diff --git a/README.md b/README.md
index 41f1840..0416849 100644
--- a/README.md
+++ b/README.md
@@ -36,6 +36,7 @@ Building and improving this Ansible role have been sponsored by my employer **Pr
   * [prometheus_rule_files](#prometheus_rule_files)
   * [prometheus_scrape_configs](#prometheus_scrape_configs)
   * [prometheus_scrape_interval](#prometheus_scrape_interval)
+  * [prometheus_tsdb_retention_size](#prometheus_tsdb_retention_size)
   * [prometheus_tsdb_retention_time](#prometheus_tsdb_retention_time)
   * [prometheus_version](#prometheus_version)
 * [Dependencies](#dependencies)
@@ -366,6 +367,16 @@ Global default scrape interval
 prometheus_scrape_interval: 15s
 ```
 
+### prometheus_tsdb_retention_size
+
+Retention size to define the maximum size of the data
+
+#### Default value
+
+```YAML
+prometheus_tsdb_retention_size:
+```
+
 ### prometheus_tsdb_retention_time
 
 Retention time to define the maximum age of the data
diff --git a/defaults/main.yml b/defaults/main.yml
index e19a5d9..89c429e 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -20,6 +20,9 @@ prometheus_evaluation_interval: 15s
 # @var prometheus_tsdb_retention_time:description: Retention time to define the maximum age of the data
 prometheus_tsdb_retention_time: 30d
 
+# @var prometheus_tsdb_retention_size:description: Retention size to define the maximum size of the data
+prometheus_tsdb_retention_size:
+
 # @var prometheus_rule_files:description: List of paths to read rule files from
 prometheus_rule_files:
   - /etc/prometheus/rules/*.yml
diff --git a/tasks/main.yml b/tasks/main.yml
index c894991..6866867 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -29,6 +29,7 @@
     path: "{{ item }}"
     owner: prometheus
     group: prometheus
+    mode: u=rwx,g=rx,o=rx
     state: directory
   tags:
     - prometheus
@@ -40,6 +41,7 @@
     path: "{{ item }}"
     owner: prometheus
     group: prometheus
+    mode: u=rwx,g=rx,o=rx
     state: directory
   tags:
     - prometheus
@@ -154,6 +156,7 @@
     dest: /etc/prometheus/config.yml
     owner: prometheus
     group: prometheus
+    mode: u=rw,g=r,o=r
   tags:
     - prometheus
 
@@ -224,6 +227,9 @@
   template:
     src: default.j2
     dest: /etc/default/prometheus
+    owner: root
+    group: root
+    mode: u=rw,g=r,o=r
   tags:
     - prometheus
 
@@ -233,6 +239,9 @@
   template:
     src: service.j2
     dest: /etc/systemd/system/prometheus.service
+    owner: root
+    group: root
+    mode: u=rw,g=r,o=r
   tags:
     - prometheus
 
diff --git a/tasks/oauth2.yml b/tasks/oauth2.yml
index 22bd571..4aaac35 100644
--- a/tasks/oauth2.yml
+++ b/tasks/oauth2.yml
@@ -82,6 +82,9 @@
   template:
     src: oauth2/default.j2
     dest: /etc/default/prometheus-oauth2
+    owner: root
+    group: root
+    mode: u=rw,g=r,o=r
   tags:
     - prometheus
     - oauth2
@@ -92,6 +95,9 @@
   template:
     src: oauth2/service.j2
     dest: /etc/systemd/system/prometheus-oauth2.service
+    owner: root
+    group: root
+    mode: u=rw,g=r,o=r
   tags:
     - prometheus
     - oauth2
diff --git a/templates/default.j2 b/templates/default.j2
index 8a2b581..203a733 100644
--- a/templates/default.j2
+++ b/templates/default.j2
@@ -1 +1 @@
-ARGS="--config.file=/etc/prometheus/config.yml --web.external-url={{ prometheus_domain }} --web.enable-lifecycle --web.enable-admin-api --web.console.templates=/etc/prometheus/consoles --web.console.libraries=/etc/prometheus/console_libraries --storage.tsdb.path=/var/lib/prometheus --storage.tsdb.retention.time={{ prometheus_tsdb_retention_time }} --web.listen-address={{ prometheus_listen_address }}"
+ARGS="--config.file=/etc/prometheus/config.yml --web.external-url={{ prometheus_domain }} --web.enable-lifecycle --web.enable-admin-api --web.console.templates=/etc/prometheus/consoles --web.console.libraries=/etc/prometheus/console_libraries --storage.tsdb.path=/var/lib/prometheus{{ ' --storage.tsdb.retention.time=' + prometheus_tsdb_retention_time if prometheus_tsdb_retention_time | default(False) else '' }}{{ ' --storage.tsdb.retention.size=' + prometheus_tsdb_retention_size if prometheus_tsdb_retention_size | default(False) else '' }} --web.listen-address={{ prometheus_listen_address }}"