Refactor planka deployment to use .env file for secrets

Move all sensitive and configurable values out of compose.yaml
into a .env file (mode 0600). compose.yaml now uses ${VAR}
substitution with no embedded secrets. Added planka.env.j2
template and a dedicated Deploy .env task in the playbook.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

playbooks/planka.yml

@@ -86,6 +86,16 @@
         planka_access_token: "{{ (_secrets_file.content | b64decode).split('\n') | select('match', '^INTERNAL_ACCESS_TOKEN=') | first | regex_replace('^INTERNAL_ACCESS_TOKEN=', '') }}"
       when: not ansible_check_mode
 
+    - name: Deploy .env
+      ansible.builtin.template:
+        src: templates/planka.env.j2
+        dest: "{{ planka_stack_dir }}/.env"
+        owner: root
+        group: root
+        mode: "0600"
+      notify: Restart planka
+      when: not ansible_check_mode
+
     - name: Deploy compose.yaml
       ansible.builtin.template:
         src: templates/planka-compose.yml.j2

playbooks/templates/planka-compose.yml.j2

@@ -6,28 +6,28 @@ networks:
 
 services:
   planka:
-    image: ghcr.io/plankanban/planka:{{ planka_version }}
+    image: ghcr.io/plankanban/planka:${PLANKA_VERSION}
     container_name: planka_app
     restart: unless-stopped
     ports:
-      - "{{ planka_port }}:1337"
+      - "${PLANKA_PORT}:1337"
     volumes:
       - favicons:/app/public/favicons
       - user-avatars:/app/public/user-avatars
       - background-images:/app/public/background-images
       - attachments:/app/private/attachments
     environment:
-      BASE_URL: {{ planka_base_url }}
-      DATABASE_URL: postgresql://postgres@postgres/{{ planka_db_name }}
-      SECRET_KEY: {{ planka_secret_key }}
-      INTERNAL_ACCESS_TOKEN: {{ planka_access_token }}
-      LOG_LEVEL: {{ planka_log_level }}
-      TRUST_PROXY: "{{ planka_trust_proxy | lower }}"
-      TOKEN_EXPIRES_IN: "{{ planka_token_expires_in }}"
-      DEFAULT_ADMIN_EMAIL: {{ planka_admin_email }}
-      DEFAULT_ADMIN_PASSWORD: {{ planka_admin_password }}
-      DEFAULT_ADMIN_NAME: {{ planka_admin_name }}
-      DEFAULT_ADMIN_USERNAME: {{ planka_admin_username }}
+      BASE_URL: ${BASE_URL}
+      DATABASE_URL: postgresql://postgres@postgres/${POSTGRES_DB}
+      SECRET_KEY: ${SECRET_KEY}
+      INTERNAL_ACCESS_TOKEN: ${INTERNAL_ACCESS_TOKEN}
+      LOG_LEVEL: ${LOG_LEVEL}
+      TRUST_PROXY: ${TRUST_PROXY}
+      TOKEN_EXPIRES_IN: ${TOKEN_EXPIRES_IN}
+      DEFAULT_ADMIN_EMAIL: ${DEFAULT_ADMIN_EMAIL}
+      DEFAULT_ADMIN_PASSWORD: ${DEFAULT_ADMIN_PASSWORD}
+      DEFAULT_ADMIN_NAME: ${DEFAULT_ADMIN_NAME}
+      DEFAULT_ADMIN_USERNAME: ${DEFAULT_ADMIN_USERNAME}
     depends_on:
       postgres:
         condition: service_healthy
@@ -42,10 +42,10 @@ services:
     volumes:
       - db-data:/var/lib/postgresql/data
     environment:
-      POSTGRES_DB: {{ planka_db_name }}
+      POSTGRES_DB: ${POSTGRES_DB}
       POSTGRES_HOST_AUTH_METHOD: trust
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U postgres -d {{ planka_db_name }}"]
+      test: ["CMD-SHELL", "pg_isready -U postgres -d ${POSTGRES_DB}"]
       interval: 10s
       timeout: 5s
       retries: 5

playbooks/templates/planka.env.j2

@@ -0,0 +1,14 @@
+# Planka environment — managed by Ansible, do not edit manually
+BASE_URL={{ planka_base_url }}
+SECRET_KEY={{ planka_secret_key }}
+INTERNAL_ACCESS_TOKEN={{ planka_access_token }}
+LOG_LEVEL={{ planka_log_level }}
+TRUST_PROXY={{ planka_trust_proxy | lower }}
+TOKEN_EXPIRES_IN={{ planka_token_expires_in }}
+DEFAULT_ADMIN_EMAIL={{ planka_admin_email }}
+DEFAULT_ADMIN_PASSWORD={{ planka_admin_password }}
+DEFAULT_ADMIN_NAME={{ planka_admin_name }}
+DEFAULT_ADMIN_USERNAME={{ planka_admin_username }}
+PLANKA_VERSION={{ planka_version }}
+PLANKA_PORT={{ planka_port }}
+POSTGRES_DB={{ planka_db_name }}