RH294 Ch 5: Ansible Vault

The project in `~/ansible` is ready (groups `dev`=node1, `test`=node2). Keep passwords out of plain text: create and change vaulted files, and use them in a playbook that creates accounts with hashed passwords. Two files are waiting in the project: `api.yml` (plain text) and `old-secrets.yml` (vaulted, password `oldpass`).

Tasks

1. Create the vault password file ~/ansible/vault-pass containing webasha123, readable only by you (mode 0600), and set it as the vault password file in ansible.cfg.
2. Create the vaulted file ~/ansible/secret.yml (vault password webasha123) with the variables devpass: Devp@ss1 and mgrpass: Mgrp@ss1.
3. Encrypt the existing api.yml with the same vault password.
4. Rekey old-secrets.yml (current password oldpass) to the new password webasha123.
5. Write users.yml that loads secret.yml with varsfiles and creates user devuser on dev with password devpass, and user manager on test with password mgrpass, both stored as SHA-512 hashes. Run it.