feat: expose dir2opds via Caddy with basic auth + direct tailscale access

group_vars/all/domains.yml

@@ -26,6 +26,7 @@ subdomains:
   gotify: "gotify.{{ primary_domain }}"  # Gotify notifications
   gotify_assistant: "gotify-assistant.{{ primary_domain }}"  # iGotify iOS assistant
   listmonk: "listmonk.{{ secondary_domain }}"  # Listmonk mailing list
+  dir2opds: "opds.{{ primary_domain }}"  # dir2opds OPDS catalog
 
 # Email domains for notifications
 email_domains:

roles/docker/tasks/infrastructure/caddy.yml

@@ -5,9 +5,24 @@
   loop:
     - /opt/stacks/caddy
 
-- name: copy Caddyfile
+- name: Install apache2-utils for htpasswd
-  ansible.builtin.copy:
+  ansible.builtin.apt:
-    src: Caddyfile
+    name: apache2-utils
+    state: present
+  become: true
+  when: vault_dir2opds is defined
+
+- name: Generate bcrypt hash for dir2opds basic auth
+  ansible.builtin.shell: |
+    htpasswd -bnB "{{ vault_dir2opds.basic_auth_user }}" "{{ vault_dir2opds.basic_auth_password }}" | awk -F: '{print $1, $2}'
+  register: dir2opds_basic_auth_hash_result
+  changed_when: false
+  no_log: true
+  when: vault_dir2opds is defined
+
+- name: template Caddyfile
+  ansible.builtin.template:
+    src: Caddyfile.j2
     dest: /opt/stacks/caddy/Caddyfile
     owner: root
     mode: 644

roles/docker/templates/Caddyfile.j2

@@ -105,3 +105,12 @@ listmonk.nerder.land {
 repaircafe.nerder.land {
     redir /volunteer-signup https://listmonk.nerder.land/subscription/form 301
 }
+
+{% if vault_dir2opds is defined %}
+opds.thesatelliteoflove.com {
+    basicauth {
+        {{ dir2opds_basic_auth_hash_result.stdout }}
+    }
+    reverse_proxy dir2opds:8080
+}
+{% endif %}

roles/docker/templates/dir2opds-compose.yml.j2

@@ -17,7 +17,7 @@ services:
     labels:
       glance.name: dir2opds
       glance.icon: si:book
-      glance.url: http://docker-01:8080
+      glance.url: https://{{ subdomains.dir2opds }}/
       glance.description: OPDS book catalog
       mag37.dockcheck.update: true
 networks: