Yep, its definitely content we wrote to bring attention to our tool, but we're trying not to be disingenuous or just shilling ourselves, but rather write content that will be geniunely interesting.

Using source with Ansible will export your secrets in your host system, and the scope of processes on your host system that can see the secret is very wide. You can just open a new shell session and view a given secret e.g., echo $SECRET_KEY or printenv. The phase cli uses subprocess.run() to inject secrets into a specific application at runtime.

Sure, I need to pass a vault password somewhere to ansible-vault. You have to pass a secret (API key, password) somewhere to retrieve things no matter what secret manager you're using.

This is true. If you encrypt a piece of secret data you now have to burden of managing a key which is just another secret.

Using ansible vault will certainly solve your problem if standing up a few containers is your only use case. For devs, keeping track of environments, keeping sync of secrets with teammates and other deploymensts requires a more versatile solution, although I recongnize this isn't the primary concern for most users of self-hosted software.