From 55de2bd8aef0889523d3d04d82a564b0ab5129aa Mon Sep 17 00:00:00 2001
From: Alex Frantz <alex@alexav.gg>
Date: Sat, 14 Feb 2026 16:10:03 -0500
Subject: [PATCH] secure cobalt

---
 tasks/cobalt.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tasks/cobalt.yml b/tasks/cobalt.yml
index 1ae42cf..e1a03e2 100644
--- a/tasks/cobalt.yml
+++ b/tasks/cobalt.yml
@@ -4,6 +4,8 @@
     name: docker
   vars:
     name: cobalt
+    directories:
+      - "{{ data_dir }}/cobalt"
     image:
       name: ghcr.io/imputnet/cobalt
       tag: 11
@@ -12,8 +14,12 @@
       TURNSTILE_SITEKEY: "{{ COBALT_TURNSTILE_SITEKEY }}"
       TURNSTILE_SECRET: "{{ COBALT_TURNSTILE_SECRET }}"
       JWT_SECRET: "{{ COBALT_JWT_SECRET }}"
+      API_AUTH_REQUIRED: 1
+      API_KEY_URL: "file:///keys.json"
     networks:
       - name: "{{ docker_network_name }}"
+    volumes:
+      - "{{ data_dir }}/cobalt/keys.json:/keys.json:ro"
     labels:
       traefik.enable: "true"
       traefik.http.routers.cobalt.rule: Host(`dl.alexav.gg`)