Manage Gondulf and StarPunk with Ansible

Both were hand-deployed to /opt/stacks. Templates match the live setup
and keep the same stack dirs and volume names, so data stays put.
Secrets come from the vault; .env and the StarPunk compose file are now
0640 root:docker instead of the broken 1204 mode. Adds their DNS
records to dns.yml and drops the dead godulf. Caddy route (no DNS).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/tasks/communication/main.yml

@@ -9,3 +9,7 @@
 - name: Install listmonk
   import_tasks: listmonk.yml
   tags: listmonk
+
+- name: Install starpunk
+  import_tasks: starpunk.yml
+  tags: starpunk

roles/docker/tasks/communication/starpunk.yml

@@ -0,0 +1,21 @@
+- name: make starpunk directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/starpunk
+
+- name: Template out the starpunk compose file
+  ansible.builtin.template:
+    src: starpunk-compose.yml.j2
+    dest: /opt/stacks/starpunk/compose.yml
+    owner: root
+    mode: '0640'
+    group: docker
+  diff: false  # contains the session secret
+
+- name: deploy starpunk stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/starpunk
+    files:
+    - compose.yml