Reset Gokapi and log in with Pocket ID

Gokapi now keeps its config and data in /opt/stacks/gokapi instead of named
volumes. config.json is templated with Pocket ID as the OIDC provider, so a
fresh install never shows the open /setup wizard. On a new database a one-off
run with --deployment-password creates the super admin, after which only
existing users can log in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/tasks/productivity/gokapi.yml

@@ -1,10 +1,16 @@
 ---
+# Gokapi logs in through Pocket ID. config.json is written only on a fresh
+# install (Gokapi rewrites it on upgrades), so changing the template later
+# means deleting /opt/stacks/gokapi/config/config.json first.
 - name: make gokapi directories
   ansible.builtin.file:
     path: "{{ item }}"
     state: directory
+    mode: '0700'
   loop:
     - /opt/stacks/gokapi
+    - /opt/stacks/gokapi/config
+    - /opt/stacks/gokapi/data
 
 - name: Template out the compose file
   ansible.builtin.template:
@@ -13,6 +19,45 @@
     owner: root
     mode: '0644'
 
+- name: Template out the gokapi config (fresh installs only)
+  ansible.builtin.template:
+    src: gokapi-config.json.j2
+    dest: /opt/stacks/gokapi/config/config.json
+    owner: root
+    mode: '0600'
+    force: false
+  no_log: true
+
+- name: Check for an existing gokapi database
+  ansible.builtin.stat:
+    path: /opt/stacks/gokapi/data/gokapi.sqlite
+  register: gokapi_db
+
+# A new database has no users and Gokapi refuses to start, so run it once with
+# --deployment-password to create the super admin (the Pocket ID email above).
+- name: Create the gokapi super admin on a fresh install
+  when: not gokapi_db.stat.exists
+  block:
+    - name: Start a one-off gokapi with a deployment password
+      ansible.builtin.command:
+        cmd: >-
+          docker compose run -d --rm --no-deps --name gokapi-init gokapi
+          /app/run.sh --deployment-password {{ vault_gokapi.deployment_password }}
+        chdir: /opt/stacks/gokapi
+      no_log: true
+
+    - name: Wait for the one-off gokapi to finish starting
+      ansible.builtin.wait_for:
+        path: /opt/stacks/gokapi/data/log.txt
+        search_regex: Gokapi started
+        timeout: 60
+  always:
+    - name: Stop the one-off gokapi
+      ansible.builtin.command: docker rm -f gokapi-init
+      when: not gokapi_db.stat.exists
+      changed_when: true
+      failed_when: false
+
 - name: deploy gokapi stack
   community.docker.docker_compose_v2:
     project_src: /opt/stacks/gokapi