Harden permissions, close exposed ports, and clean up tasks

- Quote file modes. Unquoted 644/755 were read as decimal, so files
  landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
  them over the docker network), bind dir2opds to the Tailscale IP, and
  drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
  when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
  idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
  during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dns.yml

@@ -10,74 +10,74 @@
       - name: thesatelliteoflove.com
         dns_records:
           - name: "home"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "git"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "social"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "auth"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "audio"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "books"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "paper"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "snippets"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: cal
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: loclog
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: watcher
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: models
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: bookmarks
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: gotify
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: gotify-assistant
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: pdg
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: opds
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: sync
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: gokapi
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
       - name: nerder.land
         dns_records:
           - name: "forms"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "listmonk"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "repaircafe"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "repair"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
 
     # DNS records to remove for decommissioned services
     removed_records:
       - name: thesatelliteoflove.com
         dns_records:
           - name: "pin"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "code"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "phlog"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "tasks"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "post"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "files"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "kanboard"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
           - name: "grocy"
-            ip: "152.53.36.98"
+            ip: "{{ network.netcup_ip }}"
 
   tasks:
     - name: Remove A records for decommissioned services

group_vars/all/infrastructure.yml

@@ -16,6 +16,7 @@ smtp:
 network:
   netcup_ip: "152.53.36.98"
   docker_host_ip: "100.70.169.99"
+  tailscale_hostname: "netcup.porgy-porgy.ts.net"
 
 # Paths
 paths:

roles/cron/tasks/main.yml

@@ -79,7 +79,7 @@
   template:
     src: dockcheck.config.j2
     dest: /home/phil/.config/dockcheck.config
-    mode: '0644'
+    mode: '0600'
     owner: phil
     group: phil
 

roles/cron/templates/dockcheck.config.j2

@@ -1,8 +1,10 @@
-# Dockcheck Configuration - Check only, no updates
-# Don't update, just check for updates
+# Dockcheck Configuration
+# Auto-updates containers labelled mag37.dockcheck.update=true, and sends a
+# Gotify notice for anything else with an update. Uncomment DontUpdate to
+# only check.
 # DontUpdate=true
 OnlyLabel=true
-AutoMode=true 
+AutoMode=true
 
 # Enable notifications
 Notify=true

roles/docker/README.md

@@ -94,7 +94,7 @@ roles/docker/
 │   ├── development/
 │   │   ├── main.yml               # Development category orchestrator
 │   │   ├── gitea.yml              # Git hosting
-│   │   └── codeserver.yml         # VS Code server
+│   │   └── bytestash.yml          # Code snippets
 │   ├── media/                     # Media services (7 services)
 │   ├── productivity/              # Productivity services (7 services)
 │   ├── communication/             # Communication services (2 services)
@@ -137,8 +137,8 @@ ansible-playbook site.yml -i hosts.yml --tags infrastructure,monitoring
 ```bash
 # Deploy specific services
 ansible-playbook site.yml -i hosts.yml --tags authentik
-ansible-playbook site.yml -i hosts.yml --tags gitea,codeserver
-ansible-playbook site.yml -i hosts.yml --tags mmdl
+ansible-playbook site.yml -i hosts.yml --tags gitea,bytestash
+ansible-playbook site.yml -i hosts.yml --tags paperlessngx
 ```
 
 ## Service-Specific Notes

roles/docker/tasks/communication/gotosocial.yml

@@ -11,7 +11,8 @@
     src: gotosocial-compose.yml.j2
     dest: /opt/stacks/gotosocial/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy gotosocial stack
   community.docker.docker_compose_v2:

roles/docker/tasks/communication/listmonk.yml

@@ -10,7 +10,8 @@
     src: listmonk-compose.yml.j2
     dest: /opt/stacks/listmonk/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy listmonk stack
   community.docker.docker_compose_v2:

roles/docker/tasks/communication/main.yml

@@ -5,10 +5,7 @@
   import_tasks: gotosocial.yml
   tags: gotosocial
 
-- name: Install postiz
-  import_tasks: postiz.yml
-  tags: postiz
 
 - name: Install listmonk
   import_tasks: listmonk.yml
-  tags: listmonk
+  tags: listmonk

roles/docker/tasks/communication/postiz.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove postiz stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/postiz
-    state: absent
-  ignore_errors: true
-
-- name: Remove postiz directory
-  ansible.builtin.file:
-    path: /opt/stacks/postiz
-    state: absent

roles/docker/tasks/development/bytestash.yml

@@ -10,7 +10,8 @@
     src: bytestash-compose.yml.j2
     dest: /opt/stacks/bytestash/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy bytestash stack
   community.docker.docker_compose_v2:

roles/docker/tasks/development/codeserver.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove codeserver stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/codeserver
-    state: absent
-  ignore_errors: true
-
-- name: Remove codeserver directory
-  ansible.builtin.file:
-    path: /opt/stacks/codeserver
-    state: absent

roles/docker/tasks/development/gitea.yml

@@ -11,7 +11,8 @@
     src: gitea-compose.yml.j2
     dest: /opt/stacks/gitea/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy gitea stack
   community.docker.docker_compose_v2:

roles/docker/tasks/development/main.yml

@@ -5,11 +5,7 @@
   import_tasks: gitea.yml
   tags: gitea
 
-- name: Install codeserver
-  import_tasks: codeserver.yml
-  tags: codeserver
 
 - name: Install bytestash
   import_tasks: bytestash.yml
   tags: bytestash
-

roles/docker/tasks/infrastructure/authentik.yml

@@ -10,14 +10,15 @@
     src: authentik-compose.yml.j2
     dest: /opt/stacks/authentik/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: Template out the .env file
   ansible.builtin.template:
     src: authentik-env.j2
     dest: /opt/stacks/authentik/.env
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy authentik stack
   community.docker.docker_compose_v2:

roles/docker/tasks/infrastructure/caddy.yml

@@ -27,7 +27,8 @@
     src: Caddyfile.j2
     dest: /opt/stacks/caddy/Caddyfile
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
   notify: restart caddy
 
 - name: template caddy compose file
@@ -35,7 +36,7 @@
     src: caddy-compose.yml.j2
     dest: /opt/stacks/caddy/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy caddy stack
   community.docker.docker_compose_v2:

roles/docker/tasks/main.yml

@@ -36,10 +36,25 @@
     src: ufw-docker.sh
     dest: /usr/local/bin/ufw-docker.sh
     owner: root
-    mode: 755
+    mode: '0755'
 
-- name: execute ufw-docker.sh
-  ansible.builtin.shell: /usr/local/bin/ufw-docker.sh install
+- name: check ufw-docker rules
+  ansible.builtin.command: /usr/local/bin/ufw-docker.sh check
+  register: ufw_docker_check
+  changed_when: false
+  failed_when: false
+  check_mode: false
+
+- name: install ufw-docker rules
+  ansible.builtin.command: /usr/local/bin/ufw-docker.sh install
+  when: ufw_docker_check.rc != 0
+
+# ufw-docker install asks for a ufw restart to load the new rules
+- name: restart ufw after ufw-docker install
+  ansible.builtin.systemd:
+    name: ufw
+    state: restarted
+  when: ufw_docker_check.rc != 0
 
 - name: make directories
   ansible.builtin.file:
@@ -54,7 +69,7 @@
     src: dockge-compose.yml.j2
     dest: /opt/dockge/dockge.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 # Deploy services by category for better organization and dependency management
 - name: Deploy infrastructure services

roles/docker/tasks/media/audiobookshelf.yml

@@ -10,7 +10,7 @@
     src: audiobookshelf-compose.yml.j2
     dest: /opt/stacks/audiobookshelf/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy audiobookshelf stack
   community.docker.docker_compose_v2:

roles/docker/tasks/media/calibre.yml

@@ -10,7 +10,7 @@
     src: calibre-compose.yml.j2
     dest: /opt/stacks/calibre/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy calibre stack
   community.docker.docker_compose_v2:

roles/docker/tasks/media/dir2opds.yml

@@ -17,7 +17,7 @@
     src: dir2opds-compose.yml.j2
     dest: /opt/stacks/dir2opds/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy dir2opds stack
   community.docker.docker_compose_v2:

roles/docker/tasks/media/ghost-1.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove ghost stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/ghost-1
-    state: absent
-  ignore_errors: true
-
-- name: Remove ghost directory
-  ansible.builtin.file:
-    path: /opt/stacks/ghost-1
-    state: absent

roles/docker/tasks/media/hoarder.yml

@@ -10,14 +10,15 @@
     src: hoarder-compose.yml.j2
     dest: /opt/stacks/hoarder/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: Template out the .env file
   ansible.builtin.template:
     src: hoarder-env.j2
     dest: /opt/stacks/hoarder/.env
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy hoarder stack
   community.docker.docker_compose_v2:

roles/docker/tasks/media/kosync.yml

@@ -13,7 +13,7 @@
     src: kosync-compose.yml.j2
     dest: /opt/stacks/kosync/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy kosync stack
   community.docker.docker_compose_v2:

roles/docker/tasks/media/main.yml

@@ -9,17 +9,8 @@
   import_tasks: calibre.yml
   tags: calibre
 
-- name: Install ghost-1
-  import_tasks: ghost-1.yml
-  tags: ghost-1
 
-- name: Install pinchflat
-  import_tasks: pinchflat.yml
-  tags: pinchflat
 
-- name: Install pinry
-  import_tasks: pinry.yml
-  tags: pinry
 
 - name: Install karakeep
   import_tasks: hoarder.yml
@@ -37,4 +28,4 @@
 
 - name: Install koreader sync server
   import_tasks: kosync.yml
-  tags: kosync
+  tags: kosync

roles/docker/tasks/media/manyfold.yml

@@ -20,7 +20,8 @@
     src: manyfold-compose.yml.j2
     dest: /opt/stacks/manyfold/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy manyfold stack
   community.docker.docker_compose_v2:

roles/docker/tasks/media/pinchflat.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove pinchflat stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/pinchflat
-    state: absent
-  ignore_errors: true
-
-- name: Remove pinchflat directory
-  ansible.builtin.file:
-    path: /opt/stacks/pinchflat
-    state: absent

roles/docker/tasks/media/pinry.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove pinry stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/pinry
-    state: absent
-  ignore_errors: true
-
-- name: Remove pinry directory
-  ansible.builtin.file:
-    path: /opt/stacks/pinry
-    state: absent

roles/docker/tasks/monitoring/appriseapi.yml

@@ -10,7 +10,7 @@
     src: appriseapi-compose.yml.j2
     dest: /opt/stacks/appriseapi/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy appriseapi stack
   community.docker.docker_compose_v2:

roles/docker/tasks/monitoring/changedetection.yml

@@ -10,7 +10,7 @@
     src: changedetection-compose.yml.j2
     dest: /opt/stacks/changedetection/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy changedetection stack
   community.docker.docker_compose_v2:

roles/docker/tasks/monitoring/cronmaster.yml

@@ -13,7 +13,8 @@
     src: cronmaster-compose.yml.j2
     dest: /opt/stacks/cronmaster/compose.yml
     owner: root
-    mode: '0644'
+    mode: '0640'
+    group: docker
 
 - name: deploy cronmaster stack
   community.docker.docker_compose_v2:

roles/docker/tasks/monitoring/glance.yml

@@ -18,7 +18,8 @@
     src: glance.yml.j2
     dest: /opt/stacks/glance/config/glance.yml
     owner: root
-    mode: '0644'
+    mode: '0640'
+    group: docker
   notify: restart glance
 
 - name: deploy glances stack

roles/docker/tasks/monitoring/gotify.yml

@@ -10,7 +10,8 @@
     src: gotify-compose.yml.j2
     dest: /opt/stacks/gotify/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: Deploy gotify stack
   community.docker.docker_compose_v2:

roles/docker/tasks/productivity/baikal.yml

@@ -10,7 +10,7 @@
     src: baikal-compose.yml.j2
     dest: /opt/stacks/baikal/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy baikal stack
   community.docker.docker_compose_v2:

roles/docker/tasks/productivity/dawarich.yml

@@ -10,7 +10,8 @@
     src: dawarich-compose.yml.j2
     dest: /opt/stacks/dawarich/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy dawarich stack
   community.docker.docker_compose_v2:

roles/docker/tasks/productivity/gokapi.yml

@@ -11,7 +11,7 @@
     src: gokapi-compose.yml.j2
     dest: /opt/stacks/gokapi/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy gokapi stack
   community.docker.docker_compose_v2:

roles/docker/tasks/productivity/grocy.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove grocy stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/grocy
-    state: absent
-  ignore_errors: true
-
-- name: Remove grocy directory
-  ansible.builtin.file:
-    path: /opt/stacks/grocy
-    state: absent

roles/docker/tasks/productivity/heyform.yml

@@ -10,7 +10,8 @@
     src: heyform-compose.yml.j2
     dest: /opt/stacks/heyform/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy heyform stack
   community.docker.docker_compose_v2:

roles/docker/tasks/productivity/kanboard.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove kanboard stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/kanboard
-    state: absent
-  ignore_errors: true
-
-- name: Remove kanboard directory
-  ansible.builtin.file:
-    path: /opt/stacks/kanboard
-    state: absent

roles/docker/tasks/productivity/main.yml

@@ -13,9 +13,6 @@
   import_tasks: syncthing.yml
   tags: syncthing
 
-- name: Install mmdl
-  import_tasks: mmdl.yml
-  tags: mmdl
 
 - name: Install heyform
   import_tasks: heyform.yml
@@ -25,22 +22,12 @@
   import_tasks: dawarich.yml
   tags: dawarich
 
-- name: Install palmr
-  import_tasks: palmr.yml
-  tags: palmr
 
 - name: Install obsidian-livesync
   import_tasks: obsidian-livesync.yml
   tags: obsidian-livesync
 
-- name: Install kanboard
-  import_tasks: kanboard.yml
-  tags: kanboard
 
 - name: Install gokapi
   import_tasks: gokapi.yml
   tags: gokapi
-
-- name: Install grocy
-  import_tasks: grocy.yml
-  tags: grocy

roles/docker/tasks/productivity/mmdl.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove mmdl stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/mmdl
-    state: absent
-  ignore_errors: true
-
-- name: Remove mmdl directory
-  ansible.builtin.file:
-    path: /opt/stacks/mmdl
-    state: absent

roles/docker/tasks/productivity/obsidian-livesync.yml

@@ -9,7 +9,8 @@
   ansible.builtin.template:
     src: obsidian-livesync-compose.yml.j2
     dest: "{{ paths.stacks }}/obsidian-livesync/docker-compose.yml"
-    mode: '0644'
+    mode: '0640'
+    group: docker
   notify: restart obsidian-livesync
 
 - name: deploy obsidian-livesync stack

roles/docker/tasks/productivity/palmr.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove palmr stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/palmr
-    state: absent
-  ignore_errors: true
-
-- name: Remove palmr directory
-  ansible.builtin.file:
-    path: /opt/stacks/palmr
-    state: absent

roles/docker/tasks/productivity/paperlessngx.yml

@@ -10,14 +10,16 @@
     src: paperlessngx-compose.yml.j2
     dest: /opt/stacks/paperlessngx/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: Template out the .env file
   ansible.builtin.template:
     src: paperlessngx.env.j2
     dest: /opt/stacks/paperlessngx/docker-compose.env
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy paperlessngx stack
   community.docker.docker_compose_v2:

roles/docker/tasks/productivity/syncthing.yml

@@ -10,7 +10,7 @@
     src: syncthing-compose.yml.j2
     dest: /opt/stacks/syncthing/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy syncthing stack
   community.docker.docker_compose_v2:

roles/docker/tasks/shell.yml

@@ -5,33 +5,48 @@
     update_cache: true
 
 - name: set zsh as default shell
-  ansible.builtin.shell: chsh -s $(which zsh) {{ ansible_user }}
+  ansible.builtin.user:
+    name: "{{ ansible_user }}"
+    shell: /usr/bin/zsh
 
+- name: Check if Atuin is installed
+  ansible.builtin.stat:
+    path: "/home/{{ ansible_user }}/.atuin/bin/atuin"
+  register: atuin_bin
+
+# Only fetch and run the installer on hosts that don't have Atuin yet
 - name: Download Atuin setup script
   get_url:
     url: https://setup.atuin.sh
     dest: /tmp/setup_atuin.sh
     mode: '0755'
+  when: not atuin_bin.stat.exists
 
 - name: Run the Atuin setup script
   command: /tmp/setup_atuin.sh
-  register: atuin_install
+  args:
+    creates: "/home/{{ ansible_user }}/.atuin/bin/atuin"
   become: true
   become_user: "{{ ansible_user }}"
 
+# Log in once; the session file marks an existing login.
+# no_log keeps the password and key out of Ansible output.
 - name: login to atuin
   command: /home/{{ ansible_user }}/.atuin/bin/atuin login -u philskents -p "{{ atuin_pass }}" -k "{{ atuin_key }}"
-  when: atuin_install.rc == 0
+  args:
+    creates: "/home/{{ ansible_user }}/.local/share/atuin/session"
   become: true
   become_user: "{{ ansible_user }}"
+  no_log: true
 
 - name: setup dotfile sync
-  ansible.builtin.blockinfile:
+  community.general.ini_file:
     path: "/home/{{ ansible_user }}/.config/atuin/config.toml"
-    block: |
-      [dotfiles]
-      enabled = true
-    marker: ""
+    section: dotfiles
+    option: enabled
+    value: "true"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
 
 - name: Install bat
   apt:
@@ -39,6 +54,14 @@
     state: latest
     update_cache: true
 
+- name: Ensure ~/.local/bin exists
+  ansible.builtin.file:
+    path: "/home/{{ ansible_user }}/.local/bin"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: '0755'
+
 - name: Create symlink for batcat
   ansible.builtin.file:
     src: /usr/bin/batcat

roles/docker/templates/audiobookshelf-compose.yml.j2

@@ -10,7 +10,7 @@ services:
       - TZ=America/Denver
       - DISABLE_SSRF_REQUEST_FILTER=1
     extra_hosts:
-      - '{{ subdomains.auth }}:172.20.0.5'
+      - '{{ subdomains.auth }}:{{ docker.hairpin_ip }}'
     labels:
       glance.name: Audiobookshelf
       glance.icon: si:audiobookshelf

roles/docker/templates/authentik-compose.yml.j2

@@ -51,16 +51,13 @@ services:
       - ./custom-templates:/templates
     env_file:
       - .env
-    ports:
-      - "${COMPOSE_PORT_HTTP:-9000}:9000"
-      - "${COMPOSE_PORT_HTTPS:-9443}:9443"
     depends_on:
       - postgresql
       - trout
     labels:
       glance.name: Authentik
       glance.icon: si:authentik
-      glance.url: https://auth.thesatelliteoflove.com/
+      glance.url: https://{{ subdomains.auth }}/
       glance.description: Authentication server
       glance.id: authentik
   worker:
@@ -103,4 +100,4 @@ volumes:
 networks:
   default:
     external: true
-    name: lava
+    name: {{ docker.network_name }}

roles/docker/templates/bytestash-compose.yml.j2

@@ -8,7 +8,7 @@ services:
     environment:
       JWT_SECRET: "{{ vault_bytestash.jwt_secret }}"
       TOKEN_EXPIRY: "24h"
-      ALLOW_NEW_ACCOUNTS: "true"
+      ALLOW_NEW_ACCOUNTS: "false"
       DEBUG: "false"
       DISABLE_ACCOUNTS: "false"
       DISABLE_INTERNAL_ACCOUNTS: "false"

roles/docker/templates/caddy-compose.yml.j2

@@ -6,8 +6,6 @@ services:
       - "80:80"
       - "443:443"
       - "443:443/udp"
-      - "8448:8448"
-      - "8448:8448/udp"
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile
       - ./site:/srv

roles/docker/templates/codeserver-compose.yml.j2

@@ -1,23 +0,0 @@
-services:
-  codeserver:
-    stdin_open: true
-    tty: true
-    labels:
-      glance.name: Code Server
-      glance.icon: si:vscodium
-      glance.url: https://{{ subdomains.code }}/
-      glance.description: Code Server
-      mag37.dockcheck.update: true
-    container_name: codeserver
-    volumes:
-      - home:/home
-    environment:
-      - DOCKER_USER=$USER
-    image: codercom/code-server:latest
-volumes:
-  home:
-    driver: local
-networks:    
-  default:
-    external: true
-    name: {{ docker.network_name }}

roles/docker/templates/dir2opds-compose.yml.j2

@@ -4,7 +4,7 @@ services:
     image: ghcr.io/dubyte/dir2opds:v1.9.0
     container_name: dir2opds
     ports:
-      - "8080:8080"
+      - "{{ network.docker_host_ip }}:8080:8080"
     volumes:
       - ./books:/books
     command:

roles/docker/templates/dockge-compose.yml.j2

@@ -5,7 +5,7 @@ services:
     labels:
       glance.name: Dockge
       glance.icon: si:docker
-      glance.url: http://netcup.porgy-porgy.ts.net:5001
+      glance.url: http://{{ network.tailscale_hostname }}:5001
       glance.description: Docker management      
     ports:
       # Host Port : Container Port

roles/docker/templates/ghost-1-compose.yml.j2

@@ -1,27 +0,0 @@
-services:
-
-  ghost:
-    image: ghost:5-alpine
-    restart: unless-stopped
-    environment:
-      - database__client=sqlite3
-      - database__connection__filename=/var/lib/ghost/content/data/ghost.db
-      - database__useNullAsDefault=true
-      - url=https://{{ subdomains.phlog }}
-    volumes:
-      - ghost:/var/lib/ghost/content
-    extra_hosts:
-      - '{{ subdomains.phlog }}:172.20.0.5'
-    labels:
-      glance.name: Ghost
-      glance.icon: si:ghost
-      glance.url: https://{{ subdomains.phlog }}/
-      glance.description: Photo Blog
-      mag37.dockcheck.update: true
-volumes:
-  ghost:
-    driver: local
-networks:    
-  default:
-    external: true
-    name: {{ docker.network_name }}

roles/docker/templates/glance-compose.yml.j2

@@ -8,8 +8,8 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
     restart: unless-stopped
     extra_hosts:
-      - '{{ primary_domain }}:172.20.0.5'
-      - '{{ subdomains.watcher }}:172.20.0.5'
+      - '{{ primary_domain }}:{{ docker.hairpin_ip }}'
+      - '{{ subdomains.watcher }}:{{ docker.hairpin_ip }}'
     labels:
       glance.name: Glance
       glance.icon: si:homepage

roles/docker/templates/grocy-compose.yml.j2

@@ -1,30 +0,0 @@
-services:
-  grocy:
-    image: lscr.io/linuxserver/grocy:latest
-    container_name: grocy
-    restart: unless-stopped
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=America/Denver
-    volumes:
-      - ./config:/config
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
-    labels:
-      glance.name: Grocy
-      glance.icon: si:grocyapp
-      glance.url: https://{{ subdomains.grocy }}/
-      glance.description: Kitchen ERP and inventory management
-      glance.id: grocy
-      mag37.dockcheck.update: true
-
-volumes:
-  grocy_config:
-    driver: local
-
-networks:
-  default:
-    external: true
-    name: {{ docker.network_name }}

roles/docker/templates/hoarder-compose.yml.j2

@@ -5,8 +5,6 @@ services:
     restart: unless-stopped
     volumes:
       - data:/data
-    ports:
-      - 3000:3000
     env_file:
       - .env
     extra_hosts:

roles/docker/templates/kanboard-compose.yml.j2

@@ -1,32 +0,0 @@
-services:
-  kanboard:
-    image: kanboard/kanboard:latest
-    container_name: kanboard
-    restart: unless-stopped
-    environment:
-      - PLUGIN_INSTALLER=true
-      - DB_DRIVER=sqlite
-    volumes:
-      - kanboard_data:/var/www/app/data
-      - kanboard_plugins:/var/www/app/plugins
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
-    labels:
-      glance.name: Kanboard
-      glance.icon: si:kanboard
-      glance.url: https://{{ subdomains.kanboard }}/
-      glance.description: Project management and Kanban boards
-      glance.id: kanboard
-      mag37.dockcheck.update: true
-
-volumes:
-  kanboard_data:
-    driver: local
-  kanboard_plugins:
-    driver: local
-
-networks:
-  default:
-    external: true
-    name: {{ docker.network_name }}

roles/docker/templates/kosync-compose.yml.j2

@@ -4,7 +4,7 @@ services:
     image: koreader/kosync:latest
     container_name: kosync
     environment:
-      - ENABLE_USER_REGISTRATION=true
+      - ENABLE_USER_REGISTRATION=false
     volumes:
       - ./logs/app:/app/koreader-sync-server/logs
       - ./logs/redis:/var/log/redis

roles/docker/templates/mmdl-compose.yml.j2

@@ -1,48 +0,0 @@
-services:
-  mmdl:
-    image: intriin/mmdl:latest
-    container_name: mmdl
-    restart: unless-stopped
-    depends_on:
-      - mmdl_db
-    env_file:
-      - .env.local
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
-      - "{{ subdomains.cal }}:{{ docker.hairpin_ip }}"
-    labels:
-      glance.name: MMDL
-      glance.icon: si:task
-      glance.url: https://{{ subdomains.tasks }}/
-      glance.description: Task and calendar management
-      glance.id: mmdl
-      mag37.dockcheck.update: true
-
-  mmdl_db:
-    image: mysql:8.0
-    container_name: mmdl_db
-    restart: unless-stopped
-    command: --default-authentication-plugin=mysql_native_password
-    environment:
-      MYSQL_DATABASE: mmdl
-      MYSQL_USER: mmdl
-      MYSQL_PASSWORD: "{{ vault_mmdl.mysql_password }}"
-      MYSQL_ROOT_PASSWORD: "{{ vault_mmdl.mysql_root_password }}"
-      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
-      MYSQL_ROOT_HOST: "%"
-    volumes:
-      - mmdl_db:/var/lib/mysql
-    labels:
-      glance.parent: mmdl
-      glance.name: DB
-      mag37.dockcheck.update: true
-
-volumes:
-  mmdl_db:
-    driver: local
-
-networks:
-  default:
-    external: true
-    name: {{ docker.network_name }}

roles/docker/templates/mmdl-env.j2

@@ -1,42 +0,0 @@
-# Database Configuration
-DB_HOST=mmdl_db
-DB_USER=mmdl
-DB_PASS={{ vault_mmdl.mysql_password }}
-DB_PORT=3306
-DB_DIALECT=mysql
-DB_CHARSET=utf8mb4
-DB_NAME=mmdl
-
-# Encryption
-AES_PASSWORD={{ vault_mmdl.aes_password }}
-
-# SMTP Settings
-SMTP_HOST={{ smtp.host }}
-SMTP_USERNAME={{ smtp.username }}
-SMTP_PASSWORD={{ vault_smtp.password }}
-SMTP_FROM=tasks@{{ email_domains.updates }}
-SMTP_PORT=587
-SMTP_SECURE=true
-
-# Authentication
-USE_NEXT_AUTH=true
-NEXTAUTH_URL=https://{{ subdomains.tasks }}
-NEXTAUTH_SECRET={{ vault_mmdl.nextauth_secret }}
-
-# Authentik OIDC Configuration
-AUTHENTIK_ISSUER=https://{{ subdomains.auth }}/application/o/mmdl
-AUTHENTIK_CLIENT_ID={{ vault_mmdl.oidc.client_id }}
-AUTHENTIK_CLIENT_SECRET={{ vault_mmdl.oidc.client_secret }}
-
-# User and Session Management
-ALLOW_USER_REGISTRATION=false
-MAX_CONCURRENT_LOGINS=3
-OTP_VALIDITY_PERIOD=300
-SESSION_VALIDITY_PERIOD=30
-
-# Application Settings
-API_URL=https://{{ subdomains.tasks }}
-DEBUG_MODE=false
-TEST_MODE=false
-NEXT_API_DEBUG_MODE=false
-SUBTASK_RECURSION_DEPTH=5

roles/docker/templates/palmr-compose.yml.j2

@@ -1,30 +0,0 @@
-services:
-  palmr:
-    image: kyantech/palmr:latest
-    restart: unless-stopped
-    environment:
-      DISABLE_FILESYSTEM_ENCRYPTION: "false"
-      ENCRYPTION_KEY: "{{ vault_palmr.encryption_key }}"
-      PALMR_UID: "1000"
-      PALMR_GID: "1000"
-      SECURE_SITE: "true"
-      DEFAULT_LANGUAGE: "en-US"
-      TRUST_PROXY: "true"
-    extra_hosts:
-      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
-    labels:
-      glance.name: Palmr
-      glance.icon: si:files
-      glance.url: "https://{{ subdomains.files }}/"
-      glance.description: File sharing and storage
-      glance.id: palmr
-      mag37.dockcheck.update: true
-    volumes:
-      - palmr_data:/app/server
-volumes:
-  palmr_data:
-    driver: local
-networks:
-  default:
-    external: true
-    name: "{{ docker.network_name }}"

roles/docker/templates/paperlessngx-compose.yml.j2

@@ -12,6 +12,8 @@ services:
     image: ghcr.io/paperless-ngx/paperless-ngx:latest
     restart: unless-stopped
     labels:
+      # Stop during backup so the SQLite database in the data volume is consistent
+      docker-volume-backup.stop-during-backup: true
       glance.name: Paperless NGX
       glance.icon: si:paperlessngx
       glance.url: https://{{ subdomains.paper }}/
@@ -75,6 +77,7 @@ services:
       AWS_SECRET_ACCESS_KEY: {{ vault_backup.secret_access_key }}
     volumes:
       - media:/backup/pngx-app-backup:ro
+      - data:/backup/pngx-data-backup:ro
       - /var/run/docker.sock:/var/run/docker.sock:ro
 
 volumes:

roles/docker/templates/pinchflat-compose.yml.j2

@@ -1,22 +0,0 @@
-services:
-  pinchflat:
-    environment:
-      - TZ=America/Denver
-    ports:
-      - 100.70.169.99:8945:8945
-    volumes:
-      - ./config:/config
-      - data:/downloads
-    image: ghcr.io/kieraneglin/pinchflat:latest
-    labels:
-      glance.name: Pinchflat
-      glance.icon: si:youtube
-      glance.url: http://netcup.porgy-porgy.ts.net:8945
-      glance.description: Youtube interface
-      glance.id: pinchflat
-volumes:
-  data:
-networks:
-  default:
-    external: true
-    name: lava

roles/docker/templates/pinry-compose.yml.j2

@@ -1,21 +0,0 @@
-services:
-  pinry:
-    volumes:
-      - pinry:/data
-    labels:
-      glance.name: Pinry
-      glance.icon: si:pinterest
-      glance.url: https://{{ subdomains.pin }}
-      glance.description: Pinterest clone
-      glance.id: pinterest
-    environment:
-      - SECRET_KEY=no2254XiwYFWDnt2UW6wraSbVPRdHx8wVIeBh3jeYcI=
-      - ALLOW_NEW_REGISTRATIONS=False
-    image: getpinry/pinry
-volumes:
-  pinry:
-    driver: local
-networks:
-  default:
-    external: true
-    name: {{ docker.network_name }}

roles/docker/templates/postiz-compose.yml.j2

@@ -1,96 +0,0 @@
-services:
-  postiz:
-    image: ghcr.io/gitroomhq/postiz-app:latest
-    container_name: postiz
-    restart: always
-    environment:
-      # You must change these. Replace `postiz.your-server.com` with your DNS name - what your web browser sees.
-      MAIN_URL: "https://{{ subdomains.post }}"
-      FRONTEND_URL: "https://{{ subdomains.post }}"
-      NEXT_PUBLIC_BACKEND_URL: "https://{{ subdomains.post }}/api"
-      JWT_SECRET: "TShr6Fdcwf67wIhuUvg0gOsJbdcQmgMiJl5kUh6JCfY="
- 
-      # These defaults are probably fine, but if you change your user/password, update it in the
-      # postiz-postgres or postiz-redis services below.
-      DATABASE_URL: "postgresql://postiz-user:postiz-password@postiz-postgres:5432/postiz-db-local"
-      REDIS_URL: "redis://postiz-redis:6379"
-      BACKEND_INTERNAL_URL: "http://localhost:3000"
-      IS_GENERAL: "true" # Required for self-hosting.
-      # The container images are pre-configured to use /uploads for file storage.
-      # You probably should not change this unless you have a really good reason!
-      STORAGE_PROVIDER: "local"
-      UPLOAD_DIRECTORY: "/uploads"
-      NEXT_PUBLIC_UPLOAD_DIRECTORY: "/uploads"
-
-      # Social keys
-      LINKEDIN_CLIENT_ID: "86q7ksc8q5pai3"
-      LINKEDIN_CLIENT_SECRET: {{ vault_postiz.linkedin_secret }}
-    volumes:
-      - postiz-config:/config/
-      - postiz-uploads:/uploads/
-    depends_on:
-      postiz-postgres:
-        condition: service_healthy
-      postiz-redis:
-        condition: service_healthy
-    labels:
-      glance.name: Postiz
-      glance.url: https://{{ subdomains.post }}/
-      glance.description: Social media scheduler
-      glance.id: postiz
-      mag37.dockcheck.update: true
- 
-  postiz-postgres:
-    image: postgres:14.5
-    container_name: postiz-postgres
-    restart: always
-    environment:
-      POSTGRES_PASSWORD: postiz-password
-      POSTGRES_USER: postiz-user
-      POSTGRES_DB: postiz-db-local
-    volumes:
-      - postgres-volume:/var/lib/postgresql/data
-    healthcheck:
-      test: pg_isready -U postiz-user -d postiz-db-local
-      interval: 10s
-      timeout: 3s
-      retries: 3
-    labels:
-      glance.parent: postiz
-      glance.name: DB
-      mag37.dockcheck.update: true
-  postiz-redis:
-    image: redis:7.2
-    container_name: postiz-redis
-    restart: always
-    healthcheck:
-      test: redis-cli ping
-      interval: 10s
-      timeout: 3s
-      retries: 3
-    volumes:
-      - postiz-redis-data:/data
-    labels:
-      glance.parent: postiz
-      glance.name: Redis
-      mag37.dockcheck.update: true
-
- 
- 
-volumes:
-  postgres-volume:
-    external: false
- 
-  postiz-redis-data:
-    external: false
- 
-  postiz-config:
-    external: false
- 
-  postiz-uploads:
-    external: false
- 
-networks:
-  default:
-    external: true
-    name: {{ docker.network_name }}

roles/docker/templates/syncthing-compose.yml.j2

@@ -6,7 +6,7 @@ services:
     labels:
       glance.name: Syncthing
       glance.icon: si:syncthing
-      glance.url: https://netcup.porgy-porgy.ts.net:8384
+      glance.url: https://{{ network.tailscale_hostname }}:8384
       glance.description: Syncthing core
       glance.id: Syncthing
       mag37.dockcheck.update: true
@@ -16,10 +16,10 @@ services:
     volumes:
       - home:/var/syncthing
     ports:
-      - 100.70.169.99:8384:8384 # Web UI
-      - 100.70.169.99:22000:22000/tcp # TCP file transfers
-      - 100.70.169.99:22000:22000/udp # QUIC file transfers
-      - 100.70.169.99:21027:21027/udp # Receive local discovery broadcasts
+      - {{ network.docker_host_ip }}:8384:8384 # Web UI
+      - {{ network.docker_host_ip }}:22000:22000/tcp # TCP file transfers
+      - {{ network.docker_host_ip }}:22000:22000/udp # QUIC file transfers
+      - {{ network.docker_host_ip }}:21027:21027/udp # Receive local discovery broadcasts
     restart: unless-stopped
     healthcheck:
       test: curl -fkLsS -m 2 127.0.0.1:8384/rest/noauth/health | grep -o --color=never OK || exit 1