firewall_master: move secrets to password store

ansible.cfg

@@ -1,5 +1,4 @@
 [defaults]
 remote_user = root
 vault_identity = network
-ask_vault_pass = true
 filter_plugins = filter_plugins

roles/firewall_master/tasks/web.yml

@@ -9,7 +9,7 @@
   become_method: su
   become_flags: "-s /bin/sh"
   git:
-    repo: "{{ friwall_repo }}"
+    repo: '{{ lookup("passwordstore", "hosts/"~inventory_hostname, subkey="friwall_repo") }}'
     dest: /srv/friwall/app
     force: yes
   notify: reload uwsgi

roles/firewall_master/templates/settings.json.j2

@@ -1,10 +1,10 @@
 {
   "ldap_host": "{{ domain }}",
-  "ldap_user": "{{ ldap_user }}",
-  "ldap_pass": "{{ ldap_pass }}",
+  "ldap_user": "{{ lookup("passwordstore", "hosts/"~inventory_hostname, subkey="ldap_user") }}",
+  "ldap_pass": "{{ lookup("passwordstore", "hosts/"~inventory_hostname, subkey="ldap_pass") }}",
   "ldap_base_dn": "{{ ldap_base_dn }}",
-  "oidc_server": "{{ oidc_server }}",
-  "oidc_client_id": "{{ oidc_client_id }}",
-  "oidc_client_secret": "{{ oidc_client_secret }}",
-  "wg_net": "{{ wg_net }}",
-}
+  "oidc_server": "{{ lookup("passwordstore", "hosts/"~inventory_hostname, subkey="oidc_server") }}",
+  "oidc_client_id": "{{ lookup("passwordstore", "hosts/"~inventory_hostname, subkey="oidc_client_id") }}",
+  "oidc_client_secret": "{{ lookup("passwordstore", "hosts/"~inventory_hostname, subkey="oidc_client_secret") }}",
+  "wg_net": "{{ wg_net }}"
+}