correct usage of ansible vault, I think