StarPunk 2.0.0 logs in with Pocket ID and issues its own Micropub tokens
(ADR-064 in the StarPunk repo), so the Gondulf IndieAuth server is no
longer used. Removes its task, templates, Caddy route, subdomain and
service entry, and moves its DNS record to removed_records.
The StarPunk template was still on v1.6.0-rc.2 with Gondulf hairpin
hosts; deploying it would have broken login. It now matches production:
v2.0.0, Pocket ID hairpin, OIDC client from vault_starpunk.pocketid and
the admin sub in starpunk_admin_sub.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
All of Authentik's applications (including Tailscale's tailnet login)
have moved to Pocket ID, and its only recent sign-ins were those
handovers. Drops its stack, the auth. route and DNS record, the auth
subdomain variables, Gotify's leftover hairpin entries, and the dockcheck
exclude; the docs now name Pocket ID as the SSO provider.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both were hand-deployed to /opt/stacks. Templates match the live setup
and keep the same stack dirs and volume names, so data stays put.
Secrets come from the vault; .env and the StarPunk compose file are now
0640 root:docker instead of the broken 1204 mode. Adds their DNS
records to dns.yml and drops the dead godulf. Caddy route (no DNS).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kavita's KOReader sync API and OPDS feed replace them, and both readers
(Kindle KOReader, Xteink X4) now point at books.thesatelliteoflove.com.
Drops their stacks, the sync. and opds. routes and DNS records, and the
htpasswd tasks that only existed for dir2opds basic auth.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kavita now serves books.thesatelliteoflove.com with Pocket ID login
(password login is off), and the temporary kavita. subdomain is gone.
Calibre-Web's stack is removed; its calibre_books and calibre_config
volumes stay on docker-01 as a fallback for now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Deploys from unpushed branches were being reverted by the next deploy
from main, and in-place vault edits could overwrite each other.
- deploy-guard.yml (imported by site.yml and dns.yml) refuses real runs
unless the checkout is clean and exactly origin/main; --check is fine.
- bin/deploy holds a lock so only one deploy runs at a time.
- bin/vault-run edits the vault under a lock with an atomic swap.
- bin/worktree starts a task in a fresh worktree from origin/main.
- CLAUDE.md explains the workflow.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop the Glance stack, its home. route and DNS record, the glance.*
labels on every container, and the Glance restart in the Warhammer
feed cron script. Update docs to match.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs next to Calibre-Web at a temporary kavita. subdomain until it takes
over books. Each book lives in its own folder under
/opt/stacks/kavita/books, because Kavita names a book after its folder.
The admin password is in the vault as vault_kavita.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dns.yml no longer depends on an expiring 'aws login' session. The
ansible_dns user's keys are in vault_aws_dns and can only edit the
thesatelliteoflove.com and nerder.land zones. Also adds the id record.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Quote file modes. Unquoted 644/755 were read as decimal, so files
landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
them over the docker network), bind dir2opds to the Tailscale IP, and
drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replace deploy tasks with teardown tasks that stop containers and remove
stack directories. Remove Caddy routes and DNS records, with explicit
Route53 deletion for the decommissioned subdomains.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add grocy subdomain to domains.yml
- Create Docker Compose template using LinuxServer image
- Add Ansible task for service deployment
- Configure Caddy reverse proxy with Authentik auth and API bypass
- Add DNS record for grocy subdomain
- Integrate with productivity services category
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add kanboard subdomain to domains.yml
- Create Docker Compose template with SQLite backend and plugin store enabled
- Add Ansible task for service deployment
- Configure Caddy reverse proxy routing
- Integrate with productivity services category
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add ByteStash Docker service configuration and deployment
- Configure subdomain routing through Caddy
- Add DNS record for ByteStash subdomain
- Update development service category to include ByteStash
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add comprehensive push notification infrastructure with:
- Gotify server for push notifications with admin password configuration
- iGotify Assistant service for iOS notification relay via Apple Push Notifications
- Dual subdomain setup (gotify.* and gotify-assistant.*)
- Proper service dependencies and container communication via hairpinning
- Caddy reverse proxy configuration for both services
- DNS A records for both subdomains
- Added to monitoring services category
- Tested with successful notification delivery
Services accessible at:
- https://gotify.thesatelliteoflove.com (main server)
- https://gotify-assistant.thesatelliteoflove.com (iOS assistant)
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Remove all traces of the Conduit Matrix homeserver service including:
- Delete conduit-compose.yml.j2 template and conduit.yml task file
- Remove conduit from development services category
- Remove conduit Caddy reverse proxy configuration
- Remove conduit subdomain from domains.yml
- Remove conduit DNS A record from Route53
- Delete Matrix well-known files (client/server)
- Update all documentation from 25 to 24 services
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
This comprehensive update improves maintainability and removes unused services:
## Major Changes
- Remove 5 unused services (beaver, grist, stirlingpdf, tasksmd, redlib)
- Convert remaining static compose files to Jinja2 templates
- Clean up Caddyfile removing orphaned proxy configurations
- Align DNS records with active services
## Service Cleanup
- Remove habits.thesatelliteoflove.com DNS record (beaver service)
- Add missing DNS records for active services:
- post.thesatelliteoflove.com (Postiz)
- files.thesatelliteoflove.com (Pingvin Share)
- bookmarks.thesatelliteoflove.com (Hoarder)
## Template Standardization
- Convert caddy-compose.yml to template
- Convert dockge-compose.yml to template
- Convert hoarder-compose.yml to template
- All services now use consistent template-driven approach
## Documentation Updates
- Update CLAUDE.md with new service organization
- Update README.md files with category-based deployment examples
- Update todo.md with completed work summary
- Service count updated to 22+ active services
Infrastructure is now fully organized, cleaned up, and ready for future enhancements.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add tasks.thesatelliteoflove.com A record pointing to server IP
- Enable MMDL task management service accessibility
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
philandClaude