diff --git a/ansible/.gitignore b/ansible/.gitignore
index 7694a07..d5fa76b 100644
--- a/ansible/.gitignore
+++ b/ansible/.gitignore
@@ -9,3 +9,7 @@ roles/public/*
 #keep fodler holding ansible collections empty
 collections/*
 !README.md
+
+# Ignore all vaults
+vars/vaults/*
+!vars/vaults/README.md
diff --git a/ansible/playbooks/vars/vaults/README.md b/ansible/playbooks/vars/vaults/README.md
new file mode 100644
index 0000000..29ea259
--- /dev/null
+++ b/ansible/playbooks/vars/vaults/README.md
@@ -0,0 +1 @@
+All vaulted files go here. They are not available in this repo.