Variables defined in vars/secrets.yml can also reference remote values using third-parties lookup plugins instead of using Ansible Vault.
To generate a stub secrets file, run:
pipenv run ansible-playbook -e vault_init=plugin playbooks/secrets-init.yml
And then edit vars/secrets.yml to fill all the required arguments for the plugin you want to use as described in the plugin documentation pages: