i used to use an ansible playbook and a vault file to protect passwords – it’s more involved to setup buy pretty rock solid.