What is the recommended way to lay out secret and non-secret variables for a host or group?

Make a directory per host or group under host_vars/ or group_vars/ and split it into two files: vars for normal variables in plain text, vault for secrets encrypted with ansible-vault. Ansible loads every file in the directory.

* Plain names in vars, secret values in vault, linked by a vault_ prefix. *

.
├── ansible.cfg
├── group_vars
│   └── webservers
│       └── vars
├── host_vars
│   └── demo.example.com
│       ├── vars
│       └── vault
├── inventory
└── playbook.yml

Why split it:

• Most variables stay readable and diffable in Git; only the few real secrets are encrypted.
• Anyone reviewing a change can see what changed in vars; for vault they only see that it changed.

The names vars and vault are a convention; Ansible doesn't care what the files are called. A common addition is to reference a secret indirectly: vars holds db_password: "{{ vault_db_password }}" and vault holds vault_db_password: ..., so grep still finds where db_password is defined.

Playbook variables can be protected the same way: put the secrets in a separate file, encrypt it, and load it with vars_files. Because playbook variables outrank inventory variables, that also lets you override an inventory value with a secret one.

Go deeper:

• Organizing host and group variables (official docs) — directories with several files per group or host.