Review .env -> encrypted vault methodology about bots HOT 1 OPEN

I've been thinking about this for a few days and I believe it does make sense, with a few things to note:

1. Ansible 1's vault implementation leaves a lot to be desired and should not be considered secure, so make sure you're using Ansible 2.x
2. Ansible 2's vault implementation is IMO secure, despite a few interesting choices that show a lack of total understanding of some of the cryptographic building blocks used. Which is to say there are probably more secure ways to deal with secrets than Ansible Vault but hey, this isn't nuclear codes we're protecting.
3. Environment variables on a server may be leaked in log or dump data and as such should be considered available to all users/processes on a machine. Where possible try to use local variables or make sure you're comfortable with the data that could be leaked.

These notes aside I think your approach is sensible 👍

from bots.