QUESTION; TLDR
Are there suggestions on handling FILES and VAULT FILES within a playbook and not within ROLES?
EXPLANATION
I'm familiar with the following best practices from ansible where the following directory structure is listed as such:
inventories/
production/
hosts # inventory file for production servers
group_vars/
group1.yml # here we assign variables to particular groups
group2.yml
host_vars/
hostname1.yml # here we assign variables to particular systems
hostname2.yml
staging/
hosts # inventory file for staging environment
group_vars/
group1.yml # here we assign variables to particular groups
group2.yml
host_vars/
stagehost1.yml # here we assign variables to particular systems
stagehost2.yml
library/
module_utils/
filter_plugins/
site.yml
webservers.yml
dbservers.yml
roles/
common/
webtier/
monitoring/
fooapp/
This structure works for simple projects. However a very large playbook, that uses requirements.yml to git clone roles into it's structure makes it hard to maintain items like vault files because of possible drift in vault-passwords amongst the myriad repos. From my perspective, it would be useful if the vaulted files were in a central location at the playbook level.
I was wondering if there is a way to create a playbook_dir/vault | files directory, at the same level as inventories or perhaps a playbook_dir/inventories/group_vars/vault | files directory. Then within this vault | files folder I can centralize all my necessary secret/non-secret files (such as certs and other items too long winded to be stored as a variable).
That way when the playbook is ran for [servers] it will get all the necessary variables AND vaulted | files that I need the host group to share.