TODO

• Password in the argument list: tasks/01_administrator.yml:15 and tasks/01_administrator.yml:34 hand the administrator password to manage.py create-profile and manage.py update-profile as the -p argument of a container exec call, so the value is part of the process argument list on the hosting node and in the backend container while the command runs, and of the command text of the task in a deploy log whenever MASK_CREDENTIALS_IN_LOGS is off. Cause: both tasks build the command line from PENPOT_ADMIN_PASSWORD. Options: drop -p and feed the value through stdin: with container exec -i, because upstream backend/scripts/manage.py (tag 2.18.1, lines 199-200 and 211-212) asks for the password with getpass() when -p is missing; or send the PREPL command from a script that reads the value from the container environment.