feat: add ByteStash service for code snippet management

- Add ByteStash Docker service configuration and deployment
- Configure subdomain routing through Caddy
- Add DNS record for ByteStash subdomain
- Update development service category to include ByteStash

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

roles/docker/files/Caddyfile

@@ -49,6 +49,10 @@ code.thesatelliteoflove.com {
     reverse_proxy authentik-server-1:9000
 }
 
+snippets.thesatelliteoflove.com {
+    reverse_proxy bytestash:5000
+}
+
 files.thesatelliteoflove.com {
     reverse_proxy pingvin-pingvin-share-1:3000
 }
@@ -64,8 +68,6 @@ thesatelliteoflove.com {
     file_server
 }
 
-
-
 bookmarks.thesatelliteoflove.com {
     reverse_proxy hoarder-web-1:3000
 }
@@ -91,6 +93,17 @@ gotify-assistant.thesatelliteoflove.com {
     reverse_proxy gotify-igotify-assistant-1:8080
 }
 
+pdg.thesatelliteoflove.com {
+    root * /srv/pdg
+    try_files {path} {path}.html {path}/ =404
+    file_server
+    encode gzip
+ 
+    handle_errors {
+        rewrite * /{err.status_code}.html
+        file_server
+    }
+}
 
 repair.nerder.land {
     root * /srv/repair

roles/docker/tasks/development/bytestash.yml

@@ -0,0 +1,19 @@
+- name: make bytestash directories
+  ansible.builtin.file:
+    path: "{{ item}}"
+    state: directory
+  loop:
+    - /opt/stacks/bytestash
+
+- name: Template out the compose file
+  ansible.builtin.template:
+    src: bytestash-compose.yml.j2
+    dest: /opt/stacks/bytestash/compose.yml
+    owner: root
+    mode: 644
+
+- name: deploy bytestash stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/bytestash
+    files:
+    - compose.yml

roles/docker/tasks/development/main.yml

@@ -9,3 +9,7 @@
   import_tasks: codeserver.yml
   tags: codeserver
 
+- name: Install bytestash
+  import_tasks: bytestash.yml
+  tags: bytestash
+

roles/docker/templates/bytestash-compose.yml.j2

@@ -0,0 +1,37 @@
+services:
+  bytestash:
+    image: ghcr.io/jordan-dalby/bytestash:latest
+    container_name: bytestash
+    restart: unless-stopped
+    volumes:
+      - bytestash_data:/data/snippets
+    environment:
+      JWT_SECRET: "{{ vault_bytestash.jwt_secret }}"
+      TOKEN_EXPIRY: "24h"
+      ALLOW_NEW_ACCOUNTS: "true"
+      DEBUG: "false"
+      DISABLE_ACCOUNTS: "false"
+      DISABLE_INTERNAL_ACCOUNTS: "false"
+      OIDC_ENABLED: "true"
+      OIDC_DISPLAY_NAME: "Login with Authentik"
+      OIDC_ISSUER_URL: "https://{{ subdomains.auth }}/application/o/bytestash/"
+      OIDC_CLIENT_ID: "{{ vault_bytestash.oidc_client_id }}"
+      OIDC_CLIENT_SECRET: "{{ vault_bytestash.oidc_client_secret }}"
+      OIDC_SCOPES: "openid profile email"
+    extra_hosts:
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
+    labels:
+      glance.name: ByteStash
+      glance.icon: si:code
+      glance.url: https://{{ subdomains.bytestash }}/
+      glance.description: Code snippet manager
+      glance.id: bytestash
+
+volumes:
+  bytestash_data:
+    driver: local
+
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}

roles/docker/templates/codeserver-compose.yml.j2

@@ -7,6 +7,7 @@ services:
       glance.icon: si:vscodium
       glance.url: https://{{ subdomains.code }}/
       glance.description: Code Server
+      mag37.dockcheck.update: true
     container_name: codeserver
     volumes:
       - home:/home