StarPunk 2.1.0 copies new notes to GoToSocial and keeps edits and
deletes in step. Token for the app "StarPunk crossposting" (scopes
write:statuses write:media) is in vault_starpunk.gotosocial_token; the
container reaches social. through Caddy (hairpin).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2.20.15 has run its migrations, so this is the supported jump to v3.
Search moves to Tantivy and is rebuilt on first start.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
v3 can only be reached from 2.20.15, so stop tracking :latest. Also set
the two settings v3 needs from us: trust Caddy as the proxy (v3's login
rate limiting), and keep rejecting duplicate documents.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
StarPunk's Gitea Actions workflow now builds and pushes the image on
vX.Y.Z tags. Pin the tag in starpunk_version (v2.0.2, the first CI build)
and always pull it, so an image built by hand on the server with the
same name can't be deployed instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
StarPunk 2.0.0 logs in with Pocket ID and issues its own Micropub tokens
(ADR-064 in the StarPunk repo), so the Gondulf IndieAuth server is no
longer used. Removes its task, templates, Caddy route, subdomain and
service entry, and moves its DNS record to removed_records.
The StarPunk template was still on v1.6.0-rc.2 with Gondulf hairpin
hosts; deploying it would have broken login. It now matches production:
v2.0.0, Pocket ID hairpin, OIDC client from vault_starpunk.pocketid and
the admin sub in starpunk_admin_sub.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
All of Authentik's applications (including Tailscale's tailnet login)
have moved to Pocket ID, and its only recent sign-ins were those
handovers. Drops its stack, the auth. route and DNS record, the auth
subdomain variables, Gotify's leftover hairpin entries, and the dockcheck
exclude; the docs now name Pocket ID as the SSO provider.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Gokapi now keeps its config and data in /opt/stacks/gokapi instead of named
volumes. config.json is templated with Pocket ID as the OIDC provider, so a
fresh install never shows the open /setup wizard. On a new database a one-off
run with --deployment-password creates the super admin, after which only
existing users can log in.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both were hand-deployed to /opt/stacks. Templates match the live setup
and keep the same stack dirs and volume names, so data stays put.
Secrets come from the vault; .env and the StarPunk compose file are now
0640 root:docker instead of the broken 1204 mode. Adds their DNS
records to dns.yml and drops the dead godulf. Caddy route (no DNS).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kavita's KOReader sync API and OPDS feed replace them, and both readers
(Kindle KOReader, Xteink X4) now point at books.thesatelliteoflove.com.
Drops their stacks, the sync. and opds. routes and DNS records, and the
htpasswd tasks that only existed for dir2opds basic auth.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kavita now serves books.thesatelliteoflove.com with Pocket ID login
(password login is off), and the temporary kavita. subdomain is gone.
Calibre-Web's stack is removed; its calibre_books and calibre_config
volumes stay on docker-01 as a fallback for now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop the Glance stack, its home. route and DNS record, the glance.*
labels on every container, and the Glance restart in the Warhammer
feed cron script. Update docs to match.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs next to Calibre-Web at a temporary kavita. subdomain until it takes
over books. Each book lives in its own folder under
/opt/stacks/kavita/books, because Kavita names a book after its folder.
The admin password is in the vault as vault_kavita.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs next to Authentik. The encryption key lives in vault_pocketid, and
the .env task hides its diff so the key doesn't show up in output.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
lava was created by hand without an ip_range, so any container could be
given Caddy's fixed IP (172.20.0.5). After a reboot the containers race
for the low addresses and Caddy often fails with "Address already in use".
- The docker role now creates lava as 172.20.0.0/16 with dynamic
addresses limited to 172.20.128.0/17, so 172.20.0.x is free for fixed
IPs, and warns if the network still has the old layout.
- Gitea gets fixed IP 172.20.0.6 once the network has the reserved range,
since its ufw-docker SSH rule points at its IP.
- ufw-docker allow rules for Caddy (80, 443) and Gitea SSH are managed by
the playbook and follow IP changes.
- migrate-lava-network.yml recreates the existing network once: it takes
down every compose project on lava (volumes kept), recreates the
network, and brings them back up, Caddy first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Quote file modes. Unquoted 644/755 were read as decimal, so files
landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
them over the docker network), bind dir2opds to the Tailscale IP, and
drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Removed references to 9 decommissioned services from CLAUDE.md,
README.md, domains.yml, services.yml, and Glance release tracking.
Added services tag and Cronmaster to docs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add grocy subdomain to domains.yml
- Create Docker Compose template using LinuxServer image
- Add Ansible task for service deployment
- Configure Caddy reverse proxy with Authentik auth and API bypass
- Add DNS record for grocy subdomain
- Integrate with productivity services category
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add kanboard subdomain to domains.yml
- Create Docker Compose template with SQLite backend and plugin store enabled
- Add Ansible task for service deployment
- Configure Caddy reverse proxy routing
- Integrate with productivity services category
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add Palmr Docker Compose template with encryption enabled
- Create Palmr deployment tasks for productivity category
- Add files.thesatelliteoflove.com routing in Caddyfile
- Restore files subdomain for Palmr service
- Add Palmr to Glance dashboard with file icon
- Generate and store encryption key in vault
- Configure HTTPS, Authentik integration, and dockcheck updates
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Remove Pingvin Docker Compose template and deployment tasks
- Remove files.thesatelliteoflove.com routing from Caddyfile
- Remove files subdomain from domain variables
- Stop and remove Pingvin containers from remote server
- Clean up /opt/stacks/pingvin directory
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add ByteStash Docker service configuration and deployment
- Configure subdomain routing through Caddy
- Add DNS record for ByteStash subdomain
- Update development service category to include ByteStash
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add comprehensive push notification infrastructure with:
- Gotify server for push notifications with admin password configuration
- iGotify Assistant service for iOS notification relay via Apple Push Notifications
- Dual subdomain setup (gotify.* and gotify-assistant.*)
- Proper service dependencies and container communication via hairpinning
- Caddy reverse proxy configuration for both services
- DNS A records for both subdomains
- Added to monitoring services category
- Tested with successful notification delivery
Services accessible at:
- https://gotify.thesatelliteoflove.com (main server)
- https://gotify-assistant.thesatelliteoflove.com (iOS assistant)
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Remove all traces of the Conduit Matrix homeserver service including:
- Delete conduit-compose.yml.j2 template and conduit.yml task file
- Remove conduit from development services category
- Remove conduit Caddy reverse proxy configuration
- Remove conduit subdomain from domains.yml
- Remove conduit DNS A record from Route53
- Delete Matrix well-known files (client/server)
- Update all documentation from 25 to 24 services
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update service count from 22+ to 25 across documentation
- Add vault.yml to gitignore for security
- Add notifications configuration for AppriseAPI integration
- Add jq package to common role dependencies
- Add hairpin networking fix for AppriseAPI chat subdomain access
- Remove diun service references from monitoring category
- Update project completion status in todo.md
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update remaining Docker Compose templates with centralized variables
- Fix service tag isolation to deploy individual services only
- Update all README files with variable management architecture
- Document variable hierarchy in DEPLOYMENT_LEARNINGS.md
- Add comprehensive variable usage patterns to CLAUDE.md
- Standardize domain references using {{ subdomains.* }} pattern
- Replace hardcoded network names with {{ docker.network_name }}
- Update hairpinning configuration to use variables
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Create standardized group_vars directory structure
- Add domains.yml with centralized subdomain mappings
- Add infrastructure.yml with network, SMTP, and path config
- Reorganize vault.yml secrets by service with consistent naming
- Update 15+ Docker compose templates to use new variable structure
- Simplify playbook commands by removing --extra-vars requirement
- Replace hardcoded domains/IPs with template variables
- Standardize secret references across all services
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
philandClaude