StarPunk 2.0.0 logs in with Pocket ID and issues its own Micropub tokens
(ADR-064 in the StarPunk repo), so the Gondulf IndieAuth server is no
longer used. Removes its task, templates, Caddy route, subdomain and
service entry, and moves its DNS record to removed_records.
The StarPunk template was still on v1.6.0-rc.2 with Gondulf hairpin
hosts; deploying it would have broken login. It now matches production:
v2.0.0, Pocket ID hairpin, OIDC client from vault_starpunk.pocketid and
the admin sub in starpunk_admin_sub.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
All of Authentik's applications (including Tailscale's tailnet login)
have moved to Pocket ID, and its only recent sign-ins were those
handovers. Drops its stack, the auth. route and DNS record, the auth
subdomain variables, Gotify's leftover hairpin entries, and the dockcheck
exclude; the docs now name Pocket ID as the SSO provider.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both were hand-deployed to /opt/stacks. Templates match the live setup
and keep the same stack dirs and volume names, so data stays put.
Secrets come from the vault; .env and the StarPunk compose file are now
0640 root:docker instead of the broken 1204 mode. Adds their DNS
records to dns.yml and drops the dead godulf. Caddy route (no DNS).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kavita's KOReader sync API and OPDS feed replace them, and both readers
(Kindle KOReader, Xteink X4) now point at books.thesatelliteoflove.com.
Drops their stacks, the sync. and opds. routes and DNS records, and the
htpasswd tasks that only existed for dir2opds basic auth.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kavita now serves books.thesatelliteoflove.com with Pocket ID login
(password login is off), and the temporary kavita. subdomain is gone.
Calibre-Web's stack is removed; its calibre_books and calibre_config
volumes stay on docker-01 as a fallback for now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tailscale's issuer lookup didn't match the resource=acct:phil@ filter,
got redirected to GoToSocial, found no issuer and fell back to Authentik.
phil is the only account here, so serve the same record for all queries.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tailscale finds the tailnet's login provider through the OpenID issuer
link in phil@'s WebFinger record, which now points at Pocket ID. The
same record carries GoToSocial's links, since the apex is its account
domain; other fediverse discovery paths redirect to GoToSocial. All of
these returned 404 before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop the Glance stack, its home. route and DNS record, the glance.*
labels on every container, and the Glance restart in the Warhammer
feed cron script. Update docs to match.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs next to Calibre-Web at a temporary kavita. subdomain until it takes
over books. Each book lives in its own folder under
/opt/stacks/kavita/books, because Kavita names a book after its folder.
The admin password is in the vault as vault_kavita.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs next to Authentik. The encryption key lives in vault_pocketid, and
the .env task hides its diff so the key doesn't show up in output.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
micropub_server-micropub-1 no longer exists, so /micropub on
thesatelliteoflove.com only returned errors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
