diff --git a/lotus-land-story/Rakefile b/lotus-land-story/Rakefile
index cae93c9..da4c765 100644
--- a/lotus-land-story/Rakefile
+++ b/lotus-land-story/Rakefile
@@ -35,9 +35,13 @@ end
 
 task "vars.yml" do |t|
   linode_volume = `terraform output -raw lotus_land_story_volume`
+  miniflux_db_password = `op read op://Private/Miniflux/db_password`.strip
   miniflux_password = `op read op://Private/Miniflux/password`.strip
   File.write(t.name, YAML.dump({
-    domain: DOMAIN, linode_volume:, miniflux_password:,
+    domain: DOMAIN,
+    linode_volume:,
+    miniflux_db_password:,
+    miniflux_password:,
   }.transform_keys(&:to_s)))
 end
 
diff --git a/lotus-land-story/main.yml b/lotus-land-story/main.yml
index 776b9a7..1b51e11 100644
--- a/lotus-land-story/main.yml
+++ b/lotus-land-story/main.yml
@@ -22,7 +22,7 @@
         path: /mnt/lotus-land-story/postgresql
         state: directory
         owner: postgres
-        mode: "0755"
+        mode: "0700"
     - name: Set data directory to volume
       ansible.builtin.lineinfile:
         dest: "/etc/postgresql/13/main/postgresql.conf"
@@ -115,7 +115,7 @@
           community.postgresql.postgresql_user:
             db: miniflux
             name: miniflux
-            password: miniflux
+            password: "{{ miniflux_db_password }}"
           notify: Restart postgres
         - name: Grant miniflux access
           community.postgresql.postgresql_pg_hba:
@@ -143,7 +143,7 @@
               ports:
                 - "8080:8080"
               environment:
-                - DATABASE_URL=postgres://miniflux:miniflux@host.docker.internal/miniflux
+                - DATABASE_URL=postgres://miniflux:{{ miniflux_db_password }}@host.docker.internal/miniflux
                 - RUN_MIGRATIONS=1
                 - CREATE_ADMIN=1
                 - ADMIN_USERNAME=alpha