Tailscale's issuer lookup didn't match the resource=acct:phil@ filter,
got redirected to GoToSocial, found no issuer and fell back to Authentik.
phil is the only account here, so serve the same record for all queries.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tailscale finds the tailnet's login provider through the OpenID issuer
link in phil@'s WebFinger record, which now points at Pocket ID. The
same record carries GoToSocial's links, since the apex is its account
domain; other fediverse discovery paths redirect to GoToSocial. All of
these returned 404 before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ENABLE_OPENID_SIGNUP let anyone with an OpenID URL register despite
DISABLE_REGISTRATION (an account was created that way on 2026-09-30).
All logins go through Pocket ID now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The OAuth2 source in Gitea's database was renamed to PocketID and pointed
at Pocket ID with 'gitea admin auth update-oauth', and the existing
user's external login was remapped to the Pocket ID user. Here the
container now resolves the Pocket ID host instead of Authentik; the
runner never needed the login host. Credentials are in vault_gitea.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop the Glance stack, its home. route and DNS record, the glance.*
labels on every container, and the Glance restart in the Warhammer
feed cron script. Update docs to match.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The first Pocket ID login linked to the existing account by email, then
GTS_OIDC_LINK_EXISTING was switched off so only that Pocket ID identity
can sign in. The Authentik credentials stay in the vault for rollback.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The first Pocket ID login linked to the existing account by email, then
email-based account linking was switched off so only that Pocket ID
identity can sign in. The client ID now comes from the vault instead of
being written in the template.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs next to Calibre-Web at a temporary kavita. subdomain until it takes
over books. Each book lives in its own folder under
/opt/stacks/kavita/books, because Kavita names a book after its folder.
The admin password is in the vault as vault_kavita.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Pocket ID was added as a second allauth provider first, so the existing
account could be connected from the Paperless profile page. With that
done, the Authentik provider is removed. Its credentials stay in the
vault for rollback.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Manyfold matches linked users on provider + uid, so the existing user's
auth_uid was remapped to the Pocket ID user before deploying.
HTTPS_ONLY is needed so Manyfold builds an https callback URL behind
Caddy. The Authentik credentials stay in the vault for rollback.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ByteStash matches users on issuer + sub only, so the existing user row
was remapped to the Pocket ID user before this was deployed. The old
Authentik credentials stay in the vault for rollback.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs next to Authentik. The encryption key lives in vault_pocketid, and
the .env task hides its diff so the key doesn't show up in output.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
apprise and audiobookshelf had no restart policy, and the dawarich app
and sidekiq used on-failure. Docker stops containers cleanly on a
reboot or daemon upgrade, so none of them came back on their own.
Use unless-stopped like the other services.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
micropub_server-micropub-1 no longer exists, so /micropub on
thesatelliteoflove.com only returned errors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bcrypt uses a random salt, so hashing the basic auth password on every
run changed the Caddyfile each time and triggered the Caddy restart
handler. Reuse the deployed hash while it still matches the vault
password, and only make a new one when it doesn't (or on a fresh host).
The old awk also turned htpasswd's trailing blank line into a stray
line in the Caddyfile; the next deploy removes it once.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
lava was created by hand without an ip_range, so any container could be
given Caddy's fixed IP (172.20.0.5). After a reboot the containers race
for the low addresses and Caddy often fails with "Address already in use".
- The docker role now creates lava as 172.20.0.0/16 with dynamic
addresses limited to 172.20.128.0/17, so 172.20.0.x is free for fixed
IPs, and warns if the network still has the old layout.
- Gitea gets fixed IP 172.20.0.6 once the network has the reserved range,
since its ufw-docker SSH rule points at its IP.
- ufw-docker allow rules for Caddy (80, 443) and Gitea SSH are managed by
the playbook and follow IP changes.
- migrate-lava-network.yml recreates the existing network once: it takes
down every compose project on lava (volumes kept), recreates the
network, and brings them back up, Caddy first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Quote file modes. Unquoted 644/755 were read as decimal, so files
landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
them over the docker network), bind dir2opds to the Tailscale IP, and
drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Removed references to 9 decommissioned services from CLAUDE.md,
README.md, domains.yml, services.yml, and Glance release tracking.
Added services tag and Cronmaster to docs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace deploy tasks with teardown tasks that stop containers and remove
stack directories. Remove Caddy routes and DNS records, with explicit
Route53 deletion for the decommissioned subdomains.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add mag37.dockcheck.update labels to enable automated container update monitoring for:
- Gotify iOS assistant service
- Karakeep (Hoarder) bookmark manager and all components (Chrome, Meilisearch)
- MMDL task management service
- Postiz social media scheduler and all components (PostgreSQL, Redis)
This completes the rollout of dockcheck labels across all Docker services for consistent update monitoring.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add grocy subdomain to domains.yml
- Create Docker Compose template using LinuxServer image
- Add Ansible task for service deployment
- Configure Caddy reverse proxy with Authentik auth and API bypass
- Add DNS record for grocy subdomain
- Integrate with productivity services category
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add kanboard subdomain to domains.yml
- Create Docker Compose template with SQLite backend and plugin store enabled
- Add Ansible task for service deployment
- Configure Caddy reverse proxy routing
- Integrate with productivity services category
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update service count from 24 to 27 across all documentation
- Add missing services: ByteStash, Obsidian LiveSync, Gotify
- Update service categories in README.md, CLAUDE.md, docker/README.md
- Remove deprecated secrets.enc references from command examples
- Update todo.md with complete service listings
- Ensure all documentation accurately reflects current infrastructure
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Replace all Pingvin references with Palmr in documentation
- Update README.md, CLAUDE.md, roles/docker/README.md, and todo.md
- Maintain accurate service count (24 services)
- Update service memories and productivity category listings
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add Palmr Docker Compose template with encryption enabled
- Create Palmr deployment tasks for productivity category
- Add files.thesatelliteoflove.com routing in Caddyfile
- Restore files subdomain for Palmr service
- Add Palmr to Glance dashboard with file icon
- Generate and store encryption key in vault
- Configure HTTPS, Authentik integration, and dockcheck updates
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Remove Pingvin Docker Compose template and deployment tasks
- Remove files.thesatelliteoflove.com routing from Caddyfile
- Remove files subdomain from domain variables
- Stop and remove Pingvin containers from remote server
- Clean up /opt/stacks/pingvin directory
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add mag37.dockcheck.update labels to audiobookshelf, caddy, gitea services
- Fix Gotify container names in Caddyfile routing
- Add explicit container names for gotify and igotify-assistant services
- Update Authentik to version 2025.6.3
- Fix environment variable format in gotify-compose template
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
phil