Get the Database Password Out of Git

Encrypt a rotated credential with Vault and wire up the passphrase file.

A intermediate Ansible challenge worth 10 points. Solve it hands-on in a real Ansible environment in your browser - no local setup, no fake shells.

The Challenge

Scenario: Security finding SEC-771 - a production database password sits in clear text in group_vars/dbservers/vars.yml, committed two years ago. The credential has also been rotated.

Create an encrypted group_vars/dbservers/vault.yml holding vault_db_password: Pa55w0rd-rotate-2026, reference it from vars.yml, wire /home/labuser/.vault_pass into ansible.cfg so plain ansible-playbook site.yml works, and leave no clear-text secret in the project. Then run check.