This plugin can be useful when you need to provision your server before or after a deployment of your application (or on [any hook](https://github.com/dokku/dokku/blob/master/docs/development/plugin-triggers.md), just raise an issue and let's add it) and you prefer to use Ansible instead of Bash. For example, you make use of the [ansible-dokku](https://github.com/dokku/ansible-dokku/) roles.
You can place a `ansible/.vault.sh` script (don't forget to `chmod +x` it) that looks like this:
```bash
#!/bin/bash
set -eu -o pipefail
echo "my-cool-vault-password"
```
This file will be copied over to `$DOKKU_LIB_ROOT/data/ansible/$APP` and locked down with the correct read-only permissions for the Dokku user account. This will then be used as the [Ansible Vault](https://docs.ansible.com/ansible/latest/user_guide/vault.html) password file which can be used to decrypt secrets.
So, if you then encrypt a secret:
```bash
$ ansible-vault \
encrypt_string \
--vault-password-file ansible/.vault.sh \
--name mysecretname \
mysecretvalue
```
You can place this in your plays and it can be successfully decrypted on the host.