Add static repo cloning for pleroma, tighten locks on config

inventory/group_vars/cowfee.moe.yml

@@ -31,6 +31,7 @@ pleroma_instance_email: rehashedsalt@cock.li
 pleroma_instance_name: Cowfee
 pleroma_instance_notify_email: noreply@cowfee.moe
 pleroma_openreg: true
+pleroma_static_repo: "https://git.9iron.club/salt/pleroma"
 pleroma_db_password: !vault |
           $ANSIBLE_VAULT;1.1;AES256
           34343838386134656236313462653531663839363030333630383332386535356431326436633137

roles/pleroma/tasks/main.yml

@@ -122,7 +122,14 @@
             dest: /etc/pleroma/config.exs
             owner: pleroma
             group: pleroma
+            mode: "0640"
           notify: restart pleroma
+        - name: Clone static directory
+          git:
+            repo: "{{ pleroma_static_repo }}"
+            dest: "/var/lib/pleroma/static"
+            force: yes
+          when: pleroma_static_repo is defined
         - name: Migrate DB
           command: /opt/pleroma/bin/pleroma_ctl migrate
           args: