Ghost

Deploys a Ghost CMS instance via Docker Compose with MySQL and ActivityPub federation, using Traefik as a reverse proxy.

Requirements

• Docker
• community.docker Ansible collection

Variables

Variable	Default	Description
ghost_instance	ghost	Unique instance name. Used as Compose project name and container name prefix. Change when running multiple instances on the same host.
ghost_version	6-alpine	Ghost image tag. Pin to a specific version in production.
ghost_activitypub_version	1.2.2	ActivityPub service image tag. Must match a published release of tryghost/activitypub.
ghost_db_version	8.0.44	MySQL image tag. Pin to a specific version in production.
ghost_data_path	/data/ghost	Host path for persistent data (Ghost uploads and MySQL data).
ghost_docker_path	/docker/ghost	Host path for the compose.yml file and MySQL init scripts.
ghost_domain	~	Public domain Ghost runs on (no protocol prefix). Required.
ghost_db_user	ghost	MySQL user. Shared by Ghost and ActivityPub.
ghost_db_pass	~	MySQL user password. Required. Generate with openssl rand -hex 32.
ghost_db_root_pass	~	MySQL root password. Required. Generate with openssl rand -hex 32.
ghost_mail_conf	~	SMTP configuration. See Mail below.
ghost_uninstall	false	Stops and removes containers and the compose directory.
ghost_purge	false	Also removes the data directory. Requires ghost_uninstall: true. Irreversible.

Usage

Minimal setup:

ghost_domain: "ghost.example.com"
ghost_db_pass: "{{ vault_ghost_db_pass }}"
ghost_db_root_pass: "{{ vault_ghost_db_root_pass }}"

Multiple instances on the same host:

# instance 1
ghost_instance: ghost_blog
ghost_domain: blog.example.com
ghost_db_pass: "secret_a"
ghost_db_root_pass: "rootsecret_a"
ghost_data_path: /data/ghost_blog
ghost_docker_path: /docker/ghost_blog

# instance 2
ghost_instance: ghost_docs
ghost_domain: docs.example.com
ghost_db_pass: "secret_b"
ghost_db_root_pass: "rootsecret_b"
ghost_data_path: /data/ghost_docs
ghost_docker_path: /docker/ghost_docs

Mail

When ghost_mail_conf is set, Ghost's SMTP mailer is enabled. Required keys: host, username, password.

ghost_mail_conf:
  host: smtp.example.com
  username: ghost@example.com
  password: secret
  address: ghost@example.com # optional, defaults to username
  port: 465 # optional, default: 465
  security: true # optional, default: true (TLS)

Uninstall

To stop and remove all containers and the compose directory:

ghost_uninstall: true

To also wipe all data including uploads and the MySQL database (irreversible):

ghost_uninstall: true
ghost_purge: true

Notes

• Ghost is Traefik-only — there is no port exposure option. ghost_domain is required.
• ActivityPub always runs alongside Ghost. It shares the MySQL instance and the uploads volume.
• ghost_data_path/uploads is owned by 1000:1000 (Ghost's container user). ghost_data_path/mysql is owned by 999:999 (MySQL's container user, mode 0700).
• The MySQL init script (files/create-multiple-databases.sh) only runs on the first container start when the data directory is empty. It creates the activitypub database automatically.