ensure folder exists before copy

group_vars/umami.yml

@@ -10,18 +10,7 @@ description: Umami web analytics
 docker_users_to_add:
   - "{{ ansible_user }}"   # add the SSH user to the docker group
 
-# --- Umami role ---
+umami_admin_password: "0cf1c36d008b67d42ad9eb5b0b802b2d"
-umami_base_dir: /opt/umami
-umami_image: "ghcr.io/umami-software/umami:latest"
-umami_container_name: umami
-umami_port: 3000                     # host port Umami will be exposed on
-
-# Address the umami_port is bound to on the host.
-# - "127.0.0.1" if your reverse proxy runs on this same host (loopback only)
-# - "0.0.0.0" if your reverse proxy is elsewhere (another host/container) and
-#   needs to reach this port over the network
-umami_bind_address: "0.0.0.0"
-
 # Postgres settings (used by the umami-db container)
 umami_db_container_name: umami-db
 umami_db_image: "postgres:15-alpine"

plays/umami.yml

@@ -6,5 +6,4 @@
   roles:
     - role: roles/firewall
     - role: roles/docker
-    - role: roles/env
     - role: roles/umami

roles/elasticsearch/tasks/tls.yml

@@ -8,7 +8,24 @@
 # provisioning time. See the role README for the IaC side of this.
 # ---------------------------------------------------------------------------
 
-- name: Assert the Cloudflare token file exists
+- name: Check if Cloudflare token file exists at legacy/staging path
+  ansible.builtin.stat:
+    path: /etc/retailor/cloudflare-token.env
+  register: elk_cf_token_src_stat
+
+- name: Ensure folder exists
+  ansible.builtin.command:
+    cmd: mkdir -p "{{ elk_lego_path }}"
+  when: elk_cf_token_src_stat.stat.exists
+  changed_when: true
+
+- name: Move Cloudflare token file into place if found at staging path
+  ansible.builtin.command:
+    cmd: cp /etc/retailor/cloudflare-token.env "{{ elk_cloudflare_token_env_file }}"
+  when: elk_cf_token_src_stat.stat.exists
+  changed_when: true
+
+- name: Assert the Cloudflare token file exists at the expected location
   ansible.builtin.stat:
     path: "{{ elk_cloudflare_token_env_file }}"
   register: elk_cf_token_stat
@@ -18,19 +35,33 @@
     msg: >
       {{ elk_cloudflare_token_env_file }} does not exist. This role expects
       cloud-init (or equivalent provisioning) to have already written a
-      scoped Cloudflare API token here before Ansible runs. See the IaC
+      scoped Cloudflare API token here before Ansible runs, or a legacy
-      notes in the role README.
+      copy at /etc/retailor/cloudflare-token.env to be moved into place. See the
+      IaC notes in the role README.
   when: not elk_cf_token_stat.stat.exists
 
-- name: Verify the token file is not world/group readable
+- name: Ensure the token file has correct ownership and permissions
+  ansible.builtin.file:
+    path: "{{ elk_cloudflare_token_env_file }}"
+    mode: "0640"
+    owner: root
+    group: root
+  when: elk_cf_token_stat.stat.exists
+
+- name: Re-stat token file after permission enforcement
+  ansible.builtin.stat:
+    path: "{{ elk_cloudflare_token_env_file }}"
+  register: elk_cf_token_stat
+
+- name: Verify the token file is not world readable
   ansible.builtin.assert:
     that:
-      - elk_cf_token_stat.stat.mode == "0600"
+      - elk_cf_token_stat.stat.mode == "0640"
     fail_msg: >
-      {{ elk_cloudflare_token_env_file }} should be mode 0600
+      {{ elk_cloudflare_token_env_file }} should be mode 0640
       (currently {{ elk_cf_token_stat.stat.mode }}) since it holds a
       Cloudflare API credential.
-    success_msg: "Cloudflare token file permissions look correct."
+    success_msg: "Cloudflare token file permissions verified."
 
 - name: Create lego directories
   ansible.builtin.file:

roles/umami/defaults/main.yml

@@ -5,3 +5,33 @@ umami_python_docker_sdk_packages:
 
 umami_restart_policy: unless-stopped
 umami_docker_network: umami_net
+
+# --- Umami role ---
+umami_base_dir: "{{ lookup('env', 'UMAMI_BASE_DIR') | default('/opt/umami', true) }}"
+umami_image: "{{ lookup('env', 'UMAMI_IMAGE') | default('ghcr.io/umami-software/umami:latest', true) }}"
+umami_container_name: "{{ lookup('env', 'UMAMI_CONTAINER_NAME') | default('umami', true) }}"
+umami_port: "{{ lookup('env', 'UMAMI_PORT') | default('3000', true) }}"   # host port Umami will be exposed on
+
+# Address the umami_port is bound to on the host.
+# - "127.0.0.1" if your reverse proxy runs on this same host (loopback only)
+# - "0.0.0.0" if your reverse proxy is elsewhere (another host/container) and
+#   needs to reach this port over the network
+umami_bind_address: "{{ lookup('env', 'UMAMI_BIND_ADDRESS') | default('0.0.0.0', true) }}"
+umami_admin_password: "{{ lookup('env', 'UMAMI_ADMIN_PASSWORD') | default('', true) }}"
+
+# Postgres settings (used by the umami-db container)
+umami_db_container_name: "{{ lookup('env', 'UMAMI_DB_CONTAINER_NAME') | default('umami-db', true) }}"
+umami_db_image: "{{ lookup('env', 'UMAMI_DB_IMAGE') | default('postgres:15-alpine', true) }}"
+umami_db_name: "{{ lookup('env', 'UMAMI_DB_NAME') | default('umami', true) }}"
+umami_db_user: "{{ lookup('env', 'UMAMI_DB_USER') | default('umami', true) }}"
+
+# IMPORTANT: override this via the UMAMI_DB_PASSWORD environment variable,
+# inventory/vars, --extra-vars, or (better) Ansible Vault.
+# Do not leave the default password in production.
+umami_db_password: "{{ lookup('env', 'UMAMI_DB_PASSWORD') | default('', true) }}"
+
+# A random string used by Umami to encrypt/salt data. Generate your own, e.g.:
+#   openssl rand -hex 32
+# Override this in production via the UMAMI_APP_SECRET environment variable,
+# --extra-vars, or vault.
+umami_app_secret: "{{ lookup('env', 'UMAMI_APP_SECRET') | default('', true) }}"

roles/umami/tasks/main.yml

@@ -45,6 +45,14 @@
   retries: 5
   delay: 10
 
+- name: Update Umami admin password via psql inside the db container
+  community.docker.docker_container_exec:
+    container: "{{ umami_db_container_name }}"
+    command: >
+      psql -U {{ umami_db_user }} -d {{ umami_db_name }} -c
+      "UPDATE \"user\" SET password = '{{ umami_admin_password }}' WHERE username = 'admin';"
+  no_log: true
+
 - name: Umami health check result
   ansible.builtin.debug:
     msg: "Umami is up and responding on port {{ umami_port }}."