added env file

.gitignore

@@ -1 +1,2 @@
 ansible/inventory
+ansible/passwords/

ansible/lemmy.yml

@@ -22,14 +22,28 @@
     file: path={{item.path}} state=directory
     with_items:
       - { path: '/lemmy/' }
+      - { path: '/lemmy/volumes/' }
+      - { path: '/var/www/certbot' }
 
   - name:  add all template files
     template: src={{item.src}} dest={{item.dest}}
     with_items:
-      - { src: '../docker/prod/docker-compose.yml', dest: '/lemmy/docker-compose.yml' }
+      - { src: 'templates/env', dest: '/lemmy/.env' }
-      - { src: 'nginx.conf', dest: '/lemmy/nginx.conf' }
+      - { src: 'templates/docker-compose.yml', dest: '/lemmy/docker-compose.yml' }
+      - { src: 'templates/nginx.conf', dest: '/lemmy/nginx.conf' }
+    vars:
+      postgres_password: "{{ lookup('password', 'passwords/{{ inventory_hostname }}/postgres chars=ascii_letters,digits') }}"
+      jwt_password: "{{ lookup('password', 'passwords/{{ inventory_hostname }}/jwt chars=ascii_letters,digits') }}"
 
-  - name: request letsencrypt certificates
+  - name: set env file permissions
+    file:
+      path: "/lemmy/.env"
+      state: touch
+      mode: 0600
+      access_time: preserve
+      modification_time: preserve
+
+  - name: request initial letsencrypt certificate
     command: certbot certonly --standalone --agree-tos -d '{{ domain }}' -m '{{ letsencrypt_contact_email }}'
     args:
       creates: '/etc/letsencrypt/live/{{domain}}/privkey.pem'
@@ -46,9 +60,9 @@
       state: present
       pull: yes
 
-  - name: renew certbot certificates
+  - name: certbot renewal cronjob
     cron:
       special_time=daily
       name=certbot-renew
       user=root
-      job="certbot certonly --webroot --webroot-path=/peertube/volumes/certbot/ -d '{{ domain }}' --deploy-hook 'docker-compose -f /peertube/docker-compose.yml exec nginx nginx -s reload'"
+      job="certbot certonly --webroot --webroot-path=/var/www/certbot -d '{{ domain }}' --deploy-hook 'docker-compose -f /peertube/docker-compose.yml exec nginx nginx -s reload'"

ansible/templates/docker-compose.yml

@@ -1,32 +1,32 @@
 version: '2.4'
 
 services:
+
   db:
     image: postgres:12-alpine
     restart: always
     environment:
-      POSTGRES_USER: rrr
+      POSTGRES_USER=lemmy
-      POSTGRES_PASSWORD: rrr
+      POSTGRES_PASSWORD=${DATABASE_PASSWORD}
-      POSTGRES_DB: rrr
+      POSTGRES_DB=lemmy
     volumes:
-      - db:/var/lib/postgresql/data
+      - ./volumes/db:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U rrr"]
+      test: ["CMD-SHELL", "pg_isready -U lemmy"]
       interval: 5s
       timeout: 5s
       retries: 20
+
   lemmy:
     image: dessalines/lemmy:v0.0.7.3
+    restart: always
     ports:
       - "8536:8536"
     environment:
-      LEMMY_FRONT_END_DIR: /app/dist
+      LEMMY_FRONT_END_DIR=/app/dist
-      DATABASE_URL: postgres://rrr:rrr@db:5432/rrr
+      DATABASE_URL=postgres://rrr:rrr@db:5432/rrr
-      JWT_SECRET: changeme
+      JWT_SECRET=${JWT_SECRET}
-      HOSTNAME: rrr
+      HOSTNAME=${DOMAIN}
-    restart: always
     depends_on: 
       db: 
         condition: service_healthy 
-volumes:
-  db:

ansible/templates/env

@@ -0,0 +1,4 @@
+DOMAIN={{ domain }}
+DATABASE_PASSWORD={{ postgres_password }}
+DATABASE_URL=postgres://lemmy:${DATABASE_PASSWORD}@db:5432/lemmy
+JWT_SECRET={{ jwt_password }}