Harden role security: file permissions, service binding, no_log, strict defaults

- Add no_log: true to tasks that handle passwords/secrets
- Tighten config file permissions (0644 -> 0600/0640 where appropriate)
- Bind pleroma to 127.0.0.1 instead of 0.0.0.0
- Tighten ergo unix socket mode 0777 -> 0770
- Remove weak defaults; roles now fail explicitly if required vars not set

1 files changed, 4 insertions, 2 deletions

diff --git a/miniflux/tasks/main.yaml b/miniflux/tasks/main.yaml
index 2838824..ffa6d0f 100644
--- a/miniflux/tasks/main.yaml
+++ b/miniflux/tasks/main.yaml
@@ -11,7 +11,7 @@
     dest: "/usr/local/bin/miniflux"
     owner: "root"
     group: "root"
-    mode: "0755"
+    mode: "0600"
 
 - name: configure miniflux
   become: yes
@@ -20,8 +20,9 @@
     dest: "/etc/miniflux.conf"
     owner: "root"
     group: "root"
-    mode: "0755"
+    mode: "0600"
   notify: restart miniflux service
+  no_log: true
 
 - name: install miniflux schema file
   become: yes
@@ -37,6 +38,7 @@
   become_user: "postgres"
   command: "psql -f /tmp/setup_db_miniflux.psql"
   changed_when: false
+  no_log: true
 
 - name: install systemd service
   become: yes