feat: add dockcheck auto-update labels to remaining services

Add mag37.dockcheck.update labels to enable automated container update monitoring for:
- Gotify iOS assistant service
- Karakeep (Hoarder) bookmark manager and all components (Chrome, Meilisearch)
- MMDL task management service
- Postiz social media scheduler and all components (PostgreSQL, Redis)

This completes the rollout of dockcheck labels across all Docker services for consistent update monitoring.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Overview
 
-This is a personal infrastructure Ansible playbook that automates deployment and management of 25 self-hosted Docker services across two domains (`thesatelliteoflove.com` and `nerder.land`). The setup uses Tailscale VPN for secure networking and Caddy for reverse proxy with automated HTTPS.
+This is a personal infrastructure Ansible playbook that automates deployment and management of 27 self-hosted Docker services across two domains (`thesatelliteoflove.com` and `nerder.land`). The setup uses Tailscale VPN for secure networking and Caddy for reverse proxy with automated HTTPS.
 
 **Important**: Always review `DEPLOYMENT_LEARNINGS.md` when working on this repository for lessons learned and troubleshooting guidance.
 
@@ -28,18 +28,18 @@ ansible-playbook dns.yml -i hosts.yml
 ### Service Management
 ```bash
 # Deploy specific services using tags (now properly isolated)
-ansible-playbook site.yml -i hosts.yml --tags caddy --vault-password-file vault_pass --extra-vars "@secrets.enc"
-ansible-playbook site.yml -i hosts.yml --tags authentik --vault-password-file vault_pass --extra-vars "@secrets.enc"
-ansible-playbook site.yml -i hosts.yml --tags mmdl --vault-password-file vault_pass --extra-vars "@secrets.enc"
-ansible-playbook site.yml -i hosts.yml --tags docker --vault-password-file vault_pass --extra-vars "@secrets.enc"  # all docker services
+ansible-playbook site.yml -i hosts.yml --tags caddy --vault-password-file vault_pass
+ansible-playbook site.yml -i hosts.yml --tags authentik --vault-password-file vault_pass
+ansible-playbook site.yml -i hosts.yml --tags mmdl --vault-password-file vault_pass
+ansible-playbook site.yml -i hosts.yml --tags docker --vault-password-file vault_pass  # all docker services
 
 # Deploy services by category (new organized structure)
-ansible-playbook site.yml -i hosts.yml --tags infrastructure --vault-password-file vault_pass --extra-vars "@secrets.enc"
-ansible-playbook site.yml -i hosts.yml --tags media,productivity --vault-password-file vault_pass --extra-vars "@secrets.enc"
-ansible-playbook site.yml -i hosts.yml --tags development,monitoring --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags infrastructure --vault-password-file vault_pass
+ansible-playbook site.yml -i hosts.yml --tags media,productivity --vault-password-file vault_pass
+ansible-playbook site.yml -i hosts.yml --tags development,monitoring --vault-password-file vault_pass
 
 # Deploy only infrastructure components
-ansible-playbook site.yml -i hosts.yml --tags common,cron --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags common,cron --vault-password-file vault_pass
 ```
 
 ## Architecture
@@ -51,7 +51,7 @@ ansible-playbook site.yml -i hosts.yml --tags common,cron --vault-password-file
 ### Role Structure
 - **bootstrap**: Initial server hardening, user creation, Tailscale VPN setup
 - **common**: Basic system configuration, UFW firewall management
-- **docker**: Comprehensive service deployment (25 containerized applications, organized by category)
+- **docker**: Comprehensive service deployment (24 containerized applications, organized by category)
 - **cron**: Scheduled task management (currently Warhammer RSS feed generation)
 
 ### Docker Role Organization (Reorganized into Logical Categories)
@@ -60,15 +60,15 @@ The docker role is now organized into logical service groups under `roles/docker
 - **infrastructure/**: Core platform components
   - Caddy (reverse proxy), Authentik (SSO), Dockge (container management)
 - **development/**: Development and collaboration tools  
-  - Gitea, Code Server, Matrix (Conduit)
+  - Gitea, Code Server, ByteStash
 - **media/**: Content creation and consumption
   - Audiobookshelf, Calibre, Ghost blog, Pinchflat, Pinry, Karakeep (formerly Hoarder), Manyfold
 - **productivity/**: Personal organization and document management
-  - Paperless-NGX, MMDL, Baikal (CalDAV/CardDAV), Syncthing, Heyform, Dawarich, Pingvin
+  - Paperless-NGX, MMDL, Baikal (CalDAV/CardDAV), Syncthing, Heyform, Dawarich, Palmr, Obsidian LiveSync
 - **communication/**: Social media and external communication
   - GoToSocial (Fediverse), Postiz (social media management)  
 - **monitoring/**: System monitoring and alerts
-  - Changedetection, Glance dashboard, AppriseAPI
+  - Changedetection, Glance dashboard, AppriseAPI, Gotify
 
 ### Variable Management
 **Critical**: This infrastructure uses a centralized variable hierarchy in `group_vars/all/`:
@@ -131,10 +131,11 @@ Common domains requiring hairpinning fixes:
 - **Dawarich**: Based on production compose file at https://github.com/Freika/dawarich/blob/master/docker/docker-compose.production.yml
 
 ## Service Memories
-- pingvin is the service that responds on files.thesatelliteoflove.com
+- palmr is the service that responds on files.thesatelliteoflove.com
 - karakeep (formerly called hoarder) is deployed with both 'hoarder' and 'karakeep' tags for backward compatibility
 - whenever i ask you what containers need updates, run dockcheck and return a list of containers needing updates
 - when i ask for the status container updates i want you to run dockcheck on the docker host https://github.com/mag37/dockcheck?ref=selfh.st
+- this is your reference for glance configuration https://github.com/glanceapp/glance/blob/main/docs/configuration.md#configuring-glance
 
 ## Variable Management Implementation Notes
 **Major Infrastructure Update**: Variable management system was implemented to replace all hardcoded values with centralized variables.

README.md

@@ -10,7 +10,7 @@ The playbook manages two main environments:
 
 ## Services Deployed
 
-The Docker role deploys and manages 25 self-hosted services organized into logical categories:
+The Docker role deploys and manages 27 self-hosted services organized into logical categories:
 
 ### Infrastructure
 - **Caddy** (Reverse proxy with automatic HTTPS)
@@ -20,7 +20,7 @@ The Docker role deploys and manages 25 self-hosted services organized into logic
 ### Development
 - **Gitea** (Git repository hosting)
 - **Code Server** (VS Code in browser)
-- **Matrix Conduit** (Communication/chat)
+- **ByteStash** (Code snippet management)
 
 ### Media
 - **Audiobookshelf** (Audiobook server)
@@ -38,7 +38,8 @@ The Docker role deploys and manages 25 self-hosted services organized into logic
 - **Syncthing** (File synchronization)
 - **HeyForm** (Form builder)
 - **Dawarich** (Location tracking)
-- **Pingvin Share** (File sharing)
+- **Palmr** (File sharing)
+- **Obsidian LiveSync** (Note synchronization)
 
 ### Communication
 - **GoToSocial** (Fediverse/Mastodon)
@@ -48,6 +49,7 @@ The Docker role deploys and manages 25 self-hosted services organized into logic
 - **Changedetection** (Website change monitoring)
 - **Glance** (Dashboard)
 - **AppriseAPI** (Notification service)
+- **Gotify** (Push notifications)
 
 ## Structure
 

dns.yml

@@ -27,6 +27,8 @@
             ip: "152.53.36.98"
           - name: "code"
             ip: "152.53.36.98"
+          - name: "snippets"
+            ip: "152.53.36.98"
           - name: cal
             ip: "152.53.36.98"
           - name: phlog
@@ -35,8 +37,6 @@
             ip: "152.53.36.98"
           - name: watcher
             ip: "152.53.36.98"
-          - name: chat
-            ip: "152.53.36.98"
           - name: models
             ip: "152.53.36.98"
           - name: tasks
@@ -47,6 +47,16 @@
             ip: "152.53.36.98"
           - name: bookmarks
             ip: "152.53.36.98"
+          - name: gotify
+            ip: "152.53.36.98"
+          - name: gotify-assistant
+            ip: "152.53.36.98"
+          - name: pdg
+            ip: "152.53.36.98"
+          - name: kanboard
+            ip: "152.53.36.98"
+          - name: grocy
+            ip: "152.53.36.98"
       - name: nerder.land
         dns_records:
           - name: "forms"

group_vars/all/domains.yml

@@ -21,7 +21,7 @@ subdomains:
   tasks: "tasks.{{ primary_domain }}"  # MMDL
   syncthing: "syncthing.{{ primary_domain }}"
   loclog: "loclog.{{ primary_domain }}"  # Dawarich
-  files: "files.{{ primary_domain }}"  # Pingvin file sharing
+  files: "files.{{ primary_domain }}"  # Palmr file sharing
   social: "social.{{ primary_domain }}"  # GoToSocial
   post: "post.{{ primary_domain }}"  # Postiz
   home: "home.{{ primary_domain }}"  # Glance
@@ -29,7 +29,11 @@ subdomains:
   appriseapi: "appriseapi.{{ primary_domain }}"
   dockge: "dockge.{{ primary_domain }}"
   code: "code.{{ primary_domain }}"  # Code Server
-  chat: "chat.{{ primary_domain }}"  # Conduit Matrix
+  bytestash: "snippets.{{ primary_domain }}"  # ByteStash code snippets
+  gotify: "gotify.{{ primary_domain }}"  # Gotify notifications
+  gotify_assistant: "gotify-assistant.{{ primary_domain }}"  # iGotify iOS assistant
+  kanboard: "kanboard.{{ primary_domain }}"  # Kanboard project management
+  grocy: "grocy.{{ primary_domain }}"  # Grocy kitchen ERP
 
 # Email domains for notifications
 email_domains:

group_vars/all/vault.yml

@@ -1,178 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-36656631633631613335386230623438383533396639633766663966636134336662376337646537
-3735623737386630386463666563633961303235653962380a623065373135363239633931363365
-64303031653865663366363536316265376362623463383133326165353436363062643232356364
-3239373332393264630a623736313132306434333936306638393831636636316439396162643636
-34356631653265373835636563643631396162396533376430323538613462616535353134383732
-31656533633365616566373837633535396636656638313964346164363435303263333766323236
-35373965376630323235666562663539326162306436353934326664353264636436663063343932
-33383334336637626436383761393232383337303663653264363333323231653166633865326566
-63383763336335663932383530303338393937613334666564626136666366656561386231653030
-62323734393162373432363834613365616431326162306338303862663865396533643637343236
-39343337636239616430396533366362623236616166346364343166393731666364633664633639
-39666262323963393562353939396631326237323061396364663834356634353762323735343130
-38393462303561373065353034613339613130383534666265626539646465666339336432376334
-36346364626363666332303064396161303737383864633933653064623064303837373037346138
-32303937346432343038626562386232373633343164643065373833613031616162343432313666
-32613935373165643636653064653630366462313462376634323664343938616635666365326431
-62343966613361656161616530356564396231616166336363373864653166303534396431313732
-33363463613834393266363562346533626435313939373165633430356134343436613662636331
-35653866333034633436336130323835303362626238343831316339636135316266336662643136
-37633231393334666661303230656336343834643539373238333931316339623338323362343935
-33313731383965373930306135623864396162346334393466363435623334643464363163633731
-65313964613732336661626465666562643966336363336338633538336535623362376164643938
-62313665343434363436363338316433643835666536663734316534663238316264616239333531
-62306336393565623233386162333933613430343835616237303837343666623033363132353361
-64316135306563313833396437396633633139333963663564643965313232643364386465363438
-66393663356663666437663164373664633039653733393361333233663430356233316238666361
-66633835623436646362373233326433366533616335396166623833626431376663376138373839
-36396162366565343861626233326637313530663666623338653236656232343037343435323439
-62383563346230393266336138373763653235343839336536636634303765346463333832323831
-36633434663035376465376433343839343534343463353436623664333435333662326661346431
-36396463623731363761373264373761383931636338386135366236393434623261613131643165
-36613366663830666234393462386530626162623862363430306361373838363336313862313034
-34323562636631373766353635666462646533313863323831333136383937353163356436313930
-65633832303431386266356566333665303838393363306534623231393035316637346130653064
-61373361333366373031646538333661383133376138393431663732353735643061303139653765
-30613733636161366465376438636237663361646138323337666463396535346339306230313135
-63633731343735663166616533623962343033396266623061373065306638613230653933626537
-32396235313134663731616564393837626666613539363531623665353432366564306661373538
-30616337323232663462616563366362616264383037356233626232353137386261626235333238
-61633935343766326637373632363236383637643064396366353137376137346334346432313439
-31326364633739363164386334376432633532643635343734306433636436386239346138376365
-61333864373961313565383533343738363537356466396464666363316166653662626430626139
-32353063636136643830343161616563663365393439323765323235373966393232623166366335
-61303331353232366237613061333863373232373763613130636462633863646137623461383339
-64356262393061616562636331636439623365663762313139376163656137393463303065383235
-63613331626538613737666234623330623462646639326139346164333365313233326539383963
-39346636653962623538643666623261396564613734626533343932643464343762366436383666
-36333230386438633435643434386566313835626432663331313231666432306363373530633562
-30346563626639353061393764346437666264333635613131356464333530633266643838623933
-33613733653264323438333363613737326439393764613238316665313764643835303565663462
-36633361653339306335383865663330616265623462613162336132633630353261313462616363
-33623261656432636232653961306535343633386466376130343264366662396162666365653231
-35343132373865656531646234333763393934333433376563356632313664656331616264313861
-61303263373364633663666133616332653665613362356238633865636361653830316462333063
-38303634373566313966633865303763666538613966323037656339373837383833326130313037
-35653666353864343734646161363061663331306262313764653864356261306465616664393339
-31353039636131643961323132643834343030326430343433393034663162303633356666386462
-66623166623135653938336532636434613431633366626637306563386434613738383937643937
-39636531646139633037386462383261663164653466383739373564633563646164643166336539
-30313162356331333538336235306163303366396262313366376531323833373430386162313962
-64313265393836343031656339393162313162303835386230313834383030653361363430663532
-37613631633232333964333636646636356532653065363639336234303761346435613831343835
-62376633643166643437626537346164326133396532393232333365316335393239333230343062
-61656534616536373164343064313061366538363961646533623265666663626439333266363466
-37336331333333366530636634323938653363643237343465653733656563346532623633636138
-38353761383562353434666438646436653033613761383466383962626134366237346530666539
-66353837613361313861353631613934376435343765396332353532326439663836333365386234
-32396339373765643731303738336330613066386362316538396136346236393630333939343939
-34663231363561333836636562666639346463666565613730613837663138333730303330653166
-61363763663631653061623333666437346463376264656338363462666130323031306636646532
-39343764303432346530666630316330666136346432396439343334333532363165666362356234
-64373936316438323230396263393739313665386663656263396335383461643030363463646434
-65353633636336623661616466303061376438663636656238343464366664393438633837393538
-61636461663930623661336432306237353239306334626430633662623034316635323936303534
-33663732613438353832316531353933303236306531393639633566643631356330646365333035
-38343933633139643965303864653263663965323465343331323666323239353666346336356134
-36623038393533646566303066383566323235396434663939393661356638623663653530366663
-65393934373537663265336139303033386631633038656564646438306362633230373930636335
-35353833643731373963313563613164383063666335636639656338316437393336323234393239
-63326361616161373966303663373537393462633264613639643262393163343363646163373961
-33306532636431633436633661333232303231653065653264323961303031316164653366353865
-33643437663532313638333661633464373732383838363439623235636261373839663533656362
-39373035393664336261643866623531343437666366313938376461646435333731326464613739
-39353335643766383162313161393339363465333464663335393830313638656633376466333236
-39376534613530336632373662366365343365343438666465343063653632333236343066353562
-39613864346634656233326261306231663436666339393762356531656164383531623032626537
-62363732343237656230383535343133343437643464663337623735326635353762313133313438
-61663339666537386365353335656237316336373732333330616435353461646637363362316637
-30343062643863663738373732393236666166336235333637393364376366663136356166333831
-35373534656430643030323638663933383766623533393832616461363536343361313336303030
-37636432373137346363626264616432373861663739303263393837643565623766313932303337
-62353230353065383930366532336336326437376339613933653137326166643532376238383330
-64356435386330613262363461623338656565666639386634613538373063323532316638623736
-63643461613833306161383237653161353537303036303238323234353934633032656631646139
-32633766623434666661366365346638313033613530336164653130646466373362646139333761
-65316337373766326262383932373965303532353133303331653965313136323364323230663566
-62323866366537343862343533373734383839326261383938313066643934626562663334643135
-36666435373138656562613335666230333534323432303932613364316666326239313230326230
-65653236353761306232346537653431306264353464633765346366336236396263363332383062
-30323035336165636236656262323231383539323166346534373532613439386466633039333338
-31626432366363306264626233306261613634343333366563623738336637643836343434306462
-30626535386230623838633430393466386561663062366439303337643536316237343738643331
-38616533653030363132356134356461366365633337646632663266333865313733376335333364
-66303135643932656265626164373264303263363534303161306366393835313663636164346133
-33383362653764303637343531626362336632613532313662303864626235626638653136366665
-65306530306462613937353631363931626261333634626665663739333562313536353938313134
-37343833653764663035313433633931303639656166636232353937346530373365376536616432
-39353933346532383730663637633964656535333034643832306365306432396463316538313731
-38323837653936323231306438383136373232663437646135326134633266613237393639613339
-31633633666361356366376635643631353938343861666531383664343236366661313530316166
-66313637626665626136613732323237396231316633666264613130613032666362313566653565
-30363333313933393835636431653931383031636138376662326437333435323035666661646666
-61636665613839346530623464326135643834313533323032643335636663623265326162323766
-37333233313962396138336665393438313937383731343739626134643230393766303662386131
-32623336303736653736353438623561613061306130383535303836643138613931373336626565
-34643533393936336262633239376135356632613061633962633762356637303032643435346263
-64356132666636636262363864303236623263343833643134656433646134356439646665323365
-65333733636330323766616539626635303364376431396531633131366333636636626339303363
-31613836363531653034346530333236313531363737356538313931316130323631376164396438
-66306563333561636133613462336331376363303431343761633265346338663836643337633137
-36383064383862636363303562353861643065613564646661633130623763303637343066373763
-35376136383438316233303936613637393230613339343932393533653661326164643430356535
-37373834646437613539343437316639663665656565633836653532346532636466616530383036
-38373035356665643863323666376337653930626663636631396662356165663734353539373464
-36393138613063326130623266356431663839636266623830306136653530623035623562613763
-31643038323332666632323433646139643766363737656262336334336538343066663438393261
-37626438386130323566356231656434326336333631643334303764343535306265633438353366
-62633363363762643331623165316265376363366639303532373236313961333462343362653565
-64313061376261356438316638653633376231363830303137316663666661663539323932396531
-30373738356330343336623731353030303434393739613531303034313136353164363962663538
-65646432346265393938656162313835326337653431326133343632633265376663303032636539
-62623932383462356134316637373832303863653733383133616138303264633165313461353139
-63326138366530363930333337333939663763633764646437616438383239313433323463393734
-63363339636536323561363062653238373133306661626235396234383138346137653161316238
-36333235663063356636363737663862323061326335383738383133386161393835393462656136
-38633635343561303634393430393738613330303535363561333739373963313930396263373535
-65396333386662663065656331643330386633643835323365363133396364646130666131666339
-63626166366662383531623830626664656239333562323166366431663661646331326432656537
-32643137666662313738373863303239336638363266623561636561333261613131383134343533
-64386362666235643734393738343036313664333539376166396132333131636538653030643136
-38646331363633383332313937323535396564303336303531316339383130653734623633626534
-62346136346533373037663632353836343332346233386634663534303133393964346139336130
-64643662613332306363643139653135323633613635303065336636636333376562366665373163
-65376338313264316464636162313337363439366165336137613235313466633638393836366265
-62333134393038653133383366626637313066393863303663303539643462633264653837393232
-30376331306662393431613135613366616537393162663266653034656661633236323566623963
-32313465333539333562363639663162393835373739366134363536393035616231376138373261
-39316366393562303566366533336563313937373864643732613266653239353335363031376362
-62623236346232333466613264303434653430636137386637303765303031666230303630323430
-37363331396163643963346637616665343366313736646437313234323132356565623730323334
-64613330656637326633306266373537613437366133393031656239316465636531623464323034
-32373237623864303437616363613063663233663864393462613433616333396431653563373338
-32663832396231313633316262343832653439653230316565663635376565393265356563356561
-37316432303839336533643761626635353935313632333065373063386635363934326431646535
-65353965363562653637646137383366636463336632376230373330333233393234656636363139
-63613633313834356236666638623764396164633466336164346139643631316234666434316663
-30626262353738313264636565626664363039356136306361626466356461656331336430643335
-61613363363837383430623765343863386331323437383235393933653237373465383066393439
-62613562356537616133613034663963626662333638353639396432656539633466303437393436
-33396330663133623961376462316630363431306436386137313238303431393734636262323335
-39386234323734313530363564303331623864616537346335633736376665636132376230386234
-35623733663362343165653330626635306330396237323861313530636465336437306262343238
-63373237303337316562633065633533383163373034373734346562363531393334336239306139
-65636362653238356439643038376362356338326235373337313930633337316565376131326231
-34313866336265666133643965383765343366643034373334343331373363663736643638313033
-35396239396537343230376466386133313365323732333063663066393331336133313035383064
-33633734633836613431636166666232663037626131313834336264636438303435633434646638
-64366463616365643864396533663061346262303631386134653465653933353437343134363361
-34626431643438633638333566306563396337336533653532633961336635623231393431306232
-32613831653762616264303939636264633931316432613138653039366331323739393431656263
-33623138383161646134633666623366366361373836666138633837393961623566356266663661
-33353437363334373135323835333163363939393765636264333039623663633632363533356537
-63303638656235653739326432363164343236343430636436626232313864396565363066656135
-38386535636231386166633635333837643630383765346333626136623362366232643065313938
-31613537386262336661633637666639626332343532653839313134656338343531383466616230
-63313036646533376639336439366539346132373939386634656235323836633630333265386165
-39623637306562626534353930633361323532636361393562353931336661373531

group_vars/docker/services.yml

@@ -3,11 +3,11 @@
 # Service categories for organization
 service_categories:
   infrastructure: ["caddy", "authentik", "dockge"]
-  development: ["gitea", "codeserver", "conduit"]
+  development: ["gitea", "codeserver"]
   media: ["audiobookshelf", "calibre", "ghost", "pinchflat", "pinry", "hoarder", "manyfold"]
   productivity: ["paperlessngx", "baikal", "syncthing", "mmdl", "heyform", "dawarich", "pingvin"]
   communication: ["gotosocial", "postiz"]
-  monitoring: ["glance", "changedetection", "appriseapi"]
+  monitoring: ["glance", "changedetection", "appriseapi", "gotify"]
 
 # Common service configuration
 services:

roles/cron/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+# Handler to restart systemd-journald service
+- name: restart rsyslog
+  systemd:
+    name: systemd-journald
+    state: restarted

roles/cron/tasks/main.yml

@@ -1,4 +1,7 @@
 ---
+# Enable cron logging in systemd-journald (already enabled by default)
+# We'll rely on journalctl for cron execution logs
+
 # Ensure the script is copied to the target machine
 - name: Copy the warhammer feed update script
   copy:
@@ -16,3 +19,97 @@
     hour: "9"
     user: root
     job: "/usr/local/bin/update_warhammer_feed.sh"
+
+# Create .local/bin directory for phil user
+- name: Ensure .local/bin directory exists for phil
+  file:
+    path: /home/phil/.local/bin
+    state: directory
+    mode: '0755'
+    owner: phil
+    group: phil
+
+# Install dockcheck script in phil's .local/bin
+- name: Download dockcheck.sh script
+  get_url:
+    url: https://raw.githubusercontent.com/mag37/dockcheck/main/dockcheck.sh
+    dest: /home/phil/.local/bin/dockcheck.sh
+    mode: '0755'
+    owner: phil
+    group: phil
+
+# Create .config directory for phil user
+- name: Ensure .config directory exists for phil
+  file:
+    path: /home/phil/.config
+    state: directory
+    mode: '0755'
+    owner: phil
+    group: phil
+
+# Create notify_templates directory alongside dockcheck.sh
+- name: Ensure notify_templates directory exists in .local/bin
+  file:
+    path: /home/phil/.local/bin/notify_templates
+    state: directory
+    mode: '0755'
+    owner: phil
+    group: phil
+
+# Download notify_v2.sh script for dockcheck notifications
+- name: Download notify_v2.sh script
+  get_url:
+    url: https://raw.githubusercontent.com/mag37/dockcheck/main/notify_templates/notify_v2.sh
+    dest: /home/phil/.local/bin/notify_templates/notify_v2.sh
+    mode: '0755'
+    owner: phil
+    group: phil
+
+# Download notify_gotify.sh script for dockcheck notifications
+- name: Download notify_gotify.sh script
+  get_url:
+    url: https://raw.githubusercontent.com/mag37/dockcheck/main/notify_templates/notify_gotify.sh
+    dest: /home/phil/.local/bin/notify_templates/notify_gotify.sh
+    mode: '0755'
+    owner: phil
+    group: phil
+
+# Template dockcheck configuration file
+- name: Template dockcheck configuration
+  template:
+    src: dockcheck.config.j2
+    dest: /home/phil/.config/dockcheck.config
+    mode: '0644'
+    owner: phil
+    group: phil
+
+# Create log directory for dockcheck
+- name: Create dockcheck log directory
+  file:
+    path: /var/log/dockcheck
+    state: directory
+    mode: '0755'
+    owner: phil
+    group: phil
+
+# Create dockcheck wrapper script to avoid cron escaping issues
+- name: Create dockcheck wrapper script
+  copy:
+    dest: /home/phil/.local/bin/run_dockcheck.sh
+    mode: '0755'
+    owner: phil
+    group: phil
+    content: |
+      #!/bin/bash
+      cd /home/phil
+      /home/phil/.local/bin/dockcheck.sh >> /var/log/dockcheck/dockcheck.log 2>&1
+      echo "$(date "+%Y-%m-%d %H:%M:%S") - Dockcheck completed with exit code $?" >> /var/log/dockcheck/dockcheck.log
+
+# Create cron job for dockcheck as phil user with logging
+- name: Create cron job for dockcheck container updates
+  cron:
+    name: "Check Docker container updates"
+    minute: "0"
+    hour: "8"
+    user: phil
+    job: "/home/phil/.local/bin/run_dockcheck.sh"

roles/cron/templates/dockcheck.config.j2

@@ -0,0 +1,18 @@
+# Dockcheck Configuration - Check only, no updates
+# Don't update, just check for updates
+# DontUpdate=true
+OnlyLabel=true
+AutoMode=true 
+
+# Enable notifications
+Notify=true
+
+# Exclude containers from checking
+Exclude="authentik-postgresql-1,dawarich_redis,dawarich_db"
+
+# Notification channels
+NOTIFY_CHANNELS="gotify"
+
+# Gotify notification configuration
+GOTIFY_DOMAIN="https://{{ subdomains.gotify }}"
+GOTIFY_TOKEN="{{ vault_dockcheck.gotify_token }}"

roles/docker/README.md

@@ -1,7 +1,7 @@
 # Docker Role
 
 ## Purpose
-Deploys and manages a comprehensive self-hosted infrastructure with 22+ containerized services organized into logical categories, transforming a server into a personal cloud platform with authentication, media management, productivity tools, and development services.
+Deploys and manages a comprehensive self-hosted infrastructure with 24 containerized services organized into logical categories, transforming a server into a personal cloud platform with authentication, media management, productivity tools, and development services.
 
 ## Architecture Overview
 
@@ -28,7 +28,7 @@ Deploys and manages a comprehensive self-hosted infrastructure with 22+ containe
 ### Development (`development/`)
 - **Gitea** - Self-hosted Git with CI/CD runners
 - **Code Server** - VS Code in the browser
-- **Conduit** - Matrix homeserver for communication
+- **ByteStash** - Code snippet management and organization
 
 ### Media (`media/`)
 - **Audiobookshelf** - Audiobook and podcast server
@@ -46,7 +46,8 @@ Deploys and manages a comprehensive self-hosted infrastructure with 22+ containe
 - **Syncthing** - Decentralized file sync
 - **Heyform** - Form builder and surveys
 - **Dawarich** - Location tracking
-- **Pingvin Share** - File sharing service
+- **Palmr** - File sharing service
+- **Obsidian LiveSync** - CouchDB backend for note synchronization
 
 ### Communication (`communication/`)
 - **GoToSocial** - Lightweight ActivityPub server
@@ -56,6 +57,7 @@ Deploys and manages a comprehensive self-hosted infrastructure with 22+ containe
 - **Glance** - Customizable dashboard with monitoring
 - **Change Detection** - Website monitoring
 - **Apprise API** - Unified notifications
+- **Gotify** - Self-hosted push notification service
 
 ## Deployment Patterns
 
@@ -92,8 +94,7 @@ roles/docker/
 │   ├── development/
 │   │   ├── main.yml               # Development category orchestrator
 │   │   ├── gitea.yml              # Git hosting
-│   │   ├── codeserver.yml         # VS Code server
-│   │   └── conduit.yml            # Matrix server
+│   │   └── codeserver.yml         # VS Code server
 │   ├── media/                     # Media services (7 services)
 │   ├── productivity/              # Productivity services (7 services)
 │   ├── communication/             # Communication services (2 services)

roles/docker/files/Caddyfile

@@ -40,6 +40,30 @@ tasks.thesatelliteoflove.com {
     reverse_proxy mmdl:3000
 }
 
+kanboard.thesatelliteoflove.com {
+    reverse_proxy kanboard:80
+}
+
+grocy.thesatelliteoflove.com {
+    # API endpoints bypass forward auth for mobile apps
+    handle /api/* {
+        reverse_proxy grocy:80
+    }
+    
+    # Web interface requires Authentik authentication
+    forward_auth authentik-server-1:9000 {
+        uri /outpost.goauthentik.io/auth/caddy
+        copy_headers {
+            X-authentik-username
+            X-authentik-groups  
+            X-authentik-email
+            X-authentik-name
+            X-authentik-uid
+        }
+    }
+    reverse_proxy grocy:80
+}
+
 phlog.thesatelliteoflove.com {
     reverse_proxy ghost-1-ghost-1:2368
 }
@@ -49,8 +73,12 @@ code.thesatelliteoflove.com {
     reverse_proxy authentik-server-1:9000
 }
 
+snippets.thesatelliteoflove.com {
+    reverse_proxy bytestash:5000
+}
+
 files.thesatelliteoflove.com {
-    reverse_proxy pingvin-pingvin-share-1:3000
+    reverse_proxy palmr-palmr-1:5487
 }
 
 git.thesatelliteoflove.com {
@@ -64,15 +92,6 @@ thesatelliteoflove.com {
     file_server
 }
 
-chat.thesatelliteoflove.com, chat.thesatelliteoflove.com:8448 {
-    handle /.well-known/* {
-        root * /srv/matrix
-        file_server
-    }
-    reverse_proxy /_matrix/* conduit-homeserver-1:6167
-}
-
-
 bookmarks.thesatelliteoflove.com {
     reverse_proxy hoarder-web-1:3000
 }
@@ -90,6 +109,25 @@ home.thesatelliteoflove.com {
     reverse_proxy authentik-server-1:9000
 }
 
+gotify.thesatelliteoflove.com {
+    reverse_proxy gotify:80
+}
+
+gotify-assistant.thesatelliteoflove.com {
+    reverse_proxy igotify-assistant:8080
+}
+
+pdg.thesatelliteoflove.com {
+    root * /srv/pdg
+    try_files {path} {path}.html {path}/ =404
+    file_server
+    encode gzip
+ 
+    handle_errors {
+        rewrite * /{err.status_code}.html
+        file_server
+    }
+}
 
 repair.nerder.land {
     root * /srv/repair

roles/docker/files/client

@@ -1,5 +0,0 @@
-{
-    "m.homeserver": {
-        "base_url": "https://chat.thesatelliteoflove.com"
-    }
-}

roles/docker/files/server

@@ -1,3 +0,0 @@
-{
-    "m.server": "chat.thesatelliteoflove.com:443"
-}

roles/docker/handlers/main.yml

@@ -11,4 +11,11 @@
     project_src: /opt/stacks/caddy
     files:
       - compose.yml
+    state: restarted
+
+- name: restart obsidian-livesync
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/obsidian-livesync
+    files:
+      - docker-compose.yml
     state: restarted

roles/docker/tasks/development/bytestash.yml

@@ -1,19 +1,19 @@
-- name: make pingvin directories
+- name: make bytestash directories
   ansible.builtin.file:
     path: "{{ item}}"
     state: directory
   loop:
-    - /opt/stacks/pingvin
+    - /opt/stacks/bytestash
 
 - name: Template out the compose file
   ansible.builtin.template:
-    src: pingvin-compose.yml.j2
-    dest: /opt/stacks/pingvin/compose.yml
+    src: bytestash-compose.yml.j2
+    dest: /opt/stacks/bytestash/compose.yml
     owner: root
     mode: 644
 
-- name: deploy pingvin stack
+- name: deploy bytestash stack
   community.docker.docker_compose_v2:
-    project_src: /opt/stacks/pingvin
+    project_src: /opt/stacks/bytestash
     files:
     - compose.yml

roles/docker/tasks/development/conduit.yml

@@ -1,29 +0,0 @@
-- name: make conduit directories
-  ansible.builtin.file:
-    path: "{{ item}}"
-    state: directory
-  loop:
-    - /opt/stacks/conduit
-
-- name: copy well-known files
-  ansible.builtin.copy:
-    src: "{{item}}"
-    dest: /opt/stacks/caddy/site/matrix/
-    owner: root
-    mode: 644
-  loop:
-    - client
-    - server
-
-- name: Template out the compose file
-  ansible.builtin.template:
-    src: conduit-compose.yml.j2
-    dest: /opt/stacks/conduit/compose.yml
-    owner: root
-    mode: 644
-
-- name: deploy conduit stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/conduit
-    files:
-    - compose.yml

roles/docker/tasks/development/main.yml

@@ -9,6 +9,7 @@
   import_tasks: codeserver.yml
   tags: codeserver
 
-- name: Install conduit
-  import_tasks: conduit.yml
-  tags: conduit
+- name: Install bytestash
+  import_tasks: bytestash.yml
+  tags: bytestash
+

roles/docker/tasks/monitoring/gotify.yml

@@ -0,0 +1,19 @@
+- name: Create gotify directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/gotify
+
+- name: Template out the gotify compose file
+  ansible.builtin.template:
+    src: gotify-compose.yml.j2
+    dest: /opt/stacks/gotify/compose.yml
+    owner: root
+    mode: 644
+
+- name: Deploy gotify stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/gotify
+    files:
+      - compose.yml

roles/docker/tasks/monitoring/main.yml

@@ -11,4 +11,8 @@
 
 - name: Install appriseapi
   import_tasks: appriseapi.yml 
-  tags: appriseapi
+  tags: appriseapi
+
+- name: Install gotify
+  import_tasks: gotify.yml
+  tags: gotify

roles/docker/tasks/productivity/grocy.yml

@@ -0,0 +1,18 @@
+---
+- name: Create grocy directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/grocy
+
+- name: Template grocy compose file
+  ansible.builtin.template:
+    src: grocy-compose.yml.j2
+    dest: /opt/stacks/grocy/compose.yml
+
+- name: Deploy grocy stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/grocy
+    files:
+      - compose.yml

roles/docker/tasks/productivity/kanboard.yml

@@ -0,0 +1,18 @@
+---
+- name: Create kanboard directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/kanboard
+
+- name: Template kanboard compose file
+  ansible.builtin.template:
+    src: kanboard-compose.yml.j2
+    dest: /opt/stacks/kanboard/compose.yml
+
+- name: Deploy kanboard stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/kanboard
+    files:
+      - compose.yml

roles/docker/tasks/productivity/main.yml

@@ -25,6 +25,18 @@
   import_tasks: dawarich.yml
   tags: dawarich
 
-- name: Install pingvin
-  import_tasks: pingvin.yml
-  tags: pingvin
+- name: Install palmr
+  import_tasks: palmr.yml
+  tags: palmr
+
+- name: Install obsidian-livesync
+  import_tasks: obsidian-livesync.yml
+  tags: obsidian-livesync
+
+- name: Install kanboard
+  import_tasks: kanboard.yml
+  tags: kanboard
+
+- name: Install grocy
+  import_tasks: grocy.yml
+  tags: grocy

roles/docker/tasks/productivity/obsidian-livesync.yml

@@ -0,0 +1,20 @@
+---
+- name: make obsidian-livesync directories
+  ansible.builtin.file:
+    path: "{{ paths.stacks }}/obsidian-livesync"
+    state: directory
+    mode: '0755'
+
+- name: Template out the compose file
+  ansible.builtin.template:
+    src: obsidian-livesync-compose.yml.j2
+    dest: "{{ paths.stacks }}/obsidian-livesync/docker-compose.yml"
+    mode: '0644'
+  notify: restart obsidian-livesync
+
+- name: deploy obsidian-livesync stack
+  community.docker.docker_compose_v2:
+    project_src: "{{ paths.stacks }}/obsidian-livesync"
+    state: present
+  tags:
+    - obsidian-livesync

roles/docker/tasks/productivity/palmr.yml

@@ -0,0 +1,19 @@
+- name: make palmr directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/palmr
+
+- name: Template out the compose file
+  ansible.builtin.template:
+    src: palmr-compose.yml.j2
+    dest: /opt/stacks/palmr/compose.yml
+    owner: root
+    mode: 644
+
+- name: deploy palmr stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/palmr
+    files:
+      - compose.yml

roles/docker/templates/appriseapi-compose.yml.j2

@@ -12,14 +12,14 @@ services:
       - attach:/attach
     image: caronc/apprise:latest
     extra_hosts:
-      - "{{ subdomains.chat }}:{{ docker.hairpin_ip }}"
+      - "{{ subdomains.gotify }}:{{ docker.hairpin_ip }}"
     labels:
       glance.name: Apprise
       glance.icon: si:imessage
       glance.url: https://{{ subdomains.appriseapi }}/
       glance.description: Apprise api server
       glance.id: apprise
-    
+      mag37.dockcheck.update: true
 volumes:
   config:
   attach:

roles/docker/templates/audiobookshelf-compose.yml.j2

@@ -16,6 +16,7 @@ services:
       glance.icon: si:audiobookshelf
       glance.url: https://{{ subdomains.audio }}/
       glance.description: Audio book server
+      mag37.dockcheck.update: true
 volumes:
   audiobooks:
     driver: local

roles/docker/templates/authentik-compose.yml.j2

@@ -37,7 +37,7 @@ services:
       glance.parent: authentik
       glance.name: Redis
   server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.1}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.4}
     restart: unless-stopped
     command: server
     environment:
@@ -64,7 +64,7 @@ services:
       glance.description: Authentication server
       glance.id: authentik
   worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.1}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.4}
     restart: unless-stopped
     command: worker
     environment:

roles/docker/templates/baikal-compose.yml.j2

@@ -10,7 +10,7 @@ services:
       glance.icon: si:protoncalendar
       glance.url: https://{{ subdomains.cal }}/
       glance.description: CalDav server
-
+      mag37.dockcheck.update: true
 volumes:
   config:
   data:

roles/docker/templates/bytestash-compose.yml.j2

@@ -0,0 +1,37 @@
+services:
+  bytestash:
+    image: ghcr.io/jordan-dalby/bytestash:latest
+    container_name: bytestash
+    restart: unless-stopped
+    volumes:
+      - bytestash_data:/data/snippets
+    environment:
+      JWT_SECRET: "{{ vault_bytestash.jwt_secret }}"
+      TOKEN_EXPIRY: "24h"
+      ALLOW_NEW_ACCOUNTS: "true"
+      DEBUG: "false"
+      DISABLE_ACCOUNTS: "false"
+      DISABLE_INTERNAL_ACCOUNTS: "false"
+      OIDC_ENABLED: "true"
+      OIDC_DISPLAY_NAME: "Login with Authentik"
+      OIDC_ISSUER_URL: "https://{{ subdomains.auth }}/application/o/bytestash/"
+      OIDC_CLIENT_ID: "{{ vault_bytestash.oidc_client_id }}"
+      OIDC_CLIENT_SECRET: "{{ vault_bytestash.oidc_client_secret }}"
+      OIDC_SCOPES: "openid profile email"
+    extra_hosts:
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
+    labels:
+      glance.name: ByteStash
+      glance.icon: si:code
+      glance.url: https://{{ subdomains.bytestash }}/
+      glance.description: Code snippet manager
+      glance.id: bytestash
+
+volumes:
+  bytestash_data:
+    driver: local
+
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}

roles/docker/templates/caddy-compose.yml.j2

@@ -18,6 +18,7 @@ services:
       glance.icon: si:caddy
       glance.url: https://{{ primary_domain }}/
       glance.description: Reverse proxy
+      mag37.dockcheck.update: true
     networks:
       default:
         ipv4_address: {{ docker.hairpin_ip }}

roles/docker/templates/calibre-compose.yml.j2

@@ -18,6 +18,7 @@ services:
       glance.icon: si:calibreweb
       glance.url: https://{{ subdomains.books }}/
       glance.description: Book server
+      mag37.dockcheck.update: true
 volumes:
   config:
     driver: local

roles/docker/templates/changedetection-compose.yml.j2

@@ -4,14 +4,13 @@ services:
       image: ghcr.io/dgtlmoon/changedetection.io
       container_name: changedetection
       hostname: changedetection
-      extra_hosts:
-        - '{{ subdomains.chat }}:172.20.0.5'
       labels:
         glance.name: Changedetection
         glance.icon: si:watchtower
         glance.url: https://{{ subdomains.watcher }}/
         glance.description: Changedetection
         glance.id: changedetection
+        mag37.dockcheck.update: true
       volumes:
         - changedetection-data:/datastore
 # Configurable proxy list support, see https://github.com/dgtlmoon/changedetection.io/wiki/Proxy-configuration#proxy-list-support
@@ -77,6 +76,8 @@ services:
   #    ports:
   #      - 5000:5000
       restart: unless-stopped
+      extra_hosts:
+        - "{{ subdomains.gotify }}:{{ docker.hairpin_ip }}"
 
      # Used for fetching pages via WebDriver+Chrome where you need Javascript support.
      # Now working on arm64 (needs testing on rPi - tested on Oracle ARM instance)
@@ -96,6 +97,7 @@ services:
         labels:
           glance.parent: changedetection
           glance.name: Browser
+          mag37.dockcheck.update: true
         image: dgtlmoon/sockpuppetbrowser:latest
         cap_add:
             - SYS_ADMIN
@@ -106,6 +108,8 @@ services:
             - SCREEN_HEIGHT=1024
             - SCREEN_DEPTH=16
             - MAX_CONCURRENT_CHROME_PROCESSES=10
+        extra_hosts:
+            - "{{ subdomains.gotify }}:{{ docker.hairpin_ip }}"
 
      # Used for fetching pages via Playwright+Chrome where you need Javascript support.
      # Note: Works well but is deprecated, does not fetch full page screenshots (doesnt work with Visual Selector)

roles/docker/templates/codeserver-compose.yml.j2

@@ -7,6 +7,7 @@ services:
       glance.icon: si:vscodium
       glance.url: https://{{ subdomains.code }}/
       glance.description: Code Server
+      mag37.dockcheck.update: true
     container_name: codeserver
     volumes:
       - home:/home

roles/docker/templates/conduit-compose.yml.j2

@@ -1,46 +0,0 @@
-services:
-    homeserver:
-        image: matrixconduit/matrix-conduit:next
-        restart: unless-stopped
-        volumes:
-            - db:/var/lib/matrix-conduit/
-        labels:
-          glance.name: Conduit
-          glance.icon: si:matrix
-          glance.url: https://{{ subdomains.chat }}/
-          glance.description: Matrix server
-        environment:
-            CONDUIT_SERVER_NAME: {{ subdomains.chat }} # EDIT THIS
-            CONDUIT_DATABASE_PATH: /var/lib/matrix-conduit/
-            CONDUIT_DATABASE_BACKEND: rocksdb
-            CONDUIT_PORT: 6167
-            CONDUIT_MAX_REQUEST_SIZE: 20000000 # in bytes, ~20 MB
-            CONDUIT_ALLOW_REGISTRATION: 'true'
-            CONDUIT_ALLOW_FEDERATION: 'true'
-            CONDUIT_ALLOW_CHECK_FOR_UPDATES: 'true'
-            CONDUIT_TRUSTED_SERVERS: '["matrix.org"]'
-            #CONDUIT_MAX_CONCURRENT_REQUESTS: 100
-            CONDUIT_ADDRESS: 0.0.0.0
-            CONDUIT_CONFIG: '' # Ignore this
-    #
-    ### Uncomment if you want to use your own Element-Web App.
-    ### Note: You need to provide a config.json for Element and you also need a second
-    ###       Domain or Subdomain for the communication between Element and Conduit
-    ### Config-Docs: https://github.com/vector-im/element-web/blob/develop/docs/config.md
-    # element-web:
-    #     image: vectorim/element-web:latest
-    #     restart: unless-stopped
-    #     ports:
-    #         - 8009:80
-    #     volumes:
-    #         - ./element_config.json:/app/config.json
-    #     depends_on:
-    #         - homeserver
-
-volumes:
-    db:
-
-networks:
-  default:
-    external: true
-    name: {{ docker.network_name }}

roles/docker/templates/dawarich-compose.yml.j2

@@ -1,4 +1,19 @@
 services:
+  dawarich_redis:
+    image: redis:7.4-alpine
+    container_name: dawarich_redis
+    labels:
+      glance.parent: dawarich
+      glance.name: Redis
+    volumes:
+      - dawarich_redis_data:/data
+    restart: always
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      retries: 5
+      start_period: 30s
+      timeout: 10s
   dawarich_db:
     image: postgis/postgis:17-3.5-alpine
     shm_size: 1G
@@ -19,8 +34,9 @@ services:
       retries: 5
       start_period: 30s
       timeout: 10s
+
   dawarich_app:
-    image: freikin/dawarich:0.27.3
+    image: freikin/dawarich:latest
     container_name: dawarich_app
     labels:
       glance.name: Dawarich
@@ -32,7 +48,6 @@ services:
       - dawarich_public:/var/app/public
       - dawarich_watched:/var/app/tmp/imports/watched
       - dawarich_storage:/var/app/storage
-      - dawarich_db_data:/dawarich_db_data
     stdin_open: true
     tty: true
     entrypoint: web-entrypoint.sh
@@ -40,13 +55,12 @@ services:
     restart: on-failure
     environment:
       RAILS_ENV: production
-      QUEUE_DATABASE_PATH: /dawarich_db_data/dawarich_production_queue.sqlite3
-      CACHE_DATABASE_PATH: /dawarich_db_data/dawarich_production_cache.sqlite3
       DATABASE_HOST: dawarich_db
       DATABASE_PORT: 5432
       DATABASE_USERNAME: postgres
       DATABASE_PASSWORD: {{ vault_dawarich.postgres_password }}
       DATABASE_NAME: dawarich_production
+      REDIS_URL: redis://dawarich_redis:6379
       MIN_MINUTES_SPENT_IN_CITY: 60
       APPLICATION_HOSTS: {{ subdomains.loclog }},localhost,::1,127.0.0.1
       TIME_ZONE: America/Denver
@@ -55,7 +69,7 @@ services:
       PROMETHEUS_EXPORTER_ENABLED: false
       PROMETHEUS_EXPORTER_HOST: 0.0.0.0
       PROMETHEUS_EXPORTER_PORT: 9394
-      SECRET_KEY_BASE: 1234567890
+      SECRET_KEY_BASE: {{ vault_dawarich.secret_key_base }}
       RAILS_LOG_TO_STDOUT: "true"
     logging:
       driver: "json-file"
@@ -72,13 +86,69 @@ services:
       dawarich_db:
         condition: service_healthy
         restart: true
+      dawarich_redis:
+        condition: service_healthy
+        restart: true
     deploy:
       resources:
         limits:
-          cpus: '0.50'    # Limit CPU usage to 50% of one core
-          memory: '2G'    # Limit memory usage to 2GB
+          cpus: '0.50'
+          memory: '2G'
+  dawarich_sidekiq:
+    image: freikin/dawarich:latest
+    container_name: dawarich_sidekiq
+    labels:
+      glance.parent: dawarich
+      glance.name: Sidekiq
+    volumes:
+      - dawarich_public:/var/app/public
+      - dawarich_watched:/var/app/tmp/imports/watched
+      - dawarich_storage:/var/app/storage
+    stdin_open: true
+    tty: true
+    entrypoint: sidekiq-entrypoint.sh
+    command: ['sidekiq']
+    restart: on-failure
+    environment:
+      RAILS_ENV: production
+      DATABASE_HOST: dawarich_db
+      DATABASE_PORT: 5432
+      DATABASE_USERNAME: postgres
+      DATABASE_PASSWORD: {{ vault_dawarich.postgres_password }}
+      DATABASE_NAME: dawarich_production
+      REDIS_URL: redis://dawarich_redis:6379
+      MIN_MINUTES_SPENT_IN_CITY: 60
+      APPLICATION_HOSTS: {{ subdomains.loclog }},localhost,::1,127.0.0.1
+      TIME_ZONE: America/Denver
+      APPLICATION_PROTOCOL: http
+      DISTANCE_UNIT: mi
+      PROMETHEUS_EXPORTER_ENABLED: false
+      SECRET_KEY_BASE: {{ vault_dawarich.secret_key_base }}
+      RAILS_LOG_TO_STDOUT: "true"
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "100m"
+        max-file: "5"
+    healthcheck:
+      test: ["CMD-SHELL", "ps aux | grep '[s]idekiq' || exit 1"]
+      interval: 10s
+      retries: 30
+      start_period: 30s
+      timeout: 10s
+    depends_on:
+      dawarich_app:
+        condition: service_healthy
+        restart: true
+      dawarich_db:
+        condition: service_healthy
+        restart: true
+      dawarich_redis:
+        condition: service_healthy
+        restart: true
 volumes:
   dawarich_db_data:
+  dawarich_redis_data:
   dawarich_public:
   dawarich_watched:
   dawarich_storage:

roles/docker/templates/ghost-1-compose.yml.j2

@@ -17,7 +17,7 @@ services:
       glance.icon: si:ghost
       glance.url: https://{{ subdomains.phlog }}/
       glance.description: Photo Blog
-
+      mag37.dockcheck.update: true
 volumes:
   ghost:
     driver: local

roles/docker/templates/gitea-compose.yml.j2

@@ -20,6 +20,7 @@ services:
       glance.url: https://{{ subdomains.git }}/
       glance.description: Code repo
       glance.id: gitea
+      mag37.dockcheck.update: true
     volumes:
       - gitea:/data
       - /etc/timezone:/etc/timezone:ro
@@ -46,6 +47,7 @@ services:
     labels:
       glance.parent: gitea
       glance.name: Worker
+      mag37.dockcheck.update: true
     volumes:
       - ./runner-config.yaml:/config.yaml
       - ./data:/data

roles/docker/templates/glance-compose.yml.j2

@@ -1,6 +1,6 @@
 services:
   glance:
-    image: glanceapp/glance:v0.8.3
+    image: glanceapp/glance:latest
     volumes:
       - ./config:/app/config
       - /etc/timezone:/etc/timezone:ro

roles/docker/templates/glance.yml.j2

@@ -1,40 +1,27 @@
 pages:
   - name: Home
+    head-widgets:
+      - type: markets
+        hide-header: true
+        markets:
+          - symbol: SPY
+            name: S&P 500
+          - symbol: VTSAX
+            name: Vanguard Total Stock Market
+          - symbol: BAI
+            name: Blackrock AI
+          - symbol: NLR
+            name: VanEck Uranium+Nuclear Energy
+          - symbol: BITO
+            name: Bitcoin ETF
+    
     columns:
-      - size: small
-        widgets:
-          - type: calendar
-
-          - type: server-stats
-            servers:
-              - type: local
-                name: Services
 
       - size: full
         widgets:
-          - type: group
-            widgets:
-            - type: hacker-news
-            - type: rss
-              limit: 10
-              collapse-after: 3
-              cache: 3h
-              feeds:
-              - url: https://kill-the-newsletter.com/feeds/ij4twrnzhrwvyic13qcm.xml
-              - url: https://mrmoneymustache.ck.page/68f9e9826c
-            - type: rss
-              title: Gear
-              limit: 10
-              collapse-after: 3
-              cache: 3h
-              feeds:
-              - url: https://9to5toys.com/steals/feed
-              - url: https://hiro.report/rss/
-          - type: change-detection
-            instance-url: https://watcher.thesatelliteoflove.com
-            token: ac69ae11570548549d6706eac6dbb6a9
-          - type: docker-containers
-            hide-by-default: false
+          - type: search
+            search-engine: kagi
+            new-tab: true
 
       - size: small
         widgets:
@@ -42,24 +29,62 @@ pages:
             location: Nederland, Colorado, United States
             units: imperial
 
-          - type: markets
-            markets:
-              - symbol: SPY
-                name: S&P 500
-              - symbol: VTSAX
-                name: Vanguard Total Stock Market
-              - symbol: BAI
-                name: Blackrock AI
-              - symbol: NLR
-                name: VanEck Uranium+Nuclear Energy
-              - symbol: BITO
-                name: Bitcoin ETF
-              - symbol: GOOGL
-                name: Google
-              - symbol: AMD
-                name: AMD
-              - symbol: DJT
-                name: Trump Media
+          - type: custom-api
+            title: Air Quality
+            cache: 10m
+            url: https://api.waqi.info/feed/geo:39.9676367;-105.4037992/?token={{ vault_glance.air_quality_key }}
+            template: |
+              {% raw %}{{ $aqi := printf "%03s" (.JSON.String "data.aqi") }}
+              {{ $aqiraw := .JSON.String "data.aqi" }}
+              {{ $updated := .JSON.String "data.time.iso" }}
+              {{ $humidity := .JSON.String "data.iaqi.h.v" }}
+              {{ $ozone := .JSON.String "data.iaqi.o3.v" }}
+              {{ $pm25 := .JSON.String "data.iaqi.pm25.v" }}
+              {{ $pressure := .JSON.String "data.iaqi.p.v" }}
+
+              <div class="flex justify-between">
+                <div class="size-h5">
+                  {{ if le $aqi "050" }}
+                    <div class="color-positive">Good air quality</div>
+                  {{ else if le $aqi "100" }}
+                    <div class="color-primary">Moderate air quality</div>
+                  {{ else }}
+                    <div class="color-negative">Bad air quality</div>
+                  {{ end }}
+                </div>
+              </div>
+
+              <div class="color-highlight size-h2">AQI: {{ $aqiraw }}</div>
+              <div style="border-bottom: 1px solid; margin-block: 10px;"></div>
+
+              <div class="margin-block-2">
+                <div style="display: grid; grid-template-columns: 1fr 1fr; gap: 10px;">
+
+                  <div>
+                    <div class="size-h3 color-highlight">{{ $humidity }}%</div>
+                    <div class="size-h6">HUMIDITY</div>
+                  </div>
+
+                  <div>
+                    <div class="size-h3 color-highlight">{{ $ozone }} μg/m³</div>
+                    <div class="size-h6">OZONE</div>
+                  </div>
+
+                  <div>
+                    <div class="size-h3 color-highlight">{{ $pm25 }} μg/m³</div>
+                    <div class="size-h6">PM2.5</div>
+                  </div>
+
+                  <div>
+                    <div class="size-h3 color-highlight">{{ $pressure }} hPa</div>
+                    <div class="size-h6">PRESSURE</div>
+                  </div>
+
+                </div>
+
+                <div class="size-h6" style="margin-top: 10px;">Last Updated at {{ slice $updated 11 16 }}</div>
+              </div>{% endraw %}
+
   - name: Mini Painting
     columns:
     - size: small

roles/docker/templates/gotify-compose.yml.j2

@@ -0,0 +1,47 @@
+services:
+  gotify:
+    image: gotify/server:latest
+    container_name: gotify
+    restart: unless-stopped
+    volumes:
+      - gotify_data:/app/data
+    environment:
+      - GOTIFY_DEFAULTUSER_PASS={{ vault_gotify.admin_password }}
+      - TZ=America/Denver
+    labels:
+      glance.name: Gotify
+      glance.icon: si:gotify
+      glance.url: "https://{{ subdomains.gotify }}/"
+      glance.description: Push notification server
+    extra_hosts:
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
+      - "{{ subdomains.gotify_assistant }}:{{ docker.hairpin_ip }}"
+
+  igotify-assistant:
+    image: ghcr.io/androidseb25/igotify-notification-assist:latest
+    restart: unless-stopped
+    container_name: igotify-assistant
+    volumes:
+      - igotify_data:/app/data
+    environment:
+      TZ: America/Denver
+    depends_on:
+      - gotify
+    labels:
+      glance.name: iGotify Assistant
+      glance.icon: si:apple
+      glance.url: "https://{{ subdomains.gotify_assistant }}/"
+      glance.description: iOS notification assistant
+      mag37.dockcheck.update: true
+    extra_hosts:
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
+      - "{{ subdomains.gotify }}:{{ docker.hairpin_ip }}"
+
+volumes:
+  gotify_data:
+  igotify_data:
+
+networks:
+  default:
+    external: true
+    name: "{{ docker.network_name }}"

roles/docker/templates/gotosocial-compose.yml.j2

@@ -44,23 +44,19 @@ services:
     labels:
       glance.parent: gotosocial
       glance.name: Backup
+      mag37.dockcheck.update: true
     environment:
-      BACKUP_FILENAME: backup-gts-%Y-%m-%dT%H-%M-%S.tar.gz
-      BACKUP_LATEST_SYMLINK: backup-latest.tar.gz
+      BACKUP_FILENAME: gts-backup-%Y-%m-%dT%H-%M-%S.tar.gz
       BACKUP_CRON_EXPRESSION: "0 9 * * *"
-      BACKUP_PRUNING_PREFIX: backup-
-      BACKUP_RETENTION_DAYS: 1
+      BACKUP_PRUNING_PREFIX: gts-
+      BACKUP_RETENTION_DAYS: 7
       AWS_S3_BUCKET_NAME: tsolbackups
       AWS_ENDPOINT: s3.us-west-004.backblazeb2.com 
       AWS_ACCESS_KEY_ID: {{ vault_backup.access_key_id }}
       AWS_SECRET_ACCESS_KEY: {{ vault_backup.secret_access_key }}
-      BACKUP_SKIP_BACKENDS_FROM_PRUNE: s3
-
-
     volumes:
-      - gotosocial:/backup/my-app-backup:ro
+      - gotosocial:/backup/gts-app-backup:ro
       - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ./backup:/archive
 
 volumes:
   gotosocial:

roles/docker/templates/grocy-compose.yml.j2

@@ -0,0 +1,30 @@
+services:
+  grocy:
+    image: lscr.io/linuxserver/grocy:latest
+    container_name: grocy
+    restart: unless-stopped
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=America/Denver
+    volumes:
+      - ./config:/config
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
+    labels:
+      glance.name: Grocy
+      glance.icon: si:grocyapp
+      glance.url: https://{{ subdomains.grocy }}/
+      glance.description: Kitchen ERP and inventory management
+      glance.id: grocy
+      mag37.dockcheck.update: true
+
+volumes:
+  grocy_config:
+    driver: local
+
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}

roles/docker/templates/hoarder-compose.yml.j2

@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   web:
-    image: ghcr.io/karakeep-app/karakeep:0.25.0
+    image: ghcr.io/karakeep-app/karakeep:latest
     restart: unless-stopped
     volumes:
       - data:/data
@@ -22,12 +22,14 @@ services:
       glance.url: https://{{ subdomains.bookmarks }}/
       glance.description: Bookmark manager
       glance.id: karakeep
+      mag37.dockcheck.update: true
   chrome:
     image: gcr.io/zenika-hub/alpine-chrome:123
     restart: unless-stopped
     labels:
       glance.name: Chrome
       glance.parent: karakeep
+      mag37.dockcheck.update: true
     command:
       - --no-sandbox
       - --disable-gpu
@@ -41,6 +43,7 @@ services:
     labels:
       glance.name: Meilisearch
       glance.parent: karakeep
+      mag37.dockcheck.update: true
     env_file:
       - .env
     environment:

roles/docker/templates/kanboard-compose.yml.j2

@@ -0,0 +1,32 @@
+services:
+  kanboard:
+    image: kanboard/kanboard:latest
+    container_name: kanboard
+    restart: unless-stopped
+    environment:
+      - PLUGIN_INSTALLER=true
+      - DB_DRIVER=sqlite
+    volumes:
+      - kanboard_data:/var/www/app/data
+      - kanboard_plugins:/var/www/app/plugins
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
+    labels:
+      glance.name: Kanboard
+      glance.icon: si:kanboard
+      glance.url: https://{{ subdomains.kanboard }}/
+      glance.description: Project management and Kanban boards
+      glance.id: kanboard
+      mag37.dockcheck.update: true
+
+volumes:
+  kanboard_data:
+    driver: local
+  kanboard_plugins:
+    driver: local
+
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}

roles/docker/templates/manyfold-compose.yml.j2

@@ -12,23 +12,24 @@ services:
       # The container path can be anything; you will need to enter it in the "new library" form.
       - ./models:/models
     environment:
-      SECRET_KEY_BASE: {{manyfold_key}}
+      SECRET_KEY_BASE: {{ vault_manyfold.secret_key }}
       MULTIUSER: enabled 
-      OIDC_CLIENT_ID: {{ manyfold_oidc_client_id }}
-      OIDC_CLIENT_SECRET: {{ manyfold_oidc_client_secret }}
-      OIDC_ISSUER: https://auth.thesatelliteoflove.com/application/o/manyfold/
+      OIDC_CLIENT_ID: {{ vault_manyfold.oidc.client_id }}
+      OIDC_CLIENT_SECRET: {{ vault_manyfold.oidc.client_secret }}
+      OIDC_ISSUER: https://{{ subdomains.auth }}/application/o/manyfold/
       OIDC_NAME: Authentik
-      PUBLIC_HOSTNAME: models.thesatelliteoflove.com
+      PUBLIC_HOSTNAME: {{ subdomains.models }}
       MAX_FILE_UPLOAD_SIZE: 5368709120
       PUID: 1000
       PGID: 1000
     extra_hosts:
-      - 'auth.thesatelliteoflove.com:172.20.0.5'
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
     labels:
       glance.name: Manyfold
       glance.icon: si:open3d
-      glance.url: https://models.thesatelliteoflove.com/
+      glance.url: https://{{ subdomains.models }}/
       glance.description: STL Storage
+      mag37.dockcheck.update: true
     restart: unless-stopped
     # Optional, but recommended for better security
     security_opt:
@@ -44,4 +45,4 @@ services:
 networks:
   default:
     external: true
-    name: lava
+    name: "{{ docker.network_name }}"

roles/docker/templates/mmdl-compose.yml.j2

@@ -17,6 +17,7 @@ services:
       glance.url: https://{{ subdomains.tasks }}/
       glance.description: Task and calendar management
       glance.id: mmdl
+      mag37.dockcheck.update: true
 
   mmdl_db:
     image: mysql:8.0
@@ -35,6 +36,7 @@ services:
     labels:
       glance.parent: mmdl
       glance.name: DB
+      mag37.dockcheck.update: true
 
 volumes:
   mmdl_db:

roles/docker/templates/obsidian-livesync-compose.yml.j2

@@ -0,0 +1,30 @@
+services:
+  obsidian-livesync:
+    image: oleduc/docker-obsidian-livesync-couchdb:latest
+    container_name: obsidian-livesync
+    restart: unless-stopped
+    labels:
+      glance.name: Obsidian LiveSync
+      glance.icon: si:obsidian
+      glance.url: http://{{ network.docker_host_ip }}:5984
+      glance.description: Obsidian note synchronization
+      glance.id: obsidian-livesync
+    environment:
+      - SERVER_DOMAIN={{ network.docker_host_ip }}
+      - COUCHDB_USER={{ vault_obsidian.username }}
+      - COUCHDB_PASSWORD={{ vault_obsidian.password }}
+      - COUCHDB_DATABASE=obsidian
+    ports:
+      - "{{ network.docker_host_ip }}:5984:5984"
+    volumes:
+      - couchdb_data:/opt/couchdb/data
+    networks:
+      - default
+
+volumes:
+  couchdb_data:
+
+networks:
+  default:
+    external: true
+    name: "{{ docker.network_name }}"

roles/docker/templates/palmr-compose.yml.j2

@@ -0,0 +1,30 @@
+services:
+  palmr:
+    image: kyantech/palmr:latest
+    restart: unless-stopped
+    environment:
+      DISABLE_FILESYSTEM_ENCRYPTION: "false"
+      ENCRYPTION_KEY: "{{ vault_palmr.encryption_key }}"
+      PALMR_UID: "1000"
+      PALMR_GID: "1000"
+      SECURE_SITE: "true"
+      DEFAULT_LANGUAGE: "en-US"
+      TRUST_PROXY: "true"
+    extra_hosts:
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
+    labels:
+      glance.name: Palmr
+      glance.icon: si:files
+      glance.url: "https://{{ subdomains.files }}/"
+      glance.description: File sharing and storage
+      glance.id: palmr
+      mag37.dockcheck.update: true
+    volumes:
+      - palmr_data:/app/server
+volumes:
+  palmr_data:
+    driver: local
+networks:
+  default:
+    external: true
+    name: "{{ docker.network_name }}"

roles/docker/templates/paperlessngx-compose.yml.j2

@@ -57,6 +57,26 @@ services:
       glance.name: Tika
     restart: unless-stopped
 
+  backup:
+    image: offen/docker-volume-backup:v2
+    restart: always
+    labels:
+      glance.parent: paperlessngx
+      glance.name: Backup
+      mag37.dockcheck.update: true
+    environment:
+      BACKUP_FILENAME: pngx-backup-%Y-%m-%dT%H-%M-%S.tar.gz
+      BACKUP_CRON_EXPRESSION: "10 9 * * *"
+      BACKUP_PRUNING_PREFIX: pngx-
+      BACKUP_RETENTION_DAYS: 7
+      AWS_S3_BUCKET_NAME: tsolbackups
+      AWS_ENDPOINT: s3.us-west-004.backblazeb2.com 
+      AWS_ACCESS_KEY_ID: {{ vault_backup.access_key_id }}
+      AWS_SECRET_ACCESS_KEY: {{ vault_backup.secret_access_key }}
+    volumes:
+      - media:/backup/pngx-app-backup:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+
 volumes:
   data:
   media:

roles/docker/templates/pingvin-compose.yml.j2

@@ -1,24 +0,0 @@
-services:
-  pingvin-share:
-    image: stonith404/pingvin-share:latest
-    restart: unless-stopped
-    environment:
-      - TRUST_PROXY=true
-    extra_hosts:
-      - '{{ subdomains.auth }}:{{ docker.hairpin_ip }}'
-    labels:
-      glance.name: Pingvin
-      glance.icon: si:files
-      glance.url: https://{{ subdomains.files }}
-      glance.description: File sharing service
-      glance.id: pingvin
-    volumes:
-      - data:/opt/app/backend/data
-      - images:/opt/app/frontend/public/img
-volumes:
-  images:
-  data:
-networks:
-  default:
-    external: true
-    name: {{ docker.network_name }}

roles/docker/templates/postiz-compose.yml.j2

@@ -1,6 +1,6 @@
 services:
   postiz:
-    image: ghcr.io/gitroomhq/postiz-app:v1.48.4
+    image: ghcr.io/gitroomhq/postiz-app:latest
     container_name: postiz
     restart: always
     environment:
@@ -38,6 +38,7 @@ services:
       glance.url: https://{{ subdomains.post }}/
       glance.description: Social media scheduler
       glance.id: postiz
+      mag37.dockcheck.update: true
  
   postiz-postgres:
     image: postgres:14.5
@@ -57,6 +58,7 @@ services:
     labels:
       glance.parent: postiz
       glance.name: DB
+      mag37.dockcheck.update: true
   postiz-redis:
     image: redis:7.2
     container_name: postiz-redis
@@ -71,6 +73,7 @@ services:
     labels:
       glance.parent: postiz
       glance.name: Redis
+      mag37.dockcheck.update: true
 
  
  

todo.md

@@ -9,11 +9,11 @@
   roles/docker/tasks/
   ├── main.yml (orchestrator)
   ├── infrastructure/ (caddy, authentik, dockge)
-  ├── development/ (gitea, codeserver, conduit)
+  ├── development/ (gitea, codeserver, bytestash)
   ├── media/ (audiobookshelf, calibre, ghost, pinchflat, pinry, hoarder, manyfold)
-  ├── productivity/ (paperless, baikal, syncthing, mmdl, heyform, dawarich, pingvin)
+  ├── productivity/ (paperless, baikal, syncthing, mmdl, heyform, dawarich, palmr, obsidian-livesync)
   ├── communication/ (gotosocial, postiz)
-  └── monitoring/ (glance, changedetection, appriseapi)
+  └── monitoring/ (glance, changedetection, appriseapi, gotify)
   ```
 - **COMPLETED**: All services organized into logical categories with category-level tags