Move all sensitive and configurable values out of compose.yaml
into a .env file (mode 0600). compose.yaml now uses ${VAR}
substitution with no embedded secrets. Added planka.env.j2
template and a dedicated Deploy .env task in the playbook.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add `when: not ansible_check_mode` to the slurp and set_fact tasks
so that dry runs don't fail when .secrets hasn't been created yet.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>