phil/ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Retire Gondulf and move StarPunk to v2.0.0 with Pocket ID login

Browse Source 
StarPunk 2.0.0 logs in with Pocket ID and issues its own Micropub tokens
(ADR-064 in the StarPunk repo), so the Gondulf IndieAuth server is no
longer used. Removes its task, templates, Caddy route, subdomain and
service entry, and moves its DNS record to removed_records.

The StarPunk template was still on v1.6.0-rc.2 with Gondulf hairpin
hosts; deploying it would have broken login. It now matches production:
v2.0.0, Pocket ID hairpin, OIDC client from vault_starpunk.pocketid and
the admin sub in starpunk_admin_sub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Phil
2026-10-31 11:52:07 -06:00
co-authored by Claude Opus 5.5
parent a08402f0ac
commit 6dfb58d3f1
13 changed files with 27 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/docker/README.md
+4 -5
View File
@@ -26,7 +26,6 @@ Tags: each category file has a category tag, each service its own tag.
|---|---|---|
| `caddy` | Caddy | Fixed IP 172.20.0.5. Ports 80/443 (+443/udp). `Caddyfile.j2` changes restart it via a handler; the stack itself is deployed with `recreate: never`. Static sites are served from `/opt/stacks/caddy/site/`. |
| `pocketid` | Pocket ID v2 | Passkey OIDC provider at `id.`. OIDC clients are created in its web UI; their IDs and secrets go in the vault. |
| `gondulf` | Gondulf | IndieAuth server for the main site (own image from Gitea). Sends login codes by email through Resend. |
| `dockge` | Dockge | Compose UI on port 5001, managing `/opt/stacks`. |
### Development (`development`)
@@ -59,7 +58,7 @@ Tags: each category file has a category tag, each service its own tag.
|---|---|---|
| `gotosocial` | GoToSocial | Pocket ID through env vars. Account domain is the apex; Caddy serves WebFinger there. Daily S3 backup of its volume. |
| `listmonk` | Listmonk | Postgres 17. On `listmonk.nerder.land`. |
| `starpunk` | StarPunk | Micropub server for the main site (own image from Gitea). Logs in through Gondulf. |
| `starpunk` | StarPunk | Micropub server for the main site (own image from Gitea). Admin login via Pocket ID; issues its own Micropub tokens. |
### Monitoring (`monitoring`)
| Tag | Service | Notes |
@@ -97,9 +96,9 @@ in from the internet; the Caddy and Gitea task files add those rules.
Containers labelled `mag37.dockcheck.update: true` are updated automatically
each morning by dockcheck (set up in the cron role). Containers without the
label (Gondulf, StarPunk, Listmonk, HeyForm, Dockge and most databases) only
label (StarPunk, Listmonk, HeyForm, Dockge and most databases) only
get a Gotify notice. Dawarich's database and Redis are skipped entirely.
Gondulf and StarPunk use pinned version tags.
StarPunk uses a pinned version tag.
## Adding a service
@@ -121,7 +120,7 @@ roles/docker/
├── tasks/
│ ├── main.yml # System setup, network, category imports
│ ├── shell.yml # zsh, Atuin, bat
│ ├── infrastructure/ # caddy, pocketid, gondulf (+ dockge in main.yml)
│ ├── infrastructure/ # caddy, pocketid (+ dockge in main.yml)
│ ├── development/ # gitea, bytestash
│ ├── media/ # audiobookshelf, kavita, hoarder (Karakeep), manyfold
│ ├── productivity/ # paperlessngx, baikal, syncthing, heyform, dawarich, obsidian-livesync, gokapi
roles/docker/tasks/infrastructure/gondulf.yml
-28
View File
@@ -1,28 +0,0 @@
- name: make gondulf directories
ansible.builtin.file:
path: "{{ item }}"
state: directory
loop:
- /opt/stacks/gondulf
- name: Template out the gondulf compose file
ansible.builtin.template:
src: gondulf-compose.yml.j2
dest: /opt/stacks/gondulf/compose.yml
owner: root
mode: '0644'
- name: Template out the gondulf .env file
ansible.builtin.template:
src: gondulf-env.j2
dest: /opt/stacks/gondulf/.env
owner: root
mode: '0640'
group: docker
diff: false # contains the secret key and SMTP password
- name: deploy gondulf stack
community.docker.docker_compose_v2:
project_src: /opt/stacks/gondulf
files:
- compose.yml
roles/docker/tasks/infrastructure/main.yml
-4
View File
@@ -9,10 +9,6 @@
import_tasks: pocketid.yml
tags: pocketid
- name: Install gondulf
import_tasks: gondulf.yml
tags: gondulf
- name: Template out the dockge compose file
ansible.builtin.template:
src: dockge-compose.yml.j2
roles/docker/templates/Caddyfile.j2
-4
View File
@@ -88,10 +88,6 @@ pdg.thesatelliteoflove.com {
}
}
gondulf.thesatelliteoflove.com {
reverse_proxy gondulf:8000
}
starpunk.thesatelliteoflove.com {
reverse_proxy starpunk:8000
}
roles/docker/templates/gondulf-compose.yml.j2
-34
View File
@@ -1,34 +0,0 @@
services:
gondulf:
image: git.thesatelliteoflove.com/phil/gondulf:1.0.1
container_name: gondulf
restart: unless-stopped
extra_hosts:
- '{{ primary_domain }}:{{ docker.hairpin_ip }}'
volumes:
- gondulf_data:/data
env_file:
- .env
environment:
- GONDULF_HTTPS_REDIRECT=true
- GONDULF_SECURE_COOKIES=true
- GONDULF_TRUST_PROXY=true
- GONDULF_TOKEN_EXPIRY=3600
- GONDULF_CODE_EXPIRY=600
- GONDULF_TOKEN_CLEANUP_ENABLED=false
- GONDULF_TOKEN_CLEANUP_INTERVAL=3600
- GONDULF_LOG_LEVEL=INFO
- GONDULF_DEBUG=false
healthcheck:
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8000/health"]
interval: 30s
timeout: 5s
retries: 3
start_period: 10s
volumes:
# Existing volume (gondulf_gondulf_data) holds the SQLite database
gondulf_data:
networks:
default:
external: true
name: {{ docker.network_name }}
roles/docker/templates/gondulf-env.j2
-9
View File
@@ -1,9 +0,0 @@
GONDULF_SECRET_KEY={{ vault_gondulf.secret_key }}
GONDULF_BASE_URL=https://{{ subdomains.gondulf }}
GONDULF_DATABASE_URL=sqlite:////data/gondulf.db
GONDULF_SMTP_HOST={{ smtp.host }}
GONDULF_SMTP_PORT=587
GONDULF_SMTP_USERNAME={{ smtp.username }}
GONDULF_SMTP_PASSWORD={{ vault_smtp.password }}
GONDULF_SMTP_FROM=gondulf@{{ smtp.from_domain }}
GONDULF_SMTP_USE_TLS=true
roles/docker/templates/starpunk-compose.yml.j2
+10 -3
View File
@@ -1,10 +1,10 @@
services:
starpunk:
image: git.thesatelliteoflove.com/phil/starpunk:v1.6.0-rc.2
image: git.thesatelliteoflove.com/phil/starpunk:v2.0.0
container_name: starpunk
restart: unless-stopped
extra_hosts:
- '{{ subdomains.gondulf }}:{{ docker.hairpin_ip }}'
- '{{ subdomains.pocketid }}:{{ docker.hairpin_ip }}'
- '{{ primary_domain }}:{{ docker.hairpin_ip }}'
volumes:
- starpunk-data:/data
@@ -14,9 +14,16 @@ services:
SITE_NAME: StarPunk
SITE_AUTHOR: Mr Whiskers
SITE_DESCRIPTION: Starpunk instance
# Authentication
# Site owner identity (h-card source, Micropub "me")
ADMIN_ME: https://{{ primary_domain }}
SESSION_SECRET: {{ vault_starpunk.session_secret }}
# Admin login via Pocket ID (client "StarPunk"); only this user may log in.
# StarPunk issues Micropub tokens itself (ADR-064).
OIDC_ISSUER: https://{{ subdomains.pocketid }}
OIDC_CLIENT_ID: {{ vault_starpunk.pocketid.client_id }}
OIDC_CLIENT_SECRET: {{ vault_starpunk.pocketid.client_secret }}
OIDC_ADMIN_SUB: {{ starpunk_admin_sub }}
OIDC_PROVIDER_NAME: Pocket ID
# Production settings
FLASK_ENV: production
FLASK_DEBUG: 0