Jobs run inside the runner container (label docker:host), and with the
host's Docker socket mounted every workflow had root on the server. The
socket was only there for StarPunk's image build, which has never worked
(it logged in to gitea:3000, which the host daemon can't resolve).
Image builds now go to a rootless BuildKit container that shares only a
unix socket with the runner. Site builds keep their /sites mount.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ENABLE_OPENID_SIGNUP let anyone with an OpenID URL register despite
DISABLE_REGISTRATION (an account was created that way on 2026-09-30).
All logins go through Pocket ID now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The OAuth2 source in Gitea's database was renamed to PocketID and pointed
at Pocket ID with 'gitea admin auth update-oauth', and the existing
user's external login was remapped to the Pocket ID user. Here the
container now resolves the Pocket ID host instead of Authentik; the
runner never needed the login host. Credentials are in vault_gitea.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop the Glance stack, its home. route and DNS record, the glance.*
labels on every container, and the Glance restart in the Warhammer
feed cron script. Update docs to match.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
lava was created by hand without an ip_range, so any container could be
given Caddy's fixed IP (172.20.0.5). After a reboot the containers race
for the low addresses and Caddy often fails with "Address already in use".
- The docker role now creates lava as 172.20.0.0/16 with dynamic
addresses limited to 172.20.128.0/17, so 172.20.0.x is free for fixed
IPs, and warns if the network still has the old layout.
- Gitea gets fixed IP 172.20.0.6 once the network has the reserved range,
since its ufw-docker SSH rule points at its IP.
- ufw-docker allow rules for Caddy (80, 443) and Gitea SSH are managed by
the playbook and follow IP changes.
- migrate-lava-network.yml recreates the existing network once: it takes
down every compose project on lava (volumes kept), recreates the
network, and brings them back up, Caddy first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Add mag37.dockcheck.update labels to audiobookshelf, caddy, gitea services
- Fix Gotify container names in Caddyfile routing
- Add explicit container names for gotify and igotify-assistant services
- Update Authentik to version 2025.6.3
- Fix environment variable format in gotify-compose template
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Create standardized group_vars directory structure
- Add domains.yml with centralized subdomain mappings
- Add infrastructure.yml with network, SMTP, and path config
- Reorganize vault.yml secrets by service with consistent naming
- Update 15+ Docker compose templates to use new variable structure
- Simplify playbook commands by removing --extra-vars requirement
- Replace hardcoded domains/IPs with template variables
- Standardize secret references across all services
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
philandClaude