configure umami to read environment variables

group_vars/umami.yml

@@ -10,18 +10,7 @@ description: Umami web analytics
 docker_users_to_add:
   - "{{ ansible_user }}"   # add the SSH user to the docker group
 
-# --- Umami role ---
+umami_admin_password: "0cf1c36d008b67d42ad9eb5b0b802b2d"
-umami_base_dir: /opt/umami
-umami_image: "ghcr.io/umami-software/umami:latest"
-umami_container_name: umami
-umami_port: 3000                     # host port Umami will be exposed on
-
-# Address the umami_port is bound to on the host.
-# - "127.0.0.1" if your reverse proxy runs on this same host (loopback only)
-# - "0.0.0.0" if your reverse proxy is elsewhere (another host/container) and
-#   needs to reach this port over the network
-umami_bind_address: "0.0.0.0"
-
 # Postgres settings (used by the umami-db container)
 umami_db_container_name: umami-db
 umami_db_image: "postgres:15-alpine"

plays/umami.yml

@@ -6,5 +6,4 @@
   roles:
     - role: roles/firewall
     - role: roles/docker
-    - role: roles/env
     - role: roles/umami

roles/umami/defaults/main.yml

@@ -5,3 +5,33 @@ umami_python_docker_sdk_packages:
 
 umami_restart_policy: unless-stopped
 umami_docker_network: umami_net
+
+# --- Umami role ---
+umami_base_dir: "{{ lookup('env', 'UMAMI_BASE_DIR') | default('/opt/umami', true) }}"
+umami_image: "{{ lookup('env', 'UMAMI_IMAGE') | default('ghcr.io/umami-software/umami:latest', true) }}"
+umami_container_name: "{{ lookup('env', 'UMAMI_CONTAINER_NAME') | default('umami', true) }}"
+umami_port: "{{ lookup('env', 'UMAMI_PORT') | default('3000', true) }}"   # host port Umami will be exposed on
+
+# Address the umami_port is bound to on the host.
+# - "127.0.0.1" if your reverse proxy runs on this same host (loopback only)
+# - "0.0.0.0" if your reverse proxy is elsewhere (another host/container) and
+#   needs to reach this port over the network
+umami_bind_address: "{{ lookup('env', 'UMAMI_BIND_ADDRESS') | default('0.0.0.0', true) }}"
+umami_admin_password: "{{ lookup('env', 'UMAMI_ADMIN_PASSWORD') | default('', true) }}"
+
+# Postgres settings (used by the umami-db container)
+umami_db_container_name: "{{ lookup('env', 'UMAMI_DB_CONTAINER_NAME') | default('umami-db', true) }}"
+umami_db_image: "{{ lookup('env', 'UMAMI_DB_IMAGE') | default('postgres:15-alpine', true) }}"
+umami_db_name: "{{ lookup('env', 'UMAMI_DB_NAME') | default('umami', true) }}"
+umami_db_user: "{{ lookup('env', 'UMAMI_DB_USER') | default('umami', true) }}"
+
+# IMPORTANT: override this via the UMAMI_DB_PASSWORD environment variable,
+# inventory/vars, --extra-vars, or (better) Ansible Vault.
+# Do not leave the default password in production.
+umami_db_password: "{{ lookup('env', 'UMAMI_DB_PASSWORD') | default('', true) }}"
+
+# A random string used by Umami to encrypt/salt data. Generate your own, e.g.:
+#   openssl rand -hex 32
+# Override this in production via the UMAMI_APP_SECRET environment variable,
+# --extra-vars, or vault.
+umami_app_secret: "{{ lookup('env', 'UMAMI_APP_SECRET') | default('', true) }}"

roles/umami/tasks/main.yml

@@ -45,6 +45,14 @@
   retries: 5
   delay: 10
 
+- name: Update Umami admin password via psql inside the db container
+  community.docker.docker_container_exec:
+    container: "{{ umami_db_container_name }}"
+    command: >
+      psql -U {{ umami_db_user }} -d {{ umami_db_name }} -c
+      "UPDATE \"user\" SET password = '{{ umami_admin_password }}' WHERE username = 'admin';"
+  no_log: true
+
 - name: Umami health check result
   ansible.builtin.debug:
     msg: "Umami is up and responding on port {{ umami_port }}."