ByteStash matches users on issuer + sub only, so the existing user row
was remapped to the Pocket ID user before this was deployed. The old
Authentik credentials stay in the vault for rollback.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs next to Authentik. The encryption key lives in vault_pocketid, and
the .env task hides its diff so the key doesn't show up in output.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
apprise and audiobookshelf had no restart policy, and the dawarich app
and sidekiq used on-failure. Docker stops containers cleanly on a
reboot or daemon upgrade, so none of them came back on their own.
Use unless-stopped like the other services.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
micropub_server-micropub-1 no longer exists, so /micropub on
thesatelliteoflove.com only returned errors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
lava was created by hand without an ip_range, so any container could be
given Caddy's fixed IP (172.20.0.5). After a reboot the containers race
for the low addresses and Caddy often fails with "Address already in use".
- The docker role now creates lava as 172.20.0.0/16 with dynamic
addresses limited to 172.20.128.0/17, so 172.20.0.x is free for fixed
IPs, and warns if the network still has the old layout.
- Gitea gets fixed IP 172.20.0.6 once the network has the reserved range,
since its ufw-docker SSH rule points at its IP.
- ufw-docker allow rules for Caddy (80, 443) and Gitea SSH are managed by
the playbook and follow IP changes.
- migrate-lava-network.yml recreates the existing network once: it takes
down every compose project on lava (volumes kept), recreates the
network, and brings them back up, Caddy first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Quote file modes. Unquoted 644/755 were read as decimal, so files
landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
them over the docker network), bind dir2opds to the Tailscale IP, and
drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Removed references to 9 decommissioned services from CLAUDE.md,
README.md, domains.yml, services.yml, and Glance release tracking.
Added services tag and Cronmaster to docs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add mag37.dockcheck.update labels to enable automated container update monitoring for:
- Gotify iOS assistant service
- Karakeep (Hoarder) bookmark manager and all components (Chrome, Meilisearch)
- MMDL task management service
- Postiz social media scheduler and all components (PostgreSQL, Redis)
This completes the rollout of dockcheck labels across all Docker services for consistent update monitoring.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add grocy subdomain to domains.yml
- Create Docker Compose template using LinuxServer image
- Add Ansible task for service deployment
- Configure Caddy reverse proxy with Authentik auth and API bypass
- Add DNS record for grocy subdomain
- Integrate with productivity services category
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add kanboard subdomain to domains.yml
- Create Docker Compose template with SQLite backend and plugin store enabled
- Add Ansible task for service deployment
- Configure Caddy reverse proxy routing
- Integrate with productivity services category
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add Palmr Docker Compose template with encryption enabled
- Create Palmr deployment tasks for productivity category
- Add files.thesatelliteoflove.com routing in Caddyfile
- Restore files subdomain for Palmr service
- Add Palmr to Glance dashboard with file icon
- Generate and store encryption key in vault
- Configure HTTPS, Authentik integration, and dockcheck updates
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Remove Pingvin Docker Compose template and deployment tasks
- Remove files.thesatelliteoflove.com routing from Caddyfile
- Remove files subdomain from domain variables
- Stop and remove Pingvin containers from remote server
- Clean up /opt/stacks/pingvin directory
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add mag37.dockcheck.update labels to audiobookshelf, caddy, gitea services
- Fix Gotify container names in Caddyfile routing
- Add explicit container names for gotify and igotify-assistant services
- Update Authentik to version 2025.6.3
- Fix environment variable format in gotify-compose template
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Wrap Go template syntax in Jinja2 raw blocks to prevent parsing conflicts
- Fix custom-api air quality widget template rendering
- Update Glance dashboard layout with search widget and head-widgets
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add Obsidian LiveSync Docker service with CouchDB backend
- Configure service for Tailscale-only access on port 5984
- Add vault credentials for database authentication
- Create productivity category task and handler
- Enable Glance dashboard integration
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add ByteStash Docker service configuration and deployment
- Configure subdomain routing through Caddy
- Add DNS record for ByteStash subdomain
- Update development service category to include ByteStash
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Added dockcheck label to enable automatic container updates for the
ghost-1 photo blog service, ensuring it stays current with latest
security patches and features.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fixed manyfold deployment error by updating template to use vault_manyfold.secret_key instead of undefined manyfold_key
- Standardized template to use centralized variables for domains, network, and hairpin configuration
- Added proper OIDC configuration using vault_manyfold.oidc structure
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Configure dockcheck for automatic updates instead of check-only mode
- Add dockcheck update labels to Calibre and Changedetection services
- Enable OnlyLabel and AutoMode for targeted container management
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add extra_hosts entry for changedetection service to reach Gotify
- Add extra_hosts entry for sockpuppetbrowser service to reach Gotify
- Resolves internal routing issues for Gotify notifications
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add Redis service for caching and background job processing
- Add Sidekiq worker service for background tasks
- Update to tagged version 0.28.1 for stability
- Fix Redis URL format to resolve parsing errors
- Remove incorrect volume mounts and SQLite paths
- Add proper service dependencies and health checks
- Use vault variable for SECRET_KEY_BASE security
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add comprehensive push notification infrastructure with:
- Gotify server for push notifications with admin password configuration
- iGotify Assistant service for iOS notification relay via Apple Push Notifications
- Dual subdomain setup (gotify.* and gotify-assistant.*)
- Proper service dependencies and container communication via hairpinning
- Caddy reverse proxy configuration for both services
- DNS A records for both subdomains
- Added to monitoring services category
- Tested with successful notification delivery
Services accessible at:
- https://gotify.thesatelliteoflove.com (main server)
- https://gotify-assistant.thesatelliteoflove.com (iOS assistant)
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Remove all traces of the Conduit Matrix homeserver service including:
- Delete conduit-compose.yml.j2 template and conduit.yml task file
- Remove conduit from development services category
- Remove conduit Caddy reverse proxy configuration
- Remove conduit subdomain from domains.yml
- Remove conduit DNS A record from Route53
- Delete Matrix well-known files (client/server)
- Update all documentation from 25 to 24 services
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update service count from 22+ to 25 across documentation
- Add vault.yml to gitignore for security
- Add notifications configuration for AppriseAPI integration
- Add jq package to common role dependencies
- Add hairpin networking fix for AppriseAPI chat subdomain access
- Remove diun service references from monitoring category
- Update project completion status in todo.md
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update Baikal to v0.10.1 (PostgreSQL support, PHP 8.4 compatibility)
- Update Karakeep to v0.25.0 (Safari extension, PDF screenshots, bulk tag deletion)
- Update Postiz to v1.48.4 (AI image generation, drag-drop uploads, enhanced platform support)
All services tested and running successfully with no errors.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Resolves calendar creation issue where clicking save would fail with
'Cannot read properties of undefined (Reading 'toUpperCase')' error.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Updated image version from latest to v0.8.3
- Deployed and verified successful upgrade
- New features available: theme picker, authentication, to-do widget
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update remaining Docker Compose templates with centralized variables
- Fix service tag isolation to deploy individual services only
- Update all README files with variable management architecture
- Document variable hierarchy in DEPLOYMENT_LEARNINGS.md
- Add comprehensive variable usage patterns to CLAUDE.md
- Standardize domain references using {{ subdomains.* }} pattern
- Replace hardcoded network names with {{ docker.network_name }}
- Update hairpinning configuration to use variables
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
phil