Currently we store templates for every .env file, so that bitwarden secrets are filled in when setting up the service.
However, this requires us to maintain an up-to-date copy for every service. If a sample.env is expanded, our copy becomes outdated.
Solution
Remove all templates of .env files, and create a playbook (bunch of tasks) which copy a sample.env to .env and fill in all empty values, as defined in a variables file within Ansible. This variables file has key-value pairs which read the bitwarden secrets.
The result is not having to adjust anything to the .env, unless a new type of credential needs to be inserted - for which you need to update bitwarden anyway.
Currently we store templates for every .env file, so that bitwarden secrets are filled in when setting up the service.
However, this requires us to maintain an up-to-date copy for every service. If a sample.env is expanded, our copy becomes outdated.
Solution
Remove all templates of .env files, and create a playbook (bunch of tasks) which copy a sample.env to .env and fill in all empty values, as defined in a variables file within Ansible. This variables file has key-value pairs which read the bitwarden secrets.
The result is not having to adjust anything to the .env, unless a new type of credential needs to be inserted - for which you need to update bitwarden anyway.