Manage Gondulf and StarPunk with Ansible

Both were hand-deployed to /opt/stacks. Templates match the live setup
and keep the same stack dirs and volume names, so data stays put.
Secrets come from the vault; .env and the StarPunk compose file are now
0640 root:docker instead of the broken 1204 mode. Adds their DNS
records to dns.yml and drops the dead godulf. Caddy route (no DNS).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/Caddyfile.j2

@@ -100,10 +100,6 @@ starpunk.thesatelliteoflove.com {
     reverse_proxy starpunk:8000
   }
 
-godulf.thesatelliteoflove.com {
-    reverse_proxy gondulf:8000
-  }
-
 repair.nerder.land {
     root * /srv/repair
     file_server

roles/docker/templates/gondulf-compose.yml.j2

@@ -0,0 +1,34 @@
+services:
+  gondulf:
+    image: git.thesatelliteoflove.com/phil/gondulf:1.0.1
+    container_name: gondulf
+    restart: unless-stopped
+    extra_hosts:
+      - '{{ primary_domain }}:{{ docker.hairpin_ip }}'
+    volumes:
+      - gondulf_data:/data
+    env_file:
+      - .env
+    environment:
+      - GONDULF_HTTPS_REDIRECT=true
+      - GONDULF_SECURE_COOKIES=true
+      - GONDULF_TRUST_PROXY=true
+      - GONDULF_TOKEN_EXPIRY=3600
+      - GONDULF_CODE_EXPIRY=600
+      - GONDULF_TOKEN_CLEANUP_ENABLED=false
+      - GONDULF_TOKEN_CLEANUP_INTERVAL=3600
+      - GONDULF_LOG_LEVEL=INFO
+      - GONDULF_DEBUG=false
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8000/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+volumes:
+  # Existing volume (gondulf_gondulf_data) holds the SQLite database
+  gondulf_data:
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}

roles/docker/templates/gondulf-env.j2

@@ -0,0 +1,9 @@
+GONDULF_SECRET_KEY={{ vault_gondulf.secret_key }}
+GONDULF_BASE_URL=https://{{ subdomains.gondulf }}
+GONDULF_DATABASE_URL=sqlite:////data/gondulf.db
+GONDULF_SMTP_HOST={{ smtp.host }}
+GONDULF_SMTP_PORT=587
+GONDULF_SMTP_USERNAME={{ smtp.username }}
+GONDULF_SMTP_PASSWORD={{ vault_smtp.password }}
+GONDULF_SMTP_FROM=gondulf@{{ smtp.from_domain }}
+GONDULF_SMTP_USE_TLS=true

roles/docker/templates/starpunk-compose.yml.j2

@@ -0,0 +1,31 @@
+services:
+  starpunk:
+    image: git.thesatelliteoflove.com/phil/starpunk:v1.6.0-rc.2
+    container_name: starpunk
+    restart: unless-stopped
+    extra_hosts:
+      - '{{ subdomains.gondulf }}:{{ docker.hairpin_ip }}'
+      - '{{ primary_domain }}:{{ docker.hairpin_ip }}'
+    volumes:
+      - starpunk-data:/data
+    environment:
+      # Site configuration
+      SITE_URL: https://{{ subdomains.starpunk }}
+      SITE_NAME: StarPunk
+      SITE_AUTHOR: Mr Whiskers
+      SITE_DESCRIPTION: Starpunk instance
+      # Authentication
+      ADMIN_ME: https://{{ primary_domain }}
+      SESSION_SECRET: {{ vault_starpunk.session_secret }}
+      # Production settings
+      FLASK_ENV: production
+      FLASK_DEBUG: 0
+      LOG_LEVEL: INFO
+      DEV_MODE: false
+volumes:
+  # Existing volume (starpunk_starpunk-data) holds the posts and database
+  starpunk-data:
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}