Manage Gondulf and StarPunk with Ansible

Both were hand-deployed to /opt/stacks. Templates match the live setup
and keep the same stack dirs and volume names, so data stays put.
Secrets come from the vault; .env and the StarPunk compose file are now
0640 root:docker instead of the broken 1204 mode. Adds their DNS
records to dns.yml and drops the dead godulf. Caddy route (no DNS).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/gondulf-compose.yml.j2

@@ -0,0 +1,34 @@
+services:
+  gondulf:
+    image: git.thesatelliteoflove.com/phil/gondulf:1.0.1
+    container_name: gondulf
+    restart: unless-stopped
+    extra_hosts:
+      - '{{ primary_domain }}:{{ docker.hairpin_ip }}'
+    volumes:
+      - gondulf_data:/data
+    env_file:
+      - .env
+    environment:
+      - GONDULF_HTTPS_REDIRECT=true
+      - GONDULF_SECURE_COOKIES=true
+      - GONDULF_TRUST_PROXY=true
+      - GONDULF_TOKEN_EXPIRY=3600
+      - GONDULF_CODE_EXPIRY=600
+      - GONDULF_TOKEN_CLEANUP_ENABLED=false
+      - GONDULF_TOKEN_CLEANUP_INTERVAL=3600
+      - GONDULF_LOG_LEVEL=INFO
+      - GONDULF_DEBUG=false
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8000/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+volumes:
+  # Existing volume (gondulf_gondulf_data) holds the SQLite database
+  gondulf_data:
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}