feat: add system maintenance automation

deployment/ansible/roles/application/tasks/sync.yml

@@ -79,6 +79,14 @@
     mode: '0644'
   when: application_nginx_src.stat.exists
 
+- name: Expose secrets for template rendering
+  set_fact:
+    db_password: "{{ application_db_password }}"
+    redis_password: "{{ application_redis_password }}"
+    db_username: "{{ db_user | default(db_user_default) }}"
+    db_name: "{{ db_name | default(db_name_default) }}"
+  no_log: yes
+
 - name: Render application environment file
   template:
     src: "{{ application_env_template }}"
@@ -86,9 +94,3 @@
     owner: "{{ ansible_user }}"
     group: "{{ ansible_user }}"
     mode: '0600'
-  vars:
-    db_password: "{{ application_db_password }}"
-    db_user: "{{ db_user | default(db_user_default) }}"
-    db_name: "{{ db_name | default(db_name_default) }}"
-    redis_password: "{{ application_redis_password }}"
-    app_domain: "{{ app_domain }}"