Pass the Threads token (vault_starpunk.threads_access_token, Meta app
"starpunk") and username philskents. StarPunk refreshes the token daily
and keeps the current one in /data/threads_token.json.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The server now runs Debian 13.7. systemd 257's ssh generator logs a
harmless AF_VSOCK error on netcup VMs, so the common role masks it.
The plan file now records how the upgrade went and what's left.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Debian 13 drops apt-key and software-properties-common, so the old tasks
would fail after the upgrade. The key now lives in /etc/apt/keyrings
(same fingerprint, 9DC8...CD88), the repo is a deb822 file whose release
name follows the installed Debian, and the old .list file is removed.
The apt tasks get a docker_apt tag so they can be deployed on their own.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Browsers will use HTTPS for each site for a year. includeSubDomains is
left off so hosts not served by this Caddy are unaffected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
v0.1.0 (Feb 2025) has dozens of published security advisories fixed in
v3. Tested against a copy of the database first; forms load unchanged.
v3 listens on 9157, keeps uploads under packages/server, and uses Redis 8
commands, so KeyDB is replaced by redis:8-alpine. The homepage URL is now
https (v3's CORS allowlist is built from it), Caddy is the trusted proxy,
public sign-up is off, and integration credentials get their own key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
StarPunk 2.1.0 copies new notes to GoToSocial and keeps edits and
deletes in step. Token for the app "StarPunk crossposting" (scopes
write:statuses write:media) is in vault_starpunk.gotosocial_token; the
container reaches social. through Caddy (hairpin).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2.20.15 has run its migrations, so this is the supported jump to v3.
Search moves to Tantivy and is rebuilt on first start.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
v3 can only be reached from 2.20.15, so stop tracking :latest. Also set
the two settings v3 needs from us: trust Caddy as the proxy (v3's login
rate limiting), and keep rejecting duplicate documents.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
StarPunk's Gitea Actions workflow now builds and pushes the image on
vX.Y.Z tags. Pin the tag in starpunk_version (v2.0.2, the first CI build)
and always pull it, so an image built by hand on the server with the
same name can't be deployed instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Karakeep's Chrome was alpine-chrome 123 (April 2024) and it opens every
bookmarked URL; it now uses Karakeep's own Chrome image like upstream.
Meilisearch goes from 1.13.3 to 1.41.0 with a dumpless in-place upgrade.
Gotenberg for Paperless goes from 8.7 to 8.39.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sshd accepted passwords from the internet (about 12,000 failed logins a
day) and root logins with a key. Keys only now, no root, no X11 forwarding.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The gondulf DNS record is deleted (checked against public DNS), so its
removed_records entry is no longer needed. vault_gondulf was also removed
from the vault.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Jobs run inside the runner container (label docker:host), and with the
host's Docker socket mounted every workflow had root on the server. The
socket was only there for StarPunk's image build, which has never worked
(it logged in to gitea:3000, which the host daemon can't resolve).
Image builds now go to a rootless BuildKit container that shares only a
unix socket with the runner. Site builds keep their /sites mount.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
StarPunk 2.0.0 logs in with Pocket ID and issues its own Micropub tokens
(ADR-064 in the StarPunk repo), so the Gondulf IndieAuth server is no
longer used. Removes its task, templates, Caddy route, subdomain and
service entry, and moves its DNS record to removed_records.
The StarPunk template was still on v1.6.0-rc.2 with Gondulf hairpin
hosts; deploying it would have broken login. It now matches production:
v2.0.0, Pocket ID hairpin, OIDC client from vault_starpunk.pocketid and
the admin sub in starpunk_admin_sub.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Karakeep had DISABLE_SIGNUPS unset, so anyone could make an account on
bookmarks. and use the OpenAI key behind it. The server also had no
automatic updates and three security updates waiting; the common role now
installs unattended-upgrades with Debian's default security-only origins.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The READMEs, CLAUDE.md and todo.md still described Authentik, services
removed long ago (Ghost, MMDL, Postiz, Pinchflat...) and two servers. Now
they list the 24 services actually deployed (checked against docker ps),
explain that netcup and docker-01 are one machine, document Gondulf,
StarPunk, Listmonk, Gokapi and dockcheck, and use bin/deploy throughout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
--deployment-password sets the password and exits, so the detached run
plus health wait never saw a healthy container.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The 'Gokapi started' log line is not always flushed to log.txt, so the
first-run wait timed out even though the super admin had been created.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
All of Authentik's applications (including Tailscale's tailnet login)
have moved to Pocket ID, and its only recent sign-ins were those
handovers. Drops its stack, the auth. route and DNS record, the auth
subdomain variables, Gotify's leftover hairpin entries, and the dockcheck
exclude; the docs now name Pocket ID as the SSO provider.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Gokapi now keeps its config and data in /opt/stacks/gokapi instead of named
volumes. config.json is templated with Pocket ID as the OIDC provider, so a
fresh install never shows the open /setup wizard. On a new database a one-off
run with --deployment-password creates the super admin, after which only
existing users can log in.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Audiobookshelf's OIDC settings (stored in its own database) now use the
Pocket ID client in vault_audiobookshelf.pocketid instead of Authentik, so
the container needs the Pocket ID hairpin entry. The podcasts library was
deleted and its files purged, so its volume goes too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both were hand-deployed to /opt/stacks. Templates match the live setup
and keep the same stack dirs and volume names, so data stays put.
Secrets come from the vault; .env and the StarPunk compose file are now
0640 root:docker instead of the broken 1204 mode. Adds their DNS
records to dns.yml and drops the dead godulf. Caddy route (no DNS).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kavita's KOReader sync API and OPDS feed replace them, and both readers
(Kindle KOReader, Xteink X4) now point at books.thesatelliteoflove.com.
Drops their stacks, the sync. and opds. routes and DNS records, and the
htpasswd tasks that only existed for dir2opds basic auth.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kavita now serves books.thesatelliteoflove.com with Pocket ID login
(password login is off), and the temporary kavita. subdomain is gone.
Calibre-Web's stack is removed; its calibre_books and calibre_config
volumes stay on docker-01 as a fallback for now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Deploys from unpushed branches were being reverted by the next deploy
from main, and in-place vault edits could overwrite each other.
- deploy-guard.yml (imported by site.yml and dns.yml) refuses real runs
unless the checkout is clean and exactly origin/main; --check is fine.
- bin/deploy holds a lock so only one deploy runs at a time.
- bin/vault-run edits the vault under a lock with an atomic swap.
- bin/worktree starts a task in a fresh worktree from origin/main.
- CLAUDE.md explains the workflow.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The template existed but was never copied, so the live file on the
server had drifted (still carried Glance labels).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tailscale's issuer lookup didn't match the resource=acct:phil@ filter,
got redirected to GoToSocial, found no issuer and fell back to Authentik.
phil is the only account here, so serve the same record for all queries.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tailscale finds the tailnet's login provider through the OpenID issuer
link in phil@'s WebFinger record, which now points at Pocket ID. The
same record carries GoToSocial's links, since the apex is its account
domain; other fediverse discovery paths redirect to GoToSocial. All of
these returned 404 before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ENABLE_OPENID_SIGNUP let anyone with an OpenID URL register despite
DISABLE_REGISTRATION (an account was created that way on 2026-09-30).
All logins go through Pocket ID now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The OAuth2 source in Gitea's database was renamed to PocketID and pointed
at Pocket ID with 'gitea admin auth update-oauth', and the existing
user's external login was remapped to the Pocket ID user. Here the
container now resolves the Pocket ID host instead of Authentik; the
runner never needed the login host. Credentials are in vault_gitea.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop the Glance stack, its home. route and DNS record, the glance.*
labels on every container, and the Glance restart in the Warhammer
feed cron script. Update docs to match.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The first Pocket ID login linked to the existing account by email, then
GTS_OIDC_LINK_EXISTING was switched off so only that Pocket ID identity
can sign in. The Authentik credentials stay in the vault for rollback.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The first Pocket ID login linked to the existing account by email, then
email-based account linking was switched off so only that Pocket ID
identity can sign in. The client ID now comes from the vault instead of
being written in the template.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs next to Calibre-Web at a temporary kavita. subdomain until it takes
over books. Each book lives in its own folder under
/opt/stacks/kavita/books, because Kavita names a book after its folder.
The admin password is in the vault as vault_kavita.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Pocket ID was added as a second allauth provider first, so the existing
account could be connected from the Paperless profile page. With that
done, the Authentik provider is removed. Its credentials stay in the
vault for rollback.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Manyfold matches linked users on provider + uid, so the existing user's
auth_uid was remapped to the Pocket ID user before deploying.
HTTPS_ONLY is needed so Manyfold builds an https callback URL behind
Caddy. The Authentik credentials stay in the vault for rollback.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ByteStash matches users on issuer + sub only, so the existing user row
was remapped to the Pocket ID user before this was deployed. The old
Authentik credentials stay in the vault for rollback.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
