From 2512f6cb866d1f228ccd11259485dda44a1faa9a Mon Sep 17 00:00:00 2001
From: Phil <phil@tsol.re>
Date: Sat, 31 Oct 2026 10:00:29 -0600
Subject: [PATCH] Reset Gokapi and log in with Pocket ID

Gokapi now keeps its config and data in /opt/stacks/gokapi instead of named
volumes. config.json is templated with Pocket ID as the OIDC provider, so a
fresh install never shows the open /setup wizard. On a new database a one-off
run with --deployment-password creates the super admin, after which only
existing users can log in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 group_vars/docker/services.yml               |  4 +-
 roles/docker/tasks/productivity/gokapi.yml   | 45 ++++++++++++++++++++
 roles/docker/templates/gokapi-compose.yml.j2 | 11 ++---
 roles/docker/templates/gokapi-config.json.j2 | 38 +++++++++++++++++
 4 files changed, 90 insertions(+), 8 deletions(-)
 create mode 100644 roles/docker/templates/gokapi-config.json.j2

diff --git a/group_vars/docker/services.yml b/group_vars/docker/services.yml
index 5f7771c..073039b 100644
--- a/group_vars/docker/services.yml
+++ b/group_vars/docker/services.yml
@@ -18,4 +18,6 @@ services:
   # Service-specific configurations
   dawarich:
     db_name: "dawarich"
-    db_user: "dawarich"
\ No newline at end of file
+    db_user: "dawarich"
+# Gokapi super admin: must match the Pocket ID account email
+gokapi_admin_email: "phil@{{ primary_domain }}"
diff --git a/roles/docker/tasks/productivity/gokapi.yml b/roles/docker/tasks/productivity/gokapi.yml
index e1ed8b6..f93ef31 100644
--- a/roles/docker/tasks/productivity/gokapi.yml
+++ b/roles/docker/tasks/productivity/gokapi.yml
@@ -1,10 +1,16 @@
 ---
+# Gokapi logs in through Pocket ID. config.json is written only on a fresh
+# install (Gokapi rewrites it on upgrades), so changing the template later
+# means deleting /opt/stacks/gokapi/config/config.json first.
 - name: make gokapi directories
   ansible.builtin.file:
     path: "{{ item }}"
     state: directory
+    mode: '0700'
   loop:
     - /opt/stacks/gokapi
+    - /opt/stacks/gokapi/config
+    - /opt/stacks/gokapi/data
 
 - name: Template out the compose file
   ansible.builtin.template:
@@ -13,6 +19,45 @@
     owner: root
     mode: '0644'
 
+- name: Template out the gokapi config (fresh installs only)
+  ansible.builtin.template:
+    src: gokapi-config.json.j2
+    dest: /opt/stacks/gokapi/config/config.json
+    owner: root
+    mode: '0600'
+    force: false
+  no_log: true
+
+- name: Check for an existing gokapi database
+  ansible.builtin.stat:
+    path: /opt/stacks/gokapi/data/gokapi.sqlite
+  register: gokapi_db
+
+# A new database has no users and Gokapi refuses to start, so run it once with
+# --deployment-password to create the super admin (the Pocket ID email above).
+- name: Create the gokapi super admin on a fresh install
+  when: not gokapi_db.stat.exists
+  block:
+    - name: Start a one-off gokapi with a deployment password
+      ansible.builtin.command:
+        cmd: >-
+          docker compose run -d --rm --no-deps --name gokapi-init gokapi
+          /app/run.sh --deployment-password {{ vault_gokapi.deployment_password }}
+        chdir: /opt/stacks/gokapi
+      no_log: true
+
+    - name: Wait for the one-off gokapi to finish starting
+      ansible.builtin.wait_for:
+        path: /opt/stacks/gokapi/data/log.txt
+        search_regex: Gokapi started
+        timeout: 60
+  always:
+    - name: Stop the one-off gokapi
+      ansible.builtin.command: docker rm -f gokapi-init
+      when: not gokapi_db.stat.exists
+      changed_when: true
+      failed_when: false
+
 - name: deploy gokapi stack
   community.docker.docker_compose_v2:
     project_src: /opt/stacks/gokapi
diff --git a/roles/docker/templates/gokapi-compose.yml.j2 b/roles/docker/templates/gokapi-compose.yml.j2
index 39c4cc7..106ad85 100644
--- a/roles/docker/templates/gokapi-compose.yml.j2
+++ b/roles/docker/templates/gokapi-compose.yml.j2
@@ -6,15 +6,12 @@ services:
     environment:
       TZ: "UTC"
     volumes:
-      - gokapi_data:/app/data
-      - gokapi_config:/app/config
+      - ./data:/app/data
+      - ./config:/app/config
+    extra_hosts:
+      - "{{ subdomains.pocketid }}:{{ docker.hairpin_ip }}"
     labels:
       mag37.dockcheck.update: true
-volumes:
-  gokapi_data:
-    driver: local
-  gokapi_config:
-    driver: local
 networks:
   default:
     external: true
diff --git a/roles/docker/templates/gokapi-config.json.j2 b/roles/docker/templates/gokapi-config.json.j2
new file mode 100644
index 0000000..85ace53
--- /dev/null
+++ b/roles/docker/templates/gokapi-config.json.j2
@@ -0,0 +1,38 @@
+{
+  "Authentication": {
+    "Method": 1,
+    "SaltAdmin": "{{ vault_gokapi.salt_admin }}",
+    "SaltFiles": "{{ vault_gokapi.salt_files }}",
+    "Username": "{{ gokapi_admin_email }}",
+    "HeaderKey": "",
+    "OauthProvider": "https://{{ subdomains.pocketid }}",
+    "OAuthClientId": "{{ vault_gokapi.pocketid.client_id }}",
+    "OAuthClientSecret": "{{ vault_gokapi.pocketid.client_secret }}",
+    "OauthGroupScope": "",
+    "OAuthRecheckInterval": 12,
+    "OAuthGroups": [],
+    "OnlyRegisteredUsers": true
+  },
+  "Port": ":53842",
+  "ServerUrl": "https://{{ subdomains.gokapi }}/",
+  "RedirectUrl": "https://github.com/Forceu/Gokapi/",
+  "PublicName": "Satellite Sharing",
+  "DataDir": "data",
+  "DatabaseUrl": "sqlite://./data/gokapi.sqlite",
+  "ConfigVersion": 22,
+  "MaxFileSizeMB": 102400,
+  "MaxMemory": 50,
+  "ChunkSize": 45,
+  "MaxParallelUploads": 3,
+  "Encryption": {
+    "Level": 0,
+    "Cipher": null,
+    "Salt": "",
+    "Checksum": "",
+    "ChecksumSalt": ""
+  },
+  "UseSsl": false,
+  "PicturesAlwaysLocal": false,
+  "SaveIp": false,
+  "IncludeFilename": false
+}