Harden permissions, close exposed ports, and clean up tasks

- Quote file modes. Unquoted 644/755 were read as decimal, so files
  landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
  them over the docker network), bind dir2opds to the Tailscale IP, and
  drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
  when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
  idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
  during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/tasks/media/audiobookshelf.yml

@@ -10,7 +10,7 @@
     src: audiobookshelf-compose.yml.j2
     dest: /opt/stacks/audiobookshelf/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy audiobookshelf stack
   community.docker.docker_compose_v2:

roles/docker/tasks/media/calibre.yml

@@ -10,7 +10,7 @@
     src: calibre-compose.yml.j2
     dest: /opt/stacks/calibre/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy calibre stack
   community.docker.docker_compose_v2:

roles/docker/tasks/media/dir2opds.yml

@@ -17,7 +17,7 @@
     src: dir2opds-compose.yml.j2
     dest: /opt/stacks/dir2opds/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy dir2opds stack
   community.docker.docker_compose_v2:

roles/docker/tasks/media/ghost-1.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove ghost stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/ghost-1
-    state: absent
-  ignore_errors: true
-
-- name: Remove ghost directory
-  ansible.builtin.file:
-    path: /opt/stacks/ghost-1
-    state: absent

roles/docker/tasks/media/hoarder.yml

@@ -10,14 +10,15 @@
     src: hoarder-compose.yml.j2
     dest: /opt/stacks/hoarder/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: Template out the .env file
   ansible.builtin.template:
     src: hoarder-env.j2
     dest: /opt/stacks/hoarder/.env
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy hoarder stack
   community.docker.docker_compose_v2:

roles/docker/tasks/media/kosync.yml

@@ -13,7 +13,7 @@
     src: kosync-compose.yml.j2
     dest: /opt/stacks/kosync/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy kosync stack
   community.docker.docker_compose_v2:

roles/docker/tasks/media/main.yml

@@ -9,17 +9,8 @@
   import_tasks: calibre.yml
   tags: calibre
 
-- name: Install ghost-1
-  import_tasks: ghost-1.yml
-  tags: ghost-1
 
-- name: Install pinchflat
-  import_tasks: pinchflat.yml
-  tags: pinchflat
 
-- name: Install pinry
-  import_tasks: pinry.yml
-  tags: pinry
 
 - name: Install karakeep
   import_tasks: hoarder.yml
@@ -37,4 +28,4 @@
 
 - name: Install koreader sync server
   import_tasks: kosync.yml
-  tags: kosync
+  tags: kosync

roles/docker/tasks/media/manyfold.yml

@@ -20,7 +20,8 @@
     src: manyfold-compose.yml.j2
     dest: /opt/stacks/manyfold/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy manyfold stack
   community.docker.docker_compose_v2:

roles/docker/tasks/media/pinchflat.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove pinchflat stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/pinchflat
-    state: absent
-  ignore_errors: true
-
-- name: Remove pinchflat directory
-  ansible.builtin.file:
-    path: /opt/stacks/pinchflat
-    state: absent

roles/docker/tasks/media/pinry.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove pinry stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/pinry
-    state: absent
-  ignore_errors: true
-
-- name: Remove pinry directory
-  ansible.builtin.file:
-    path: /opt/stacks/pinry
-    state: absent