Harden permissions, close exposed ports, and clean up tasks

- Quote file modes. Unquoted 644/755 were read as decimal, so files
  landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
  them over the docker network), bind dir2opds to the Tailscale IP, and
  drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
  when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
  idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
  during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/tasks/shell.yml

@@ -5,33 +5,48 @@
     update_cache: true
 
 - name: set zsh as default shell
-  ansible.builtin.shell: chsh -s $(which zsh) {{ ansible_user }}
+  ansible.builtin.user:
+    name: "{{ ansible_user }}"
+    shell: /usr/bin/zsh
 
+- name: Check if Atuin is installed
+  ansible.builtin.stat:
+    path: "/home/{{ ansible_user }}/.atuin/bin/atuin"
+  register: atuin_bin
+
+# Only fetch and run the installer on hosts that don't have Atuin yet
 - name: Download Atuin setup script
   get_url:
     url: https://setup.atuin.sh
     dest: /tmp/setup_atuin.sh
     mode: '0755'
+  when: not atuin_bin.stat.exists
 
 - name: Run the Atuin setup script
   command: /tmp/setup_atuin.sh
-  register: atuin_install
+  args:
+    creates: "/home/{{ ansible_user }}/.atuin/bin/atuin"
   become: true
   become_user: "{{ ansible_user }}"
 
+# Log in once; the session file marks an existing login.
+# no_log keeps the password and key out of Ansible output.
 - name: login to atuin
   command: /home/{{ ansible_user }}/.atuin/bin/atuin login -u philskents -p "{{ atuin_pass }}" -k "{{ atuin_key }}"
-  when: atuin_install.rc == 0
+  args:
+    creates: "/home/{{ ansible_user }}/.local/share/atuin/session"
   become: true
   become_user: "{{ ansible_user }}"
+  no_log: true
 
 - name: setup dotfile sync
-  ansible.builtin.blockinfile:
+  community.general.ini_file:
     path: "/home/{{ ansible_user }}/.config/atuin/config.toml"
-    block: |
-      [dotfiles]
-      enabled = true
-    marker: ""
+    section: dotfiles
+    option: enabled
+    value: "true"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
 
 - name: Install bat
   apt:
@@ -39,6 +54,14 @@
     state: latest
     update_cache: true
 
+- name: Ensure ~/.local/bin exists
+  ansible.builtin.file:
+    path: "/home/{{ ansible_user }}/.local/bin"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: '0755'
+
 - name: Create symlink for batcat
   ansible.builtin.file:
     src: /usr/bin/batcat