Sample Ansible playbook using environment variables.

site.yml

---

- hosts: rails
  remote_user: ubuntu
  become: yes
  become_user: root
  vars:
    secret_key_base: '{{ SECRET_KEY_BASE }}'
    secret_token: '{{ SECRET_TOKEN }}'
    db_username: '{{ DB_USERNAME }}'
    db_password: '{{ DB_PASSWORD }}'
    sendgrid_username: '{{ SENDGRID_USERNAME }}'
    sendgrid_password: '{{ SENDGRID_PASSWORD }}'
    devise_secret_key: '{{ DEVISE_SECRET_KEY }}'
    twilio_account_sid: '{{ TWILIO_ACCOUNT_SID }}'
    twilio_auth_token: '{{ TWILIO_AUTH_TOKEN }}'
    
  roles:
    - { role: timezone, tags: timezone }
    - { role: ntp, tags: ntp }
    - { role: firewall, tags: firewall }  
    - { role: base-deps, tag: base-deps }
    - { role: app_user, tags: app_user }
    - { role: postgres, tag: postgres }
    - { role: nodejs, tags: nodejs }
    - { role: passenger, tags: passenger }
    - { role: app, tags: app }

# Create a simple bash script to export a variable called ENV_VARS to pass to Ansible:
# #!/bin/bash
# export ENV_VARS="$(cat .env.staging)"
# Usage: . bin/env_vars && ansible-playbook site.yml -i inventories/production --extra-vars $ENV_VARS

Using this style allows you to make use of your current process for managing environment configuration securely (with dotenv, rbenv-vars or the like) without having to use Ansible's Vault module.