Runs next to Authentik. The encryption key lives in vault_pocketid, and
the .env task hides its diff so the key doesn't show up in output.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bcrypt uses a random salt, so hashing the basic auth password on every
run changed the Caddyfile each time and triggered the Caddy restart
handler. Reuse the deployed hash while it still matches the vault
password, and only make a new one when it doesn't (or on a fresh host).
The old awk also turned htpasswd's trailing blank line into a stray
line in the Caddyfile; the next deploy removes it once.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
lava was created by hand without an ip_range, so any container could be
given Caddy's fixed IP (172.20.0.5). After a reboot the containers race
for the low addresses and Caddy often fails with "Address already in use".
- The docker role now creates lava as 172.20.0.0/16 with dynamic
addresses limited to 172.20.128.0/17, so 172.20.0.x is free for fixed
IPs, and warns if the network still has the old layout.
- Gitea gets fixed IP 172.20.0.6 once the network has the reserved range,
since its ufw-docker SSH rule points at its IP.
- ufw-docker allow rules for Caddy (80, 443) and Gitea SSH are managed by
the playbook and follow IP changes.
- migrate-lava-network.yml recreates the existing network once: it takes
down every compose project on lava (volumes kept), recreates the
network, and brings them back up, Caddy first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Quote file modes. Unquoted 644/755 were read as decimal, so files
landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
them over the docker network), bind dir2opds to the Tailscale IP, and
drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This comprehensive update improves maintainability and removes unused services:
## Major Changes
- Remove 5 unused services (beaver, grist, stirlingpdf, tasksmd, redlib)
- Convert remaining static compose files to Jinja2 templates
- Clean up Caddyfile removing orphaned proxy configurations
- Align DNS records with active services
## Service Cleanup
- Remove habits.thesatelliteoflove.com DNS record (beaver service)
- Add missing DNS records for active services:
- post.thesatelliteoflove.com (Postiz)
- files.thesatelliteoflove.com (Pingvin Share)
- bookmarks.thesatelliteoflove.com (Hoarder)
## Template Standardization
- Convert caddy-compose.yml to template
- Convert dockge-compose.yml to template
- Convert hoarder-compose.yml to template
- All services now use consistent template-driven approach
## Documentation Updates
- Update CLAUDE.md with new service organization
- Update README.md files with category-based deployment examples
- Update todo.md with completed work summary
- Service count updated to 22+ active services
Infrastructure is now fully organized, cleaned up, and ready for future enhancements.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
philandClaude