stateless secret management

defaults/main.yaml

@@ -1,4 +1,5 @@
 ---
 buildbot_worker_name: buildbot-worker
+buildbot_worker_password: "{{ ansible_local[_local_facts_id].worker_password }}"
 buildbot_worker_admin_info: ""
 buildbot_worker_host_info: ""

tasks/local_facts.yaml

@@ -0,0 +1,17 @@
+---
+
+- name: ansible local facts directory
+  file:
+    path: /etc/ansible/facts.d
+    state: directory
+
+- name: set ansible local fact
+  copy:
+    content: "{{_local_facts|to_json}}"
+    dest: /etc/ansible/facts.d/{{_local_facts_id}}.fact
+    mode: 0600
+  register: _local_facts_set
+
+- name: Gathering Facts
+  setup:
+  when: _local_facts_set.changed

tasks/main.yaml

@@ -1,5 +1,7 @@
 ---
 
+- import_tasks: local_facts.yaml
+
 - name: pip3 packages for buildbot-worker
   pip:
     name:
@@ -49,6 +51,20 @@
     creates: /var/lib/buildbot-worker/{{buildbot_worker_name}}/worker
   notify: restart buildbot-worker service
 
+- name: buildbot-worker name
+  lineinfile:
+    path: /var/lib/buildbot-worker/{{buildbot_worker_name}}/worker/buildbot.tac
+    regexp: '^workername *='
+    line: workername = '{{buildbot_worker_name}}'
+  notify: restart buildbot-worker service
+
+- name: buildbot-worker password
+  lineinfile:
+    path: /var/lib/buildbot-worker/{{buildbot_worker_name}}/worker/buildbot.tac
+    regexp: '^passwd *='
+    line: passwd = '{{buildbot_worker_password}}'
+  notify: restart buildbot-worker service
+
 - name: buildbot-worker host info
   copy:
     content: "{{buildbot_worker_host_info}}"

vars/main.yaml

@@ -1,4 +1,8 @@
 ---
+_local_facts_id: buildbot_worker_{{buildbot_worker_name}}
+_local_facts:
+  worker_password: "{% if not ansible_local[_local_facts_id].worker_password is defined %}{{ lookup('password', '/dev/null length=16 chars=ascii_letters') }}{% else %}{{ ansible_local[_local_facts_id].worker_password }}{% endif %}"
+
 buildbot_worker_user: "{{ buildbot_worker_name }}"
 buildbot_worker_group: "{{ buildbot_worker_name }}"
 buildbot_worker_home_directory: "/var/lib/buildbot-worker/{{ buildbot_worker_name }}"