• role defaults • inventory file or script group vars • inventory group_vars/all • playbook group_vars/all • inventory group_vars/* • playbook group_vars/* • inventory file or script host vars
for clear separation & to easily handle one off differences Use Python or some other environment variable system for managing your secrets! Couple variables to the most focused point, then raise their scope as you need