Harden permissions, close exposed ports, and clean up tasks

- Quote file modes. Unquoted 644/755 were read as decimal, so files
  landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
  them over the docker network), bind dir2opds to the Tailscale IP, and
  drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
  when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
  idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
  during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/tasks/productivity/baikal.yml

@@ -10,7 +10,7 @@
     src: baikal-compose.yml.j2
     dest: /opt/stacks/baikal/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy baikal stack
   community.docker.docker_compose_v2:

roles/docker/tasks/productivity/dawarich.yml

@@ -10,7 +10,8 @@
     src: dawarich-compose.yml.j2
     dest: /opt/stacks/dawarich/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy dawarich stack
   community.docker.docker_compose_v2:

roles/docker/tasks/productivity/gokapi.yml

@@ -11,7 +11,7 @@
     src: gokapi-compose.yml.j2
     dest: /opt/stacks/gokapi/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy gokapi stack
   community.docker.docker_compose_v2:

roles/docker/tasks/productivity/grocy.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove grocy stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/grocy
-    state: absent
-  ignore_errors: true
-
-- name: Remove grocy directory
-  ansible.builtin.file:
-    path: /opt/stacks/grocy
-    state: absent

roles/docker/tasks/productivity/heyform.yml

@@ -10,7 +10,8 @@
     src: heyform-compose.yml.j2
     dest: /opt/stacks/heyform/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy heyform stack
   community.docker.docker_compose_v2:

roles/docker/tasks/productivity/kanboard.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove kanboard stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/kanboard
-    state: absent
-  ignore_errors: true
-
-- name: Remove kanboard directory
-  ansible.builtin.file:
-    path: /opt/stacks/kanboard
-    state: absent

roles/docker/tasks/productivity/main.yml

@@ -13,9 +13,6 @@
   import_tasks: syncthing.yml
   tags: syncthing
 
-- name: Install mmdl
-  import_tasks: mmdl.yml
-  tags: mmdl
 
 - name: Install heyform
   import_tasks: heyform.yml
@@ -25,22 +22,12 @@
   import_tasks: dawarich.yml
   tags: dawarich
 
-- name: Install palmr
-  import_tasks: palmr.yml
-  tags: palmr
 
 - name: Install obsidian-livesync
   import_tasks: obsidian-livesync.yml
   tags: obsidian-livesync
 
-- name: Install kanboard
-  import_tasks: kanboard.yml
-  tags: kanboard
 
 - name: Install gokapi
   import_tasks: gokapi.yml
   tags: gokapi
-
-- name: Install grocy
-  import_tasks: grocy.yml
-  tags: grocy

roles/docker/tasks/productivity/mmdl.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove mmdl stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/mmdl
-    state: absent
-  ignore_errors: true
-
-- name: Remove mmdl directory
-  ansible.builtin.file:
-    path: /opt/stacks/mmdl
-    state: absent

roles/docker/tasks/productivity/obsidian-livesync.yml

@@ -9,7 +9,8 @@
   ansible.builtin.template:
     src: obsidian-livesync-compose.yml.j2
     dest: "{{ paths.stacks }}/obsidian-livesync/docker-compose.yml"
-    mode: '0644'
+    mode: '0640'
+    group: docker
   notify: restart obsidian-livesync
 
 - name: deploy obsidian-livesync stack

roles/docker/tasks/productivity/palmr.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove palmr stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/palmr
-    state: absent
-  ignore_errors: true
-
-- name: Remove palmr directory
-  ansible.builtin.file:
-    path: /opt/stacks/palmr
-    state: absent

roles/docker/tasks/productivity/paperlessngx.yml

@@ -10,14 +10,16 @@
     src: paperlessngx-compose.yml.j2
     dest: /opt/stacks/paperlessngx/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: Template out the .env file
   ansible.builtin.template:
     src: paperlessngx.env.j2
     dest: /opt/stacks/paperlessngx/docker-compose.env
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy paperlessngx stack
   community.docker.docker_compose_v2:

roles/docker/tasks/productivity/syncthing.yml

@@ -10,7 +10,7 @@
     src: syncthing-compose.yml.j2
     dest: /opt/stacks/syncthing/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy syncthing stack
   community.docker.docker_compose_v2: