diff --git a/roles/dokploy/defaults/main.yaml b/roles/dokploy/defaults/main.yaml
index 835c69b..62d537a 100644
--- a/roles/dokploy/defaults/main.yaml
+++ b/roles/dokploy/defaults/main.yaml
@@ -1,5 +1,5 @@
 ---
-dokploy_state: present  # present | absent | latest
+dokploy_state: present # present | absent | latest
 dokploy_remove_data_on_absent: false
 dokploy_update_all_services: true
 dokploy_config_dir: /etc/dokploy
@@ -13,7 +13,8 @@ dokploy_traefik_image: traefik:v3.6.1
 
 dokploy_postgres_user: dokploy
 dokploy_postgres_db: dokploy
-dokploy_postgres_password: "{{ lookup('password', '/dev/null chars=ascii_letters,digits length=32') }}"
+# Must be explicitly set per-host or in vault — left empty to fail loudly
+dokploy_postgres_password: ""
 
 dokploy_docker_network: dokploy-network
 
diff --git a/roles/dokploy/tasks/delete.yaml b/roles/dokploy/tasks/delete.yaml
index 06dcfa4..190a1d1 100644
--- a/roles/dokploy/tasks/delete.yaml
+++ b/roles/dokploy/tasks/delete.yaml
@@ -9,14 +9,22 @@
     - dokploy
     - dokploy-redis
     - dokploy-postgres
-  ignore_errors: true
+  register: _dokploy_remove_services
+  failed_when:
+    - _dokploy_remove_services is failed
+    - "'could not find' not in (_dokploy_remove_services.msg | default('') | lower)"
+    - "'not found' not in (_dokploy_remove_services.msg | default('') | lower)"
   tags: dokploy, deletion
 
 - name: Leave Docker Swarm
   become: true
   community.docker.docker_swarm:
     state: absent
-  ignore_errors: true
+  register: _dokploy_swarm_leave
+  failed_when:
+    - _dokploy_swarm_leave is failed
+    - "'not part of a swarm' not in (_dokploy_swarm_leave.msg | default('') | lower)"
+    - "'not a swarm manager' not in (_dokploy_swarm_leave.msg | default('') | lower)"
   tags: dokploy, deletion
 
 - name: Remove Dokploy network
@@ -24,10 +32,14 @@
   community.docker.docker_network:
     name: "{{ dokploy_docker_network }}"
     state: absent
-  ignore_errors: true
+  register: _dokploy_remove_network
+  failed_when:
+    - _dokploy_remove_network is failed
+    - "'not found' not in (_dokploy_remove_network.msg | default('') | lower)"
   tags: dokploy, deletion
 
 - name: Remove Dokploy configuration directory
+  become: true
   ansible.builtin.file:
     path: "{{ dokploy_config_dir }}"
     state: absent
@@ -43,13 +55,17 @@
     - dokploy-postgres-database
     - redis-data-volume
     - dokploy-docker-config
+  register: _dokploy_remove_volumes
+  failed_when:
+    - _dokploy_remove_volumes is failed
+    - "'no such volume' not in (_dokploy_remove_volumes.msg | default('') | lower)"
+    - "'not found' not in (_dokploy_remove_volumes.msg | default('') | lower)"
   when: dokploy_remove_data_on_absent | bool
-  ignore_errors: true
   tags: dokploy, deletion, volumes
 
 - name: Display uninstallation message
   ansible.builtin.debug:
     msg:
       - "Dokploy has been uninstalled"
-      - "Application data preserved: {{ not dokploy_remove_data_on_absent }}"
+      - "Data removed: {{ dokploy_remove_data_on_absent | bool }}"
   tags: dokploy, deletion
diff --git a/roles/dokploy/tasks/install.yaml b/roles/dokploy/tasks/install.yaml
index 985157b..e7000e8 100644
--- a/roles/dokploy/tasks/install.yaml
+++ b/roles/dokploy/tasks/install.yaml
@@ -2,7 +2,6 @@
 - name: Check if Docker is installed
   ansible.builtin.command:
     cmd: docker --version
-  ignore_errors: false
   changed_when: false
   tags: dokploy, docker, installation
 
@@ -17,35 +16,39 @@
   become: true
   community.docker.docker_swarm:
     state: absent
-  ignore_errors: true
+  register: _dokploy_swarm_leave
+  failed_when:
+    - _dokploy_swarm_leave is failed
+    - "'not part of a swarm' not in (_dokploy_swarm_leave.msg | default('') | lower)"
+    - "'not a swarm manager' not in (_dokploy_swarm_leave.msg | default('') | lower)"
   tags: dokploy, swarm, installation
 
 - name: Determine advertise address
+  tags: dokploy, network, installation
   block:
     - name: Get private IP address
       ansible.builtin.set_fact:
-        private_ip: "{{ ansible_default_ipv4.address }}"
+        dokploy_private_ip: "{{ ansible_default_ipv4.address }}"
       when: dokploy_advertise_addr == ""
 
     - name: Set advertise address
       ansible.builtin.set_fact:
-        effective_advertise_addr: "{{ dokploy_advertise_addr | default(private_ip) }}"
-  tags: dokploy, network, installation
+        dokploy_effective_advertise_addr: "{{ dokploy_advertise_addr | default(dokploy_private_ip) }}"
 
 - name: Validate advertise address
   ansible.builtin.assert:
     that:
-      - effective_advertise_addr is defined
-      - effective_advertise_addr != ""
-    msg: "Could not determine advertise address. Please set dokploy_advertise_addr variable."
+      - dokploy_effective_advertise_addr is defined
+      - dokploy_effective_advertise_addr != ""
+    fail_msg: "Could not determine advertise address. Please set dokploy_advertise_addr variable."
   tags: dokploy, network, installation
 
 - name: Initialize Docker Swarm
   become: true
   community.docker.docker_swarm:
     state: present
-    advertise_addr: "{{ effective_advertise_addr }}"
-    listen_addr: "{{ effective_advertise_addr }}"
+    advertise_addr: "{{ dokploy_effective_advertise_addr }}"
+    listen_addr: "{{ dokploy_effective_advertise_addr }}"
   tags: dokploy, swarm, installation
 
 - name: Create dokploy overlay network
@@ -61,7 +64,7 @@
   ansible.builtin.file:
     path: "{{ dokploy_config_dir }}"
     state: directory
-    mode: "0777"
+    mode: "0755"
   tags: dokploy, files, installation
 
 - name: Pull all service images (when update all services requested)
@@ -188,7 +191,7 @@
       constraints:
         - "node.role=={{ dokploy_constraint_node_role }}"
     env:
-      ADVERTISE_ADDR: "{{ effective_advertise_addr }}"
+      ADVERTISE_ADDR: "{{ dokploy_effective_advertise_addr }}"
       DATABASE_URL: "postgres://{{ dokploy_postgres_user }}:{{ dokploy_postgres_password }}@dokploy-postgres:5432/{{ dokploy_postgres_db }}"
     state: present
   tags: dokploy, main, installation
@@ -268,6 +271,6 @@
   ansible.builtin.debug:
     msg:
       - "Dokploy installed successfully"
-      - "Using advertise address: {{ effective_advertise_addr }}"
+      - "Using advertise address: {{ dokploy_effective_advertise_addr }}"
       - "Access at: http://{{ ansible_host }}:{{ dokploy_http_port }}"
   tags: dokploy, installation
diff --git a/roles/dokploy/tasks/main.yaml b/roles/dokploy/tasks/main.yaml
index d963268..351e5f4 100644
--- a/roles/dokploy/tasks/main.yaml
+++ b/roles/dokploy/tasks/main.yaml
@@ -3,7 +3,18 @@
   ansible.builtin.assert:
     that:
       - dokploy_state in ['present', 'absent', 'latest']
-    msg: "dokploy_state must be one of: present, absent, latest"
+    fail_msg: "dokploy_state must be one of: present, absent, latest"
+  tags: always
+
+- name: Validate dokploy_postgres_password is set
+  ansible.builtin.assert:
+    that:
+      - dokploy_postgres_password | default('', true) | length > 0
+    fail_msg: >-
+      dokploy_postgres_password must be explicitly set per-host or in vault.
+      It cannot be left empty.
+    quiet: true
+  when: dokploy_state in ['present', 'latest']
   tags: always
 
 - name: Check if Dokploy services exist
@@ -11,7 +22,7 @@
   community.docker.docker_swarm_service_info:
     name: dokploy
   register: dokploy_services
-  ignore_errors: true
+  failed_when: false
   tags: always
 
 - name: Include deletion tasks if state is absent