Manage Gondulf and StarPunk with Ansible

Both were hand-deployed to /opt/stacks. Templates match the live setup
and keep the same stack dirs and volume names, so data stays put.
Secrets come from the vault; .env and the StarPunk compose file are now
0640 root:docker instead of the broken 1204 mode. Adds their DNS
records to dns.yml and drops the dead godulf. Caddy route (no DNS).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/starpunk-compose.yml.j2

@@ -0,0 +1,31 @@
+services:
+  starpunk:
+    image: git.thesatelliteoflove.com/phil/starpunk:v1.6.0-rc.2
+    container_name: starpunk
+    restart: unless-stopped
+    extra_hosts:
+      - '{{ subdomains.gondulf }}:{{ docker.hairpin_ip }}'
+      - '{{ primary_domain }}:{{ docker.hairpin_ip }}'
+    volumes:
+      - starpunk-data:/data
+    environment:
+      # Site configuration
+      SITE_URL: https://{{ subdomains.starpunk }}
+      SITE_NAME: StarPunk
+      SITE_AUTHOR: Mr Whiskers
+      SITE_DESCRIPTION: Starpunk instance
+      # Authentication
+      ADMIN_ME: https://{{ primary_domain }}
+      SESSION_SECRET: {{ vault_starpunk.session_secret }}
+      # Production settings
+      FLASK_ENV: production
+      FLASK_DEBUG: 0
+      LOG_LEVEL: INFO
+      DEV_MODE: false
+volumes:
+  # Existing volume (starpunk_starpunk-data) holds the posts and database
+  starpunk-data:
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}