From d31278c901e3289882ed87c1bbe7771358f375fa Mon Sep 17 00:00:00 2001
From: Kevin Midboe <kevin.midboe@gmail.com>
Date: Sun, 9 Aug 2026 21:01:44 +0200
Subject: [PATCH] configure umami to read environment variables

---
 group_vars/umami.yml          | 13 +------------
 plays/umami.yml               |  1 -
 roles/umami/defaults/main.yml | 30 ++++++++++++++++++++++++++++++
 roles/umami/tasks/main.yml    |  8 ++++++++
 4 files changed, 39 insertions(+), 13 deletions(-)

diff --git a/group_vars/umami.yml b/group_vars/umami.yml
index 784018a..b51868d 100644
--- a/group_vars/umami.yml
+++ b/group_vars/umami.yml
@@ -10,18 +10,7 @@ description: Umami web analytics
 docker_users_to_add:
   - "{{ ansible_user }}"   # add the SSH user to the docker group
 
-# --- Umami role ---
-umami_base_dir: /opt/umami
-umami_image: "ghcr.io/umami-software/umami:latest"
-umami_container_name: umami
-umami_port: 3000                     # host port Umami will be exposed on
-
-# Address the umami_port is bound to on the host.
-# - "127.0.0.1" if your reverse proxy runs on this same host (loopback only)
-# - "0.0.0.0" if your reverse proxy is elsewhere (another host/container) and
-#   needs to reach this port over the network
-umami_bind_address: "0.0.0.0"
-
+umami_admin_password: "0cf1c36d008b67d42ad9eb5b0b802b2d"
 # Postgres settings (used by the umami-db container)
 umami_db_container_name: umami-db
 umami_db_image: "postgres:15-alpine"
diff --git a/plays/umami.yml b/plays/umami.yml
index 259fbf8..349079e 100644
--- a/plays/umami.yml
+++ b/plays/umami.yml
@@ -6,5 +6,4 @@
   roles:
     - role: roles/firewall
     - role: roles/docker
-    - role: roles/env
     - role: roles/umami
diff --git a/roles/umami/defaults/main.yml b/roles/umami/defaults/main.yml
index 22e2e92..cc429dc 100644
--- a/roles/umami/defaults/main.yml
+++ b/roles/umami/defaults/main.yml
@@ -5,3 +5,33 @@ umami_python_docker_sdk_packages:
 
 umami_restart_policy: unless-stopped
 umami_docker_network: umami_net
+
+# --- Umami role ---
+umami_base_dir: "{{ lookup('env', 'UMAMI_BASE_DIR') | default('/opt/umami', true) }}"
+umami_image: "{{ lookup('env', 'UMAMI_IMAGE') | default('ghcr.io/umami-software/umami:latest', true) }}"
+umami_container_name: "{{ lookup('env', 'UMAMI_CONTAINER_NAME') | default('umami', true) }}"
+umami_port: "{{ lookup('env', 'UMAMI_PORT') | default('3000', true) }}"   # host port Umami will be exposed on
+
+# Address the umami_port is bound to on the host.
+# - "127.0.0.1" if your reverse proxy runs on this same host (loopback only)
+# - "0.0.0.0" if your reverse proxy is elsewhere (another host/container) and
+#   needs to reach this port over the network
+umami_bind_address: "{{ lookup('env', 'UMAMI_BIND_ADDRESS') | default('0.0.0.0', true) }}"
+umami_admin_password: "{{ lookup('env', 'UMAMI_ADMIN_PASSWORD') | default('', true) }}"
+
+# Postgres settings (used by the umami-db container)
+umami_db_container_name: "{{ lookup('env', 'UMAMI_DB_CONTAINER_NAME') | default('umami-db', true) }}"
+umami_db_image: "{{ lookup('env', 'UMAMI_DB_IMAGE') | default('postgres:15-alpine', true) }}"
+umami_db_name: "{{ lookup('env', 'UMAMI_DB_NAME') | default('umami', true) }}"
+umami_db_user: "{{ lookup('env', 'UMAMI_DB_USER') | default('umami', true) }}"
+
+# IMPORTANT: override this via the UMAMI_DB_PASSWORD environment variable,
+# inventory/vars, --extra-vars, or (better) Ansible Vault.
+# Do not leave the default password in production.
+umami_db_password: "{{ lookup('env', 'UMAMI_DB_PASSWORD') | default('', true) }}"
+
+# A random string used by Umami to encrypt/salt data. Generate your own, e.g.:
+#   openssl rand -hex 32
+# Override this in production via the UMAMI_APP_SECRET environment variable,
+# --extra-vars, or vault.
+umami_app_secret: "{{ lookup('env', 'UMAMI_APP_SECRET') | default('', true) }}"
diff --git a/roles/umami/tasks/main.yml b/roles/umami/tasks/main.yml
index cc417e2..db72541 100644
--- a/roles/umami/tasks/main.yml
+++ b/roles/umami/tasks/main.yml
@@ -45,6 +45,14 @@
   retries: 5
   delay: 10
 
+- name: Update Umami admin password via psql inside the db container
+  community.docker.docker_container_exec:
+    container: "{{ umami_db_container_name }}"
+    command: >
+      psql -U {{ umami_db_user }} -d {{ umami_db_name }} -c
+      "UPDATE \"user\" SET password = '{{ umami_admin_password }}' WHERE username = 'admin';"
+  no_log: true
+
 - name: Umami health check result
   ansible.builtin.debug:
     msg: "Umami is up and responding on port {{ umami_port }}."