Hi everyone,
I was looking through the documentation, as this looks like a very, very interesting project. However, I have a doubt regarding security best practices. Let’s suppose we have 100+ sites managed with Trellis, and 3 developers.
We create an encrypted Ansible Vault containing all the passwords used across the sites. As suggested by Ansible itself, this encrypted vault is tracked in Git (or a similar version control system) because it’s encrypted. So far, so good.
Now, imagine one of the developers leaves the team.
We perform a Vault rekey to lock the departing developer out. However, because the Vault is version-controlled in Git, the previous version of the Vault- encrypted with the old key that the former developer still possesses - is still accessible in the commit history. Inside that old version are the active passwords used by all 100+ sites.
Ideally, we should rotate ALL the passwords, but this implies an enormous amount of manual work that needs to be done very quickly. Until that rotation is completed, the former developer would still have free access to the sites, their databases, etc.
How is a situation like this typically handled with Trellis and Ansible Vault?