# Secrets

Do not commit passwords, API keys, issued certificates, private keys, or `.env`
files containing secrets.

This repository is ready for these future integrations:

- Ansible Vault
- SOPS
- HashiCorp Vault
- Smallstep certificates

Role defaults deliberately use `CHANGE_ME_IN_VAULT` placeholders for required
application secrets. Override those values in encrypted inventory data before
deploying real services.