diff --git a/AGENTS.md b/AGENTS.md index 7dd36fe..3bf1f7e 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -134,8 +134,8 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i - `atlas_manage_storage`, `atlas_manage_sharing`, and `atlas_manage_firewall` are enabled in Atlas host vars as the declared steady state; set one false only for a deliberate suspension. `atlas_manage_media_stack` remains false until the future rootful Immich stack has its required Vault inputs and target validation. -- Atlas requires `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash` for Cockpit - and, while sharing is enabled, `vault_atlas_samba_password`. The future rootful media stack also requires +- Atlas requires `vault_atlas_admin_password_hash` for Cockpit and, while sharing is enabled, + `vault_atlas_samba_password`. The future rootful media stack also requires `vault_atlas_immich_db_password`. Never print these values. - Atlas creates the complete declared hierarchy only under the verified existing or explicitly bootstrapped pool: `work`, `archive`, `archive/app_data`, `archive/app_data/navidrome`, `archive/app_data/syncthing`, `media`, `media/music`, @@ -178,8 +178,9 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i or API access for the selected clients. - Validate the managed WireGuard path and its LAN/VPN-only firewalld rules before enabling remote services; never expose SSH, Cockpit, NFS, SMB or Syncthing through public port forwarding. -- Add the least-privilege Prometheus backup flow: remote dump generation, dedicated SSH identity, - pinned host key, atomic pull, verification, retention and an Atlas systemd service/timer. +- Add the Atlas-initiated least-privilege Prometheus backup pull: Prometheus exposes only prepared + read-only dumps through a dedicated account and Atlas retains the private SSH key, pinned host key, + atomic pull, verification, retention and systemd service/timer. - Add the encrypted offsite backup with Borg to a Hetzner Storage Box: use a dedicated SSH identity, pin the host key, keep Borg repository credentials and encryption material in Vault, use snapshot-consistent sources, and manage retries, logging, pruning, repository checks and restores. diff --git a/README.md b/README.md index 3e17482..971aeb6 100644 --- a/README.md +++ b/README.md @@ -133,6 +133,8 @@ ansible-playbook ansible/site.yml --limit prometheus \ ``` The target must already provide `server_username` with local sudo access. +Prometheus authorizes its declared SSH public keys through separate files below +`~/.ssh/authorized_keys.d/`, while `sshd` is configured to read those files directly. ### DuckDNS @@ -215,8 +217,8 @@ only manages child datasets. A one-time RAIDZ2 bootstrap is available only with It never partitions, forces, destroys, rolls back, or changes the vdev layout of an existing pool. Linux clients use NFSv4 and Windows/WSL clients use SMB; both are restricted to the configured LAN. -For the first run, provide `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash`, -`vault_atlas_samba_password`, and `vault_atlas_immich_db_password`. Bootstrap the host through its +For the first run, provide `vault_atlas_admin_password_hash`, `vault_atlas_samba_password`, and +`vault_atlas_immich_db_password`. Bootstrap the host through its existing administrator: ```bash @@ -228,7 +230,8 @@ ansible-playbook ansible/site.yml --limit atlas \ Cockpit password. Subsequent runs use `atlas_admin_username`. Atlas declares storage, sharing, and its LAN firewall rules enabled. Before the first apply, check the existing pool and mountpoints, LAN subnet, and active firewalld zone. `atlas_manage_media_stack` remains disabled until `/dev/dri`, the container -paths, and the Immich database secret are validated. +paths, and the Immich database secret are validated. Atlas reads its declared SSH public keys from +separate files below `~/.ssh/authorized_keys.d/`. With storage management enabled, Atlas creates the complete dataset hierarchy below the existing or explicitly bootstrapped `zpool`: `work`, `archive`, `archive/app_data`, the separate `archive/app_data/navidrome` and diff --git a/ansible/inventory/group_vars/server.yml b/ansible/inventory/group_vars/server.yml index 1157516..5e16bb1 100644 --- a/ansible/inventory/group_vars/server.yml +++ b/ansible/inventory/group_vars/server.yml @@ -95,3 +95,5 @@ server_sshd_settings: server_sshd_allow_users: - "{{ server_username }}" +server_ssh_authorized_keys: [] +server_ssh_authorized_key_directory: "{{ server_user_home }}/.ssh/authorized_keys.d" diff --git a/ansible/inventory/host_vars/atlas.yml b/ansible/inventory/host_vars/atlas.yml index c131589..af086b8 100644 --- a/ansible/inventory/host_vars/atlas.yml +++ b/ansible/inventory/host_vars/atlas.yml @@ -12,7 +12,13 @@ atlas_admin_group: "{{ atlas_admin_username }}" atlas_admin_home: "/home/{{ atlas_admin_username }}" atlas_admin_uid: 1000 atlas_admin_gid: 1000 -atlas_admin_ssh_keys: "{{ vault_atlas_authorized_ssh_keys | default([]) }}" +atlas_admin_ssh_keys: + - name: ikaros + key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros" + - name: nymph + key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph" + - name: siren + key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren" atlas_admin_password_hash: "{{ vault_atlas_admin_password_hash | default('!') }}" atlas_ssh_allow_tcp_forwarding: local diff --git a/ansible/inventory/host_vars/prometheus.yml b/ansible/inventory/host_vars/prometheus.yml index 599b5ea..078e9c3 100644 --- a/ansible/inventory/host_vars/prometheus.yml +++ b/ansible/inventory/host_vars/prometheus.yml @@ -7,6 +7,13 @@ ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519 server_username: rocky server_duckdns_domain: fscotto +server_ssh_authorized_keys: + - name: ikaros + key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros" + - name: nymph + key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph" + - name: siren + key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren" wireguard_overlay_enabled: true wireguard_address: 10.0.0.1/24 diff --git a/ansible/roles/profile_atlas/defaults/main.yml b/ansible/roles/profile_atlas/defaults/main.yml index 571d16a..a2cbc8e 100644 --- a/ansible/roles/profile_atlas/defaults/main.yml +++ b/ansible/roles/profile_atlas/defaults/main.yml @@ -10,6 +10,7 @@ atlas_admin_home: "/home/{{ atlas_admin_username }}" atlas_admin_uid: 1000 atlas_admin_gid: 1000 atlas_admin_ssh_keys: [] +atlas_admin_ssh_key_directory: "{{ atlas_admin_home }}/.ssh/authorized_keys.d" atlas_admin_password_hash: "!" # Local forwarding permits an administrator to tunnel a private service without allowing remote forwards. atlas_ssh_allow_tcp_forwarding: local diff --git a/ansible/roles/profile_atlas/tasks/account.yml b/ansible/roles/profile_atlas/tasks/account.yml index 6909685..55e7ff9 100644 --- a/ansible/roles/profile_atlas/tasks/account.yml +++ b/ansible/roles/profile_atlas/tasks/account.yml @@ -9,8 +9,8 @@ - atlas_ssh_allow_tcp_forwarding in ['no', 'yes', 'local', 'remote', 'all'] - "'wheel' not in atlas_immich_supplementary_groups" fail_msg: >- - Define atlas_admin_username, vault_atlas_authorized_ssh_keys and - vault_atlas_admin_password_hash before applying the Atlas profile. + Define atlas_admin_username, atlas_admin_ssh_keys and vault_atlas_admin_password_hash + before applying the Atlas profile. no_log: true - name: Create Atlas administrator group @@ -78,13 +78,26 @@ mode: "0440" validate: "visudo -cf %s" -- name: Manage Atlas administrator authorized SSH keys exclusively +- name: Ensure Atlas administrator SSH authorized key fragments directory exists tags: [atlas, services] - ansible.posix.authorized_key: - user: "{{ atlas_admin_username }}" - key: "{{ atlas_admin_ssh_keys | join('\n') }}" - state: present - exclusive: true + ansible.builtin.file: + path: "{{ atlas_admin_ssh_key_directory }}" + state: directory + owner: "{{ atlas_admin_username }}" + group: "{{ atlas_admin_group }}" + mode: "0700" + +- name: Manage Atlas administrator SSH authorized key fragments + tags: [atlas, services] + ansible.builtin.copy: + content: "{{ item.key }}\n" + dest: "{{ atlas_admin_ssh_key_directory }}/{{ item.name }}" + owner: "{{ atlas_admin_username }}" + group: "{{ atlas_admin_group }}" + mode: "0600" + loop: "{{ atlas_admin_ssh_keys }}" + loop_control: + label: "{{ item.name }}" - name: Check whether the Atlas SSH host key exists tags: [atlas, services] diff --git a/ansible/roles/profile_atlas/templates/00-atlas-hardening.conf.j2 b/ansible/roles/profile_atlas/templates/00-atlas-hardening.conf.j2 index cf2f51c..a81114d 100644 --- a/ansible/roles/profile_atlas/templates/00-atlas-hardening.conf.j2 +++ b/ansible/roles/profile_atlas/templates/00-atlas-hardening.conf.j2 @@ -4,6 +4,7 @@ PubkeyAuthentication yes PasswordAuthentication no KbdInteractiveAuthentication no AuthenticationMethods publickey +AuthorizedKeysFile {% for key in atlas_admin_ssh_keys %}%h/.ssh/authorized_keys.d/{{ key.name }}{% if not loop.last %} {% endif %}{% endfor %} X11Forwarding no AllowTcpForwarding {{ atlas_ssh_allow_tcp_forwarding }} AllowAgentForwarding no diff --git a/ansible/roles/profile_server/tasks/main.yml b/ansible/roles/profile_server/tasks/main.yml index f1d395d..f5fba74 100644 --- a/ansible/roles/profile_server/tasks/main.yml +++ b/ansible/roles/profile_server/tasks/main.yml @@ -61,6 +61,42 @@ tags: [services, podman] ansible.builtin.include_tasks: podman-compose.yml +- name: Ensure server SSH authorized key fragments directory exists + tags: [services, ssh] + ansible.builtin.file: + path: "{{ server_ssh_authorized_key_directory }}" + state: directory + owner: "{{ server_username }}" + group: "{{ server_user_group }}" + mode: "0700" + when: server_ssh_authorized_keys | length > 0 + +- name: Manage server SSH authorized key fragments + tags: [services, ssh] + ansible.builtin.copy: + content: "{{ item.key }}\n" + dest: "{{ server_ssh_authorized_key_directory }}/{{ item.name }}" + owner: "{{ server_username }}" + group: "{{ server_user_group }}" + mode: "0600" + loop: "{{ server_ssh_authorized_keys }}" + loop_control: + label: "{{ item.name }}" + when: server_ssh_authorized_keys | length > 0 + +- name: Configure server SSH authorized key fragments + tags: [services, ssh] + ansible.builtin.lineinfile: + path: /etc/ssh/sshd_config + regexp: '^\s*AuthorizedKeysFile\s+' + line: >- + AuthorizedKeysFile {{ server_ssh_authorized_keys | map(attribute='name') + | map('regex_replace', '^', '%h/.ssh/authorized_keys.d/') | join(' ') }} + state: present + validate: "sshd -t -f %s" + notify: Reload SSH service + when: server_ssh_authorized_keys | length > 0 + - name: Disable SSH root login on server tags: [services] ansible.builtin.lineinfile: diff --git a/secrets/vault.yml b/secrets/vault.yml index 8f4f2a5..019ea49 100644 --- a/secrets/vault.yml +++ b/secrets/vault.yml @@ -1,92 +1,71 @@ $ANSIBLE_VAULT;1.1;AES256 -39613737656234646631643933343136616133616631646435313739613739646232323939643939 -3530316437326161653531626464633034643332343539390a353161623661366434386339336533 -64646239383036373863623866633532666433626165326662633935383961316636653462316664 -3338313762363130310a643765656337316664323531343666346331383835666664383936393161 -65623631643438333837353638613934353766656334616565363430373462323466663963306564 -37333436633266336163396566373530326636303537313864306637323462346461656366373234 -63383330633836393534646665613966646435656438303230636364616538646438643132623166 -61646237313835336363333733343634386536356436643131386630656431363238666330646633 -65316261363639346231613364303939303334623832353766613736336434306336656636336366 -33643563343961306164326466323730613334613330306133373139636235646238366334626233 -33306161613436313337663133393664643663336635623536366137613462633532316636313730 -65633433393431383661653933376563633234373763666334633339376133373733623233643034 -64643265333539396531366539303861393837303037363832353763323438306639303865663239 -32333635616236363131356163343366343862353735356563663733346535646663613862643162 -32313635343932396362623138393036633262303963623763643736333337333730306531613164 -31353934323238336663386633616232653162616338373136373635343139343337656138623037 -64616161633564393863633564386665306462646234663162646136656430313835386137333939 -39626561616135663638633261356335366431653230633264383939363033363632386562616534 -35303465383562383233353463313733393662353036393936346134376430313761653861636136 -30333136356331303066336336366433653165393731353732313533653431363634666266663433 -31323266333665393739363339333463633463623836646161633633316164336161386636633666 -64323039653261333731643033383166653334646661626434323234346638353531653731633733 -65363335363236653935323130643662336636343734383231343433626261353363333330396661 -30336133663364363064623066303266343732383538346162656465663361626236316166326466 -66366536316533633339336666363836636138396133366534366365616430376632636563306464 -36643334393565363363626339343061333433383133613865323831653034303432323439646439 -37353235613662346633613461373137626131336164393832383235663939613366303733333663 -32396334653336353534346338306637386361326334313032366636636636666265633534393033 -66356430333866383332343132656635303262336661313735656632626561373938366265666265 -32653630366166313736396464613638396465616362386363346539326464313632306136346538 -66663839626639323033313236343162643632323039636563643166623364643063393064356364 -38356662353965313239356339326563303562353735623236396332333035326138353162333961 -31303562616166393964363233393564366666613331316263363838316635653631636436343537 -65666434356438383365353539333339616162643737626163353866663336336165626430636562 -35643563646562323938396464303339613265633132623862396561666665653032653531393065 -35623761623230643434313133346639383438613934306631616366656534333561333337323938 -37643533306361373137376433383334306137613034623665386638303738386337616365313762 -35386138366630306534346538333637303135643262313638323466623937623366663938613461 -61303439326665306139323039613032343436313966623862306464623966343362633761323135 -31623262646166303235633935663034363139393737353737353538336662313833396639326562 -61386539383430623462353264306566633562373030656639386163646534653035633064623738 -39616665666334613537366362376235336630393066316563323832636632326165646635366331 -64346239323033303665326533393038303236663736653435643662346330373166306435646430 -36303136623466396234336232366234633235313234346239356435633533356264386236353432 -61613264656664633035376331366131613865633462616161613763353239323765366438323266 -39383034303130316339663431366263376631343131633362623566633638393164393232396266 -66663637623637613831653463383532323539623361656466383634623131633962396561633361 -66376164613665306239336164356564616230306335343363326433376237646330613263323534 -33303663396239633934613864633433313264336431363732333038343766663835666636643438 -36376638396539313063646464386537656330613537343462386563643135323363383537643232 -32323930646338326564316635326463623063373161623338623865353837626135326438343961 -32323236363936373564646530323165616664393166313135626630346166363261353538656365 -31633161393739643339303830313731386333393138346437666130333565653439626165303636 -66623466663534333039343738363130383234373638333362383135396239633763343264316333 -39623135663636313565643633383232616531623431383438383730643035356666313065373431 -66646239643333646630623364616439323836346334633336343434323162363865653761356539 -31336136626337643862313938363762393263303565326135333465393633303366336531373130 -32366163333638393337323438316633626365646238663035646538393638363637323034653430 -39613434633730363461373338376232376630376134653333313634303862373839663039303265 -64616264616134643432353431356139653965356131623862633061326236346631306166656661 -63616531386564663261313566646565396439363762313438393339383165333936653230613230 -63666335376431316435313535626137313662633137376635396365306565346465373631306462 -36393066373065313934366161616431626463623130663133346534303437643834383837333938 -35366530303962383230386531653334336632363439306633303330343638316161636264646661 -33623239396234653562663332313465353239323339366632643138663363393130653037316430 -65383936313937303531366632306538626661626531636638643662623333376335343866623662 -31363130643037663032323739353436356430383462656633336238336462346563666538383166 -65653932663262656331356136663130333365636564316537353037383430333464663037323637 -36666337306261313533666233653735363639393164373339313137393337636534323966386466 -32633633346131656164353562616430643262376466316437356135366330366564356432616539 -36643337626664333731383939393662376162333161656534656432306263653438373137373563 -39343739373663363539616666663364646133393437383631346630643733656333323131643361 -32643165646130313637373561613938383565393838663965616339666663353538386262613831 -62653362373738373562646430313335623439346233663264326638306131306161623963636639 -35636139376338323530666633363437353931343438303639333835656135633038323336653261 -64393164326638336434393061383565653631356361653661373363363361366538333434383939 -65303139386262373330393865323965333937313434633261653962336630346234663766313537 -61323662633739363538393730326161616365346439343038613266613165373434613864626139 -35393261363237656665343962343035306332336630313138376661663938393336626336636662 -33653732393933646639323739303565616630356262613263363165376139363039316166653964 -61316630623139656331313864626261363232623765396139313339393564373935323132363837 -61363432633932393634383762316565393065323430333533363538353539663237313037643433 -64303430386262626135353739633038633837393037313135346334643231636163633463626234 -36336337633462613435346434643932303463396265653933306464336132323961656363353235 -64336332613035306564383066363936326133383630343230653238303762393166626563353833 -39316335303361303466623463393162333663636333363432393661656638306564356435363661 -30666664386633376439623864336366363338633330663066343563663066363562313239323030 -63353865366638663666363032616234343437613330353739336332326139323534356439376165 -63303938643039363330643363633632333864613639663838643432326237616665626434353464 -34363737366133323037656234643534373835346166363534653635323930313430343337623833 -386535373562653337356164376531646433 +34663237313764396365646239613936373362306636663862373964343131636362333265306564 +3739343661336433303637343066626263646530663464380a636363303065643130336239663335 +64323265303964383635366235656163353333393166363635333831343531356339363939333530 +6266306339323862300a353530623639643836323135363566653161356630316565323233333937 +34343637383766623036633435346131393935303736613963653762663336383336366666333961 +39346336356563383464306364373438666638353731616566656164386365373966623230313933 +61343237373034616163363733326139306665366339383866316666396138373164366363613164 +34313638373435623439326164396264393838316263633630653935626635333362386132313864 +34643937653730336637633137623937346131396330356665626564666561343630383562646563 +65393532656162323931663266323635343437613639373731623631636533326533396662373032 +61386436613235353638613731313835373137643533363936326566316165636137653438393238 +37343765356366626666363162663262313663393038323531346461343731396334623339323865 +65323464323465326364633263346561316364336431323763386138383132643136663630636439 +66393564343462663933626464623866613563376234663430353837343139346363313539313839 +65386134653932393464356562346238336535323130373235303964313664363031623137383365 +39356530666564383334626330613039303135626237393233353362363033653239343634356261 +35356533643937393834383930336633623932363435646261633837663536356462356535613030 +63626438393466616238383030643631343661613630623738323933386434636461383136376261 +39616137336134663130613234633266383434336133353334373063366232663839316536376565 +62643766316464393135633564373062663335633533626631326534333232323364343133393534 +63396465363066643261303334363966343935323635383938616539323838393235373730313832 +37313235316264643932343062353162353534653963336634373264343937653035333735393766 +32393765643535383535616335613136336566653637343835366538633737313962336531333533 +32376163613861313139393863646331386133363435373364316134376533316136396533353161 +39353737633439656466396561623938646438636664373438323866613636653963393938346363 +63616366313030623464613832336566356339343931643436393138346463356161653039666632 +63396465306630336634316632663930613637643331363236353363383162333865383536623235 +33306232333439383135306266656666616135363433636332663865633234653530666435356164 +34336338343831633966666334643436373162336333313666613766656638656530373663383036 +39366134326134323435326434383637313334336562386638346333303666396336653231396463 +37633131393564656265646530373262393231373663303133323566666630366530626439353062 +37323138656431653235303439653133303831383864376562353363373466396334373063616561 +34343932383433323331363633643432303633323337656261386339653263393832396539633938 +36303634336162613366376435366530663632656263363436666532663561636465613736303962 +35663035303437313933373533336639323563376539303730323933346636626462336530303135 +65623036326663363130326438376161303463363839653564623462663561346236393262643035 +63363631663834303734393330353730333234626236616636326236376133633635376435326630 +33383035363466326139336431353937363236303134633662653066356164656366353038366264 +63343261393865303163633166663433373362663261343166303932313061393463346662366165 +31396333633964636265326539396533343932363433636438363137356430663764373835373566 +63633265323537353666653862623030646661366531646163303261363035356138346538623466 +63323235393835353864303362356465393739303531653139316338643136346164366630383635 +64376261376465303134383938346639386563363532313532663532656462663362643339353733 +61356566613638336639323235393132623032303639393065363238366337333237363863326365 +32383563313062363166656137626639363138363236383763663262363531646133356434633636 +39653666626539356538313234636634386438386434303336313337323638383863376163356365 +32346330306361343337373636376239643538396334303038636664633666306562316435303332 +33663238336336353237396139633133386439376162616439313862323462613636646262326162 +62653237636161393938336435333730636237313363663835323932613933373466343163646331 +37383466386437303433616162323433343761623831323163363331613164376565623633356335 +61366336393938383036623962353031333735376266643866363562653965306335636531376138 +64303764343565376561623933663035646163343235646565666465323864323065636462383962 +66633336313032323333366237366561613734376132346537373136376639623163313837613235 +37393332323539303338353365373766383537626162613738343534396339613336323437646466 +61623636303665623262633632653633373931373933366138316565353938656232313961373865 +66393230663532616532666561666465313361316432376432313034343333636566626564323066 +34613331633439626233333939303461393239623262376265393132313134653537396165343262 +39303135366566623037646265616630313638383732323064303237626334383261303230383162 +66633164353330666436376666316236363164373230633062636430663632393837366630643539 +33663233306464616165613337633030656661393336613036333036666565356232333966616361 +62353465643839373266333866353135396262303461666465393736636638636462666136613461 +31373130663563393833633930323766656530616261323363383333306631653563363734343034 +64383962346463663861356362346437346630353835383062373433396335343931343462386165 +33636266306563346431376438333463653165663962346262633037393238393135323536633866 +65623663323365643233346232613936373562363532373162613533316335376138366432316362 +30303662363436636263313064363235393632353430386438663833666665316561323431396430 +64623435323461313763613730643762633535393533333635313435613665383535633161353539 +37666665313730663366646537363963636631363836353437663963656566353962633935383263 +38663930373135353336326530396636373938333934326630303138643563633934656566663963 +6461373661386230356262643732373861366139323261303961 diff --git a/secrets/vault.yml.example b/secrets/vault.yml.example index e3930e4..9f35d24 100644 --- a/secrets/vault.yml.example +++ b/secrets/vault.yml.example @@ -11,8 +11,6 @@ vault_git_work_gpg: "REPLACE_ME" vault_openai_api_key: "REPLACE_ME" vault_ikaros_authorized_ssh_keys: - "ssh-ed25519 REPLACE_ME" -vault_atlas_authorized_ssh_keys: - - "ssh-ed25519 REPLACE_ME atlas-admin" vault_atlas_admin_password_hash: "REPLACE_WITH_A_SHADOW_COMPATIBLE_HASH" vault_atlas_samba_password: "REPLACE_ME" vault_atlas_immich_db_password: "REPLACE_ME"