From ca70fe8bf6bef825da5143e2eaa8357493d388b1 Mon Sep 17 00:00:00 2001
From: Kevin Midboe <kevin.midboe@gmail.com>
Date: Mon, 10 Aug 2026 20:23:15 +0200
Subject: [PATCH] hash before updating password

---
 roles/umami/tasks/main.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/roles/umami/tasks/main.yml b/roles/umami/tasks/main.yml
index db72541..5532ccf 100644
--- a/roles/umami/tasks/main.yml
+++ b/roles/umami/tasks/main.yml
@@ -45,12 +45,17 @@
   retries: 5
   delay: 10
 
+- name: Generate bcrypt hash for Umami admin password
+  ansible.builtin.set_fact:
+    umami_admin_password_hash: "{{ umami_admin_password | password_hash('bcrypt', rounds=10) }}"
+  no_log: true
+
 - name: Update Umami admin password via psql inside the db container
   community.docker.docker_container_exec:
     container: "{{ umami_db_container_name }}"
     command: >
       psql -U {{ umami_db_user }} -d {{ umami_db_name }} -c
-      "UPDATE \"user\" SET password = '{{ umami_admin_password }}' WHERE username = 'admin';"
+      "UPDATE \"user\" SET password = '{{ umami_admin_password_hash }}' WHERE username = 'admin';"
   no_log: true
 
 - name: Umami health check result