jokester/ansible-playbooks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: deploy pod manifests containing credentials with mode 0600

Browse Source 
gitea.yaml, immich.yaml, and metabase.yaml embed database passwords in
env vars; per repo policy, rendered files containing secrets must not
be world-readable.
This commit is contained in:
Clément Désiles
2026-07-04 00:06:29 +02:00
parent 95a743ddeb
commit 7972fe09ad
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/gitea/tasks/main.yml
+1 -1
View File
@@ -101,7 +101,7 @@
dest: "{{ podman_projects_dir | default('/opt/podman') }}/gitea/gitea.yaml" dest: "{{ podman_projects_dir | default('/opt/podman') }}/gitea/gitea.yaml"
owner: "{{ ansible_user }}" owner: "{{ ansible_user }}"
group: "{{ ansible_user }}" group: "{{ ansible_user }}"
mode: "0644" mode: "0600"
notify: Restart gitea notify: Restart gitea
- name: Get home directory for {{ ansible_user }} - name: Get home directory for {{ ansible_user }}
roles/immich/tasks/main.yml
+1 -1
View File
@@ -127,7 +127,7 @@
dest: "{{ podman_projects_dir | default('/opt/podman') }}/immich/immich.yaml" dest: "{{ podman_projects_dir | default('/opt/podman') }}/immich/immich.yaml"
owner: "{{ ansible_user }}" owner: "{{ ansible_user }}"
group: "{{ ansible_user }}" group: "{{ ansible_user }}"
mode: "0644" mode: "0600"
notify: Restart Immich notify: Restart Immich
- name: Get home directory for {{ ansible_user }} - name: Get home directory for {{ ansible_user }}
roles/metabase/tasks/main.yml
+1 -1
View File
@@ -73,7 +73,7 @@
dest: "{{ podman_projects_dir }}/metabase/metabase.yaml" dest: "{{ podman_projects_dir }}/metabase/metabase.yaml"
owner: "{{ ansible_user }}" owner: "{{ ansible_user }}"
group: "{{ ansible_user }}" group: "{{ ansible_user }}"
mode: "0644" mode: "0600"
notify: Restart Metabase notify: Restart Metabase
- name: Get home directory for {{ ansible_user }} - name: Get home directory for {{ ansible_user }}