Secrets

ansible vault secrets are stored in group_vars/all/vault.yml

Note that the directory path and filename are important.

The format of the file is

---
become_pass: <ansible_user_become_pass>

Secrets required for Terraform can be stored in a file:

ex. terraform/.secrets which is already ignored by Git

Required variables:

export TF_VAR_cloudflare_token=<cloudflare_token>
export TF_VAR_zone_id=<cloudflare_zone_id>
export TF_VAR_account_id=<cloudflare_account_id>
export TF_VAR_tunnel_secret=<tunnel_secret>

Note the cloudflare token requires Zone/DNS:edit and Account/Cloudflare Tunnel:edit privs

I generate tunnel secrets with this command:

hexdump -vn32 -e'4/4 "%08X"' /dev/urandom | base64 -w0 -