From 7972fe09ade86d19d1146080fa24c86e40ea9e1e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20D=C3=A9siles?=
 <1536672+cdesiles@users.noreply.github.com>
Date: Sat, 4 Jul 2026 00:06:29 +0200
Subject: [PATCH] security: deploy pod manifests containing credentials with
 mode 0600

gitea.yaml, immich.yaml, and metabase.yaml embed database passwords in
env vars; per repo policy, rendered files containing secrets must not
be world-readable.
---
 roles/gitea/tasks/main.yml    | 2 +-
 roles/immich/tasks/main.yml   | 2 +-
 roles/metabase/tasks/main.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/roles/gitea/tasks/main.yml b/roles/gitea/tasks/main.yml
index 95618e6..8e7d0ee 100644
--- a/roles/gitea/tasks/main.yml
+++ b/roles/gitea/tasks/main.yml
@@ -101,7 +101,7 @@
     dest: "{{ podman_projects_dir | default('/opt/podman') }}/gitea/gitea.yaml"
     owner: "{{ ansible_user }}"
     group: "{{ ansible_user }}"
-    mode: "0644"
+    mode: "0600"
   notify: Restart gitea
 
 - name: Get home directory for {{ ansible_user }}
diff --git a/roles/immich/tasks/main.yml b/roles/immich/tasks/main.yml
index 86d7ed1..23edcc8 100644
--- a/roles/immich/tasks/main.yml
+++ b/roles/immich/tasks/main.yml
@@ -127,7 +127,7 @@
     dest: "{{ podman_projects_dir | default('/opt/podman') }}/immich/immich.yaml"
     owner: "{{ ansible_user }}"
     group: "{{ ansible_user }}"
-    mode: "0644"
+    mode: "0600"
   notify: Restart Immich
 
 - name: Get home directory for {{ ansible_user }}
diff --git a/roles/metabase/tasks/main.yml b/roles/metabase/tasks/main.yml
index 7da141a..5a68dce 100644
--- a/roles/metabase/tasks/main.yml
+++ b/roles/metabase/tasks/main.yml
@@ -73,7 +73,7 @@
     dest: "{{ podman_projects_dir }}/metabase/metabase.yaml"
     owner: "{{ ansible_user }}"
     group: "{{ ansible_user }}"
-    mode: "0644"
+    mode: "0600"
   notify: Restart Metabase
 
 - name: Get home directory for {{ ansible_user }}