dns.yml no longer depends on an expiring 'aws login' session. The
ansible_dns user's keys are in vault_aws_dns and can only edit the
thesatelliteoflove.com and nerder.land zones. Also adds the id record.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs next to Authentik. The encryption key lives in vault_pocketid, and
the .env task hides its diff so the key doesn't show up in output.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
apprise and audiobookshelf had no restart policy, and the dawarich app
and sidekiq used on-failure. Docker stops containers cleanly on a
reboot or daemon upgrade, so none of them came back on their own.
Use unless-stopped like the other services.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
micropub_server-micropub-1 no longer exists, so /micropub on
thesatelliteoflove.com only returned errors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bcrypt uses a random salt, so hashing the basic auth password on every
run changed the Caddyfile each time and triggered the Caddy restart
handler. Reuse the deployed hash while it still matches the vault
password, and only make a new one when it doesn't (or on a fresh host).
The old awk also turned htpasswd's trailing blank line into a stray
line in the Caddyfile; the next deploy removes it once.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
lava was created by hand without an ip_range, so any container could be
given Caddy's fixed IP (172.20.0.5). After a reboot the containers race
for the low addresses and Caddy often fails with "Address already in use".
- The docker role now creates lava as 172.20.0.0/16 with dynamic
addresses limited to 172.20.128.0/17, so 172.20.0.x is free for fixed
IPs, and warns if the network still has the old layout.
- Gitea gets fixed IP 172.20.0.6 once the network has the reserved range,
since its ufw-docker SSH rule points at its IP.
- ufw-docker allow rules for Caddy (80, 443) and Gitea SSH are managed by
the playbook and follow IP changes.
- migrate-lava-network.yml recreates the existing network once: it takes
down every compose project on lava (volumes kept), recreates the
network, and brings them back up, Caddy first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Quote file modes. Unquoted 644/755 were read as decimal, so files
landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
them over the docker network), bind dir2opds to the Tailscale IP, and
drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Removed references to 9 decommissioned services from CLAUDE.md,
README.md, domains.yml, services.yml, and Glance release tracking.
Added services tag and Cronmaster to docs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace deploy tasks with teardown tasks that stop containers and remove
stack directories. Remove Caddy routes and DNS records, with explicit
Route53 deletion for the decommissioned subdomains.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add mag37.dockcheck.update labels to enable automated container update monitoring for:
- Gotify iOS assistant service
- Karakeep (Hoarder) bookmark manager and all components (Chrome, Meilisearch)
- MMDL task management service
- Postiz social media scheduler and all components (PostgreSQL, Redis)
This completes the rollout of dockcheck labels across all Docker services for consistent update monitoring.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add grocy subdomain to domains.yml
- Create Docker Compose template using LinuxServer image
- Add Ansible task for service deployment
- Configure Caddy reverse proxy with Authentik auth and API bypass
- Add DNS record for grocy subdomain
- Integrate with productivity services category
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add kanboard subdomain to domains.yml
- Create Docker Compose template with SQLite backend and plugin store enabled
- Add Ansible task for service deployment
- Configure Caddy reverse proxy routing
- Integrate with productivity services category
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update service count from 24 to 27 across all documentation
- Add missing services: ByteStash, Obsidian LiveSync, Gotify
- Update service categories in README.md, CLAUDE.md, docker/README.md
- Remove deprecated secrets.enc references from command examples
- Update todo.md with complete service listings
- Ensure all documentation accurately reflects current infrastructure
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Replace all Pingvin references with Palmr in documentation
- Update README.md, CLAUDE.md, roles/docker/README.md, and todo.md
- Maintain accurate service count (24 services)
- Update service memories and productivity category listings
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add Palmr Docker Compose template with encryption enabled
- Create Palmr deployment tasks for productivity category
- Add files.thesatelliteoflove.com routing in Caddyfile
- Restore files subdomain for Palmr service
- Add Palmr to Glance dashboard with file icon
- Generate and store encryption key in vault
- Configure HTTPS, Authentik integration, and dockcheck updates
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Remove Pingvin Docker Compose template and deployment tasks
- Remove files.thesatelliteoflove.com routing from Caddyfile
- Remove files subdomain from domain variables
- Stop and remove Pingvin containers from remote server
- Clean up /opt/stacks/pingvin directory
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add mag37.dockcheck.update labels to audiobookshelf, caddy, gitea services
- Fix Gotify container names in Caddyfile routing
- Add explicit container names for gotify and igotify-assistant services
- Update Authentik to version 2025.6.3
- Fix environment variable format in gotify-compose template
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Wrap Go template syntax in Jinja2 raw blocks to prevent parsing conflicts
- Fix custom-api air quality widget template rendering
- Update Glance dashboard layout with search widget and head-widgets
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add Obsidian LiveSync Docker service with CouchDB backend
- Configure service for Tailscale-only access on port 5984
- Add vault credentials for database authentication
- Create productivity category task and handler
- Enable Glance dashboard integration
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add ByteStash Docker service configuration and deployment
- Configure subdomain routing through Caddy
- Add DNS record for ByteStash subdomain
- Update development service category to include ByteStash
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Added dockcheck label to enable automatic container updates for the
ghost-1 photo blog service, ensuring it stays current with latest
security patches and features.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Added dawarich_db to the exclusion list to prevent automatic updates
of the database container, ensuring data integrity and preventing
potential downtime during automated container updates.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fixed manyfold deployment error by updating template to use vault_manyfold.secret_key instead of undefined manyfold_key
- Standardized template to use centralized variables for domains, network, and hairpin configuration
- Added proper OIDC configuration using vault_manyfold.oidc structure
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Configure dockcheck for automatic updates instead of check-only mode
- Add dockcheck update labels to Calibre and Changedetection services
- Enable OnlyLabel and AutoMode for targeted container management
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
phil