use ansible vault

trung wants it very early in the process