Harden permissions, close exposed ports, and clean up tasks

- Quote file modes. Unquoted 644/755 were read as decimal, so files
  landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
  them over the docker network), bind dir2opds to the Tailscale IP, and
  drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
  when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
  idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
  during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This commit is contained in:

Phil

2026-10-29 21:03:54 -06:00

co-authored by

Claude Opus 5.5

parent dea3b29b6b

commit c0145dd5a2

65 changed files with 154 additions and 600 deletions

									
										roles/docker/tasks/media/kosync.yml
									
		+1
		-1
	
												View File
												
				@@ -13,7 +13,7 @@

				    src: kosync-compose.yml.j2

				    dest: /opt/stacks/kosync/compose.yml

				    owner: root

				    mode: 644

				    mode: '0644'

				- name: deploy kosync stack

				  community.docker.docker_compose_v2: