Pocket ID was added as a second allauth provider first, so the existing
account could be connected from the Paperless profile page. With that
done, the Authentik provider is removed. Its credentials stay in the
vault for rollback.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Quote file modes. Unquoted 644/755 were read as decimal, so files
landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
them over the docker network), bind dir2opds to the Tailscale IP, and
drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Update remaining Docker Compose templates with centralized variables
- Fix service tag isolation to deploy individual services only
- Update all README files with variable management architecture
- Document variable hierarchy in DEPLOYMENT_LEARNINGS.md
- Add comprehensive variable usage patterns to CLAUDE.md
- Standardize domain references using {{ subdomains.* }} pattern
- Replace hardcoded network names with {{ docker.network_name }}
- Update hairpinning configuration to use variables
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
philandClaude