dns.yml no longer depends on an expiring 'aws login' session. The
ansible_dns user's keys are in vault_aws_dns and can only edit the
thesatelliteoflove.com and nerder.land zones. Also adds the id record.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs next to Authentik. The encryption key lives in vault_pocketid, and
the .env task hides its diff so the key doesn't show up in output.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
apprise and audiobookshelf had no restart policy, and the dawarich app
and sidekiq used on-failure. Docker stops containers cleanly on a
reboot or daemon upgrade, so none of them came back on their own.
Use unless-stopped like the other services.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
micropub_server-micropub-1 no longer exists, so /micropub on
thesatelliteoflove.com only returned errors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bcrypt uses a random salt, so hashing the basic auth password on every
run changed the Caddyfile each time and triggered the Caddy restart
handler. Reuse the deployed hash while it still matches the vault
password, and only make a new one when it doesn't (or on a fresh host).
The old awk also turned htpasswd's trailing blank line into a stray
line in the Caddyfile; the next deploy removes it once.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
lava was created by hand without an ip_range, so any container could be
given Caddy's fixed IP (172.20.0.5). After a reboot the containers race
for the low addresses and Caddy often fails with "Address already in use".
- The docker role now creates lava as 172.20.0.0/16 with dynamic
addresses limited to 172.20.128.0/17, so 172.20.0.x is free for fixed
IPs, and warns if the network still has the old layout.
- Gitea gets fixed IP 172.20.0.6 once the network has the reserved range,
since its ufw-docker SSH rule points at its IP.
- ufw-docker allow rules for Caddy (80, 443) and Gitea SSH are managed by
the playbook and follow IP changes.
- migrate-lava-network.yml recreates the existing network once: it takes
down every compose project on lava (volumes kept), recreates the
network, and brings them back up, Caddy first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Quote file modes. Unquoted 644/755 were read as decimal, so files
landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
them over the docker network), bind dir2opds to the Tailscale IP, and
drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
