Introduction
============

``debops.secret`` role enables you to have a separate directory on the Ansible
Controller (different than the playbook directory and inventory directory)
which can be used as a handy "workspace" for other roles.

Some usage examples of this role in `DebOps`_ include:

- password lookups, either from current role, or using known location of
  passwords from other roles, usually dependencies (for example
  ``debops.mysql`` role can manage an user account in the database with
  random password and other role can lookup that password to include in
  a generated configuration file);

- secure file storage, for example for application keys generated on remote
  hosts (``debops.boxbackup`` role retrieves client keys for backup
  purposes), for that reason secret directory should be protected by an
  external means, for example encrypted filesystem (currently there is no
  encryption provided by default);

- secure workspace (``debops.boxbackup`` role, again, uses the secret directory
  to create and manage Root CA for backup servers – client and server
  certificates are automatically downloaded to Ansible Controller, signed and
  uploaded to destination hosts);

- simple centralized backup (specific roles like ``debops.sshd``,
  ``debops.pki`` and ``debops.monkeysphere`` have separate task lists that
  are invoked by custom playbooks to allow backup and restoration of ssh host
  keys and SSL certificates. Generated .tar.gz files are kept on Ansible
  Controller in secret directory).

.. _DebOps: http://debops.org/

