diff --git a/roles/mastodon/meta/argument_specs.yml b/roles/mastodon/meta/argument_specs.yml
new file mode 100644
index 0000000..ab10c55
--- /dev/null
+++ b/roles/mastodon/meta/argument_specs.yml
@@ -0,0 +1,37 @@
+---
+argument_specs:
+  main:
+    options:
+      vapid_public_key:
+        type: str
+        required: true
+      vapid_private_key:
+        type: str
+        required: true
+      otp_secret:
+        type: str
+        required: true
+      secret_key_base:
+        type: str
+        required: true
+      db_pass:
+        type: str
+        required: true
+      smtp_password:
+        type: str
+        required: true
+      aws_secret_access_key:
+        type: str
+        required: true
+      active_record_encryption_deterministic_key:
+        type: str
+        required: true
+      active_record_encryption_key_derivation_salt:
+        type: str
+        required: true
+      active_record_encryption_primary_key:
+        type: str
+        required: true
+      ldap_password:
+        type: str
+        required: true
diff --git a/roles/mastodon/vars/main.yml b/roles/mastodon/vars/main.yml
index b6e33a7..4d11481 100644
--- a/roles/mastodon/vars/main.yml
+++ b/roles/mastodon/vars/main.yml
@@ -2,25 +2,17 @@ version: v4.3.0
 
 local_domain: m.comfycamp.space
 
-vapid_public_key: change_me
-vapid_private_key: change_me
-otp_secret: change_me
-secret_key_base: change_me
-
 db_host: postgresql
 db_user: mastodon
 db_name: mastodon
-db_pass: change_me
 db_port: "5432"
 
 smtp_server: comfycamp.space
 smtp_port: "465"
 smtp_login: mastodon@comfycamp.space
-smtp_password: change_me
 smtp_from_address: mastodon@comfycamp.space
 
 s3_endpoint: http://minio:9000
 s3_hostname: s3.comfycamp.space
 s3_bucket: mastodon
 aws_access_key_id: WfSoEsOL1Glg9GXc3sRN
-aws_secret_access_key: change_me