---
- name: Load unencrypted variables
  no_log: true
  include_vars:
    ignore_unknown_extensions: true
    dir: "{{ item }}"
    extensions:
      - yml
      - yaml
  with_items:
    - "{{ plugin_config_root }}"  # vars.yml system variables
    - "{{ app_config_root }}"  # config.yml end-user variables

- name: Check if a vault directory exists
  stat:
    path: "{{ app_config_root }}/vault"
  register: vault_dir

- name: Load encrypted variables
  no_log: true
  when: vault_dir.stat.exists
  include_vars:
    ignore_unknown_extensions: true
    dir: "{{ app_config_root }}/vault"
    extensions:
      - yml
      - yaml