File permissions are world readable

[tiny-pangolin]

File permissions for vmauth are currently set as 644 and contain passwords and bearer tokens. These files should be set to 640 so they are not world readable and should be set so that the Victoriametrics user and Victoriametrics group own these files.

[zekker6]

vmauth role only uses 0644 for systemd service configuration:

ansible-playbooks/roles/vmauth/tasks/configure.yml

Lines 2 to 9 in 6a20a47

	- name: "Systemd | Copy vmauth systemd unit file"
	ansible.builtin.template:
	src: vmauth.service.j2
	dest: /etc/systemd/system/vmauth.service
	owner: root
	group: root
	mode: 0644
	notify: Restart vmauth service

It is not safe to change this as systemd itself is not running as root or same user as VictoriaMetrics components, so it will not be able to read those.

Service configuration does cannot include any passwords or tokens. Instead, authentication credentials are stored in configuration file which has 0600 permissions:

ansible-playbooks/roles/vmauth/tasks/configure.yml

Lines 25 to 35 in 6a20a47

	- name: Template auth config
	ansible.builtin.template:
	src: auth.yaml.j2
	dest: "{{ vmauth_config_dir }}/auth.yaml"
	owner: "{{ vmauth_system_user }}"
	group: "{{ vmauth_system_group }}"
	mode: 0600
	no_log: true
	when:
	- vmauth_auth_config != ""
	notify: Restart vmauth service

Additionally, roles uses configuration defined by vmauth_config to pass it via Environment file to systemd service. This file is also using 0600 by default:

ansible-playbooks/roles/vmauth/tasks/configure.yml

Lines 37 to 44 in 6a20a47

	- name: Setup environment file
	ansible.builtin.template:
	dest: "{{ vmauth_config_dir }}/vmauth.conf"
	src: "vmauth.conf.j2"
	owner: "{{ vmauth_system_user }}"
	group: "{{ vmauth_system_group }}"
	mode: 0600
	notify: Restart vmauth service

So I would say that the problem does not exist with vmauth, but it would be great to add a clear explanation of how to use these configuration options to get a properly secured setup.
Also, it seems like Environment= option support is implemented differently in other roles, so it would be great to unify the way it works across all roles and add a doc for this.