ansible-vault encrypt credentials

Solution 1:

I don't think you can encrypt the hosts file. A much better approach would be to have any sensitive information like credentials stored in a secondary vars file that's encrypted with ansible-vault and then just include that file in your playbook:

- hosts: all
  sudo: yes
  gather_facts: yes
  vars_files:
    - /path/to/encrypted/vars.yml

Your inventory file contains a host:

10.1.1.2

Your vars/vars.yml will store your credentials:

ansible_ssh_user: vagrant
ansible_ssh_password: vagrant

To use more than one host you can add groups in the inventory file. The hosts that are in the specific group are sharing the same credentials:

[group1]
10.1.1.2
10.1.1.3

[group2]
10.1.1.4
10.1.1.5

Your playbook will now have two hosts sections:

- hosts: group1
  vars_files:
    - vars/group1.yml

- hosts: group2
  vars_files:
    - vars/group2.yml

The group1.yml and group2.yml files must share the same password.