added cronmaster

- Authentik: upgrade from v2025.6.4 to v2025.8.3 for latest security fixes and features
- GoToSocial: switch from pinned v0.19.1 to latest tag for ongoing updates

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Overview
 
-This is a personal infrastructure Ansible playbook that automates deployment and management of 24 self-hosted Docker services across two domains (`thesatelliteoflove.com` and `nerder.land`). The setup uses Tailscale VPN for secure networking and Caddy for reverse proxy with automated HTTPS.
+This is a personal infrastructure Ansible playbook that automates deployment and management of 27 self-hosted Docker services across two domains (`thesatelliteoflove.com` and `nerder.land`). The setup uses Tailscale VPN for secure networking and Caddy for reverse proxy with automated HTTPS.
 
 **Important**: Always review `DEPLOYMENT_LEARNINGS.md` when working on this repository for lessons learned and troubleshooting guidance.
 
@@ -28,18 +28,18 @@ ansible-playbook dns.yml -i hosts.yml
 ### Service Management
 ```bash
 # Deploy specific services using tags (now properly isolated)
-ansible-playbook site.yml -i hosts.yml --tags caddy --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags caddy --vault-password-file vault_pass
-ansible-playbook site.yml -i hosts.yml --tags authentik --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags authentik --vault-password-file vault_pass
-ansible-playbook site.yml -i hosts.yml --tags mmdl --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags mmdl --vault-password-file vault_pass
-ansible-playbook site.yml -i hosts.yml --tags docker --vault-password-file vault_pass --extra-vars "@secrets.enc"  # all docker services
+ansible-playbook site.yml -i hosts.yml --tags docker --vault-password-file vault_pass  # all docker services
 
 # Deploy services by category (new organized structure)
-ansible-playbook site.yml -i hosts.yml --tags infrastructure --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags infrastructure --vault-password-file vault_pass
-ansible-playbook site.yml -i hosts.yml --tags media,productivity --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags media,productivity --vault-password-file vault_pass
-ansible-playbook site.yml -i hosts.yml --tags development,monitoring --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags development,monitoring --vault-password-file vault_pass
 
 # Deploy only infrastructure components
-ansible-playbook site.yml -i hosts.yml --tags common,cron --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags common,cron --vault-password-file vault_pass
 ```
 
 ## Architecture
@@ -60,15 +60,15 @@ The docker role is now organized into logical service groups under `roles/docker
 - **infrastructure/**: Core platform components
   - Caddy (reverse proxy), Authentik (SSO), Dockge (container management)
 - **development/**: Development and collaboration tools  
-  - Gitea, Code Server
+  - Gitea, Code Server, ByteStash
 - **media/**: Content creation and consumption
   - Audiobookshelf, Calibre, Ghost blog, Pinchflat, Pinry, Karakeep (formerly Hoarder), Manyfold
 - **productivity/**: Personal organization and document management
-  - Paperless-NGX, MMDL, Baikal (CalDAV/CardDAV), Syncthing, Heyform, Dawarich, Pingvin
+  - Paperless-NGX, MMDL, Baikal (CalDAV/CardDAV), Syncthing, Heyform, Dawarich, Palmr, Obsidian LiveSync
 - **communication/**: Social media and external communication
   - GoToSocial (Fediverse), Postiz (social media management)  
 - **monitoring/**: System monitoring and alerts
-  - Changedetection, Glance dashboard, AppriseAPI
+  - Changedetection, Glance dashboard, AppriseAPI, Gotify
 
 ### Variable Management
 **Critical**: This infrastructure uses a centralized variable hierarchy in `group_vars/all/`:
@@ -131,10 +131,11 @@ Common domains requiring hairpinning fixes:
 - **Dawarich**: Based on production compose file at https://github.com/Freika/dawarich/blob/master/docker/docker-compose.production.yml
 
 ## Service Memories
-- pingvin is the service that responds on files.thesatelliteoflove.com
+- palmr is the service that responds on files.thesatelliteoflove.com
 - karakeep (formerly called hoarder) is deployed with both 'hoarder' and 'karakeep' tags for backward compatibility
 - whenever i ask you what containers need updates, run dockcheck and return a list of containers needing updates
 - when i ask for the status container updates i want you to run dockcheck on the docker host https://github.com/mag37/dockcheck?ref=selfh.st
+- this is your reference for glance configuration https://github.com/glanceapp/glance/blob/main/docs/configuration.md#configuring-glance
 
 ## Variable Management Implementation Notes
 **Major Infrastructure Update**: Variable management system was implemented to replace all hardcoded values with centralized variables.

README.md

@@ -10,7 +10,7 @@ The playbook manages two main environments:
 
 ## Services Deployed
 
-The Docker role deploys and manages 24 self-hosted services organized into logical categories:
+The Docker role deploys and manages 27 self-hosted services organized into logical categories:
 
 ### Infrastructure
 - **Caddy** (Reverse proxy with automatic HTTPS)
@@ -20,6 +20,7 @@ The Docker role deploys and manages 24 self-hosted services organized into logic
 ### Development
 - **Gitea** (Git repository hosting)
 - **Code Server** (VS Code in browser)
+- **ByteStash** (Code snippet management)
 
 ### Media
 - **Audiobookshelf** (Audiobook server)
@@ -37,7 +38,8 @@ The Docker role deploys and manages 24 self-hosted services organized into logic
 - **Syncthing** (File synchronization)
 - **HeyForm** (Form builder)
 - **Dawarich** (Location tracking)
-- **Pingvin Share** (File sharing)
+- **Palmr** (File sharing)
+- **Obsidian LiveSync** (Note synchronization)
 
 ### Communication
 - **GoToSocial** (Fediverse/Mastodon)
@@ -47,6 +49,7 @@ The Docker role deploys and manages 24 self-hosted services organized into logic
 - **Changedetection** (Website change monitoring)
 - **Glance** (Dashboard)
 - **AppriseAPI** (Notification service)
+- **Gotify** (Push notifications)
 
 ## Structure
 

dns.yml

@@ -27,6 +27,8 @@
             ip: "152.53.36.98"
           - name: "code"
             ip: "152.53.36.98"
+          - name: "snippets"
+            ip: "152.53.36.98"
           - name: cal
             ip: "152.53.36.98"
           - name: phlog
@@ -49,6 +51,12 @@
             ip: "152.53.36.98"
           - name: gotify-assistant
             ip: "152.53.36.98"
+          - name: pdg
+            ip: "152.53.36.98"
+          - name: kanboard
+            ip: "152.53.36.98"
+          - name: grocy
+            ip: "152.53.36.98"
       - name: nerder.land
         dns_records:
           - name: "forms"

group_vars/all/domains.yml

@@ -21,7 +21,7 @@ subdomains:
   tasks: "tasks.{{ primary_domain }}"  # MMDL
   syncthing: "syncthing.{{ primary_domain }}"
   loclog: "loclog.{{ primary_domain }}"  # Dawarich
-  files: "files.{{ primary_domain }}"  # Pingvin file sharing
+  files: "files.{{ primary_domain }}"  # Palmr file sharing
   social: "social.{{ primary_domain }}"  # GoToSocial
   post: "post.{{ primary_domain }}"  # Postiz
   home: "home.{{ primary_domain }}"  # Glance
@@ -29,8 +29,11 @@ subdomains:
   appriseapi: "appriseapi.{{ primary_domain }}"
   dockge: "dockge.{{ primary_domain }}"
   code: "code.{{ primary_domain }}"  # Code Server
+  bytestash: "snippets.{{ primary_domain }}"  # ByteStash code snippets
   gotify: "gotify.{{ primary_domain }}"  # Gotify notifications
   gotify_assistant: "gotify-assistant.{{ primary_domain }}"  # iGotify iOS assistant
+  kanboard: "kanboard.{{ primary_domain }}"  # Kanboard project management
+  grocy: "grocy.{{ primary_domain }}"  # Grocy kitchen ERP
 
 # Email domains for notifications
 email_domains:

roles/cron/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+# Handler to restart systemd-journald service
+- name: restart rsyslog
+  systemd:
+    name: systemd-journald
+    state: restarted

roles/cron/tasks/main.yml

@@ -1,4 +1,7 @@
 ---
+# Enable cron logging in systemd-journald (already enabled by default)
+# We'll rely on journalctl for cron execution logs
+
 # Ensure the script is copied to the target machine
 - name: Copy the warhammer feed update script
   copy:
@@ -80,11 +83,33 @@
     owner: phil
     group: phil
 
-# Create cron job for dockcheck as phil user
+# Create log directory for dockcheck
+- name: Create dockcheck log directory
+  file:
+    path: /var/log/dockcheck
+    state: directory
+    mode: '0755'
+    owner: phil
+    group: phil
+
+# Create dockcheck wrapper script to avoid cron escaping issues
+- name: Create dockcheck wrapper script
+  copy:
+    dest: /home/phil/.local/bin/run_dockcheck.sh
+    mode: '0755'
+    owner: phil
+    group: phil
+    content: |
+      #!/bin/bash
+      cd /home/phil
+      /home/phil/.local/bin/dockcheck.sh >> /var/log/dockcheck/dockcheck.log 2>&1
+      echo "$(date "+%Y-%m-%d %H:%M:%S") - Dockcheck completed with exit code $?" >> /var/log/dockcheck/dockcheck.log
+
+# Create cron job for dockcheck as phil user with logging
 - name: Create cron job for dockcheck container updates
   cron:
     name: "Check Docker container updates"
     minute: "0"
     hour: "8"
     user: phil
-    job: "/home/phil/.local/bin/dockcheck.sh"
+    job: "/home/phil/.local/bin/run_dockcheck.sh"

roles/cron/templates/dockcheck.config.j2

@@ -1,12 +1,14 @@
 # Dockcheck Configuration - Check only, no updates
 # Don't update, just check for updates
-DontUpdate=true
+# DontUpdate=true
+OnlyLabel=true
+AutoMode=true 
 
 # Enable notifications
 Notify=true
 
 # Exclude containers from checking
-Exclude="authentik-postgresql-1,dawarich_redis"
+Exclude="authentik-postgresql-1,dawarich_redis,dawarich_db"
 
 # Notification channels
 NOTIFY_CHANNELS="gotify"

roles/docker/README.md

@@ -28,6 +28,7 @@ Deploys and manages a comprehensive self-hosted infrastructure with 24 container
 ### Development (`development/`)
 - **Gitea** - Self-hosted Git with CI/CD runners
 - **Code Server** - VS Code in the browser
+- **ByteStash** - Code snippet management and organization
 
 ### Media (`media/`)
 - **Audiobookshelf** - Audiobook and podcast server
@@ -45,7 +46,8 @@ Deploys and manages a comprehensive self-hosted infrastructure with 24 container
 - **Syncthing** - Decentralized file sync
 - **Heyform** - Form builder and surveys
 - **Dawarich** - Location tracking
-- **Pingvin Share** - File sharing service
+- **Palmr** - File sharing service
+- **Obsidian LiveSync** - CouchDB backend for note synchronization
 
 ### Communication (`communication/`)
 - **GoToSocial** - Lightweight ActivityPub server
@@ -55,6 +57,7 @@ Deploys and manages a comprehensive self-hosted infrastructure with 24 container
 - **Glance** - Customizable dashboard with monitoring
 - **Change Detection** - Website monitoring
 - **Apprise API** - Unified notifications
+- **Gotify** - Self-hosted push notification service
 
 ## Deployment Patterns
 

roles/docker/files/Caddyfile

@@ -40,6 +40,30 @@ tasks.thesatelliteoflove.com {
     reverse_proxy mmdl:3000
 }
 
+kanboard.thesatelliteoflove.com {
+    reverse_proxy kanboard:80
+}
+
+grocy.thesatelliteoflove.com {
+    # API endpoints bypass forward auth for mobile apps
+    handle /api/* {
+        reverse_proxy grocy:80
+    }
+    
+    # Web interface requires Authentik authentication
+    forward_auth authentik-server-1:9000 {
+        uri /outpost.goauthentik.io/auth/caddy
+        copy_headers {
+            X-authentik-username
+            X-authentik-groups  
+            X-authentik-email
+            X-authentik-name
+            X-authentik-uid
+        }
+    }
+    reverse_proxy grocy:80
+}
+
 phlog.thesatelliteoflove.com {
     reverse_proxy ghost-1-ghost-1:2368
 }
@@ -49,8 +73,12 @@ code.thesatelliteoflove.com {
     reverse_proxy authentik-server-1:9000
 }
 
+snippets.thesatelliteoflove.com {
+    reverse_proxy bytestash:5000
+}
+
 files.thesatelliteoflove.com {
-    reverse_proxy pingvin-pingvin-share-1:3000
+    reverse_proxy palmr-palmr-1:5487
 }
 
 git.thesatelliteoflove.com {
@@ -64,8 +92,6 @@ thesatelliteoflove.com {
     file_server
 }
 
-
-
 bookmarks.thesatelliteoflove.com {
     reverse_proxy hoarder-web-1:3000
 }
@@ -84,13 +110,24 @@ home.thesatelliteoflove.com {
 }
 
 gotify.thesatelliteoflove.com {
-    reverse_proxy gotify-gotify-1:80
+    reverse_proxy gotify:80
 }
 
 gotify-assistant.thesatelliteoflove.com {
-    reverse_proxy gotify-igotify-assistant-1:8080
+    reverse_proxy igotify-assistant:8080
 }
 
+pdg.thesatelliteoflove.com {
+    root * /srv/pdg
+    try_files {path} {path}.html {path}/ =404
+    file_server
+    encode gzip
+ 
+    handle_errors {
+        rewrite * /{err.status_code}.html
+        file_server
+    }
+}
 
 repair.nerder.land {
     root * /srv/repair

roles/docker/handlers/main.yml

@@ -12,3 +12,10 @@
     files:
       - compose.yml
     state: restarted
+
+- name: restart obsidian-livesync
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/obsidian-livesync
+    files:
+      - docker-compose.yml
+    state: restarted

roles/docker/tasks/development/bytestash.yml

@@ -1,19 +1,19 @@
-- name: make pingvin directories
+- name: make bytestash directories
   ansible.builtin.file:
     path: "{{ item}}"
     state: directory
   loop:
-    - /opt/stacks/pingvin
+    - /opt/stacks/bytestash
 
 - name: Template out the compose file
   ansible.builtin.template:
-    src: pingvin-compose.yml.j2
+    src: bytestash-compose.yml.j2
-    dest: /opt/stacks/pingvin/compose.yml
+    dest: /opt/stacks/bytestash/compose.yml
     owner: root
     mode: 644
 
-- name: deploy pingvin stack
+- name: deploy bytestash stack
   community.docker.docker_compose_v2:
-    project_src: /opt/stacks/pingvin
+    project_src: /opt/stacks/bytestash
     files:
     - compose.yml

roles/docker/tasks/development/main.yml

@@ -9,3 +9,7 @@
   import_tasks: codeserver.yml
   tags: codeserver
 
+- name: Install bytestash
+  import_tasks: bytestash.yml
+  tags: bytestash
+

roles/docker/tasks/monitoring/cronmaster.yml

@@ -0,0 +1,22 @@
+- name: make cronmaster directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/cronmaster
+    - /opt/stacks/cronmaster/scripts
+    - /opt/stacks/cronmaster/data
+    - /opt/stacks/cronmaster/snippets
+
+- name: Template out the compose file
+  ansible.builtin.template:
+    src: cronmaster-compose.yml.j2
+    dest: /opt/stacks/cronmaster/compose.yml
+    owner: root
+    mode: '0644'
+
+- name: deploy cronmaster stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/cronmaster
+    files:
+      - compose.yml

roles/docker/tasks/monitoring/main.yml

@@ -16,3 +16,7 @@
 - name: Install gotify
   import_tasks: gotify.yml
   tags: gotify
+
+- name: Install cronmaster
+  import_tasks: cronmaster.yml
+  tags: cronmaster

roles/docker/tasks/productivity/grocy.yml

@@ -0,0 +1,18 @@
+---
+- name: Create grocy directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/grocy
+
+- name: Template grocy compose file
+  ansible.builtin.template:
+    src: grocy-compose.yml.j2
+    dest: /opt/stacks/grocy/compose.yml
+
+- name: Deploy grocy stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/grocy
+    files:
+      - compose.yml

roles/docker/tasks/productivity/kanboard.yml

@@ -0,0 +1,18 @@
+---
+- name: Create kanboard directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/kanboard
+
+- name: Template kanboard compose file
+  ansible.builtin.template:
+    src: kanboard-compose.yml.j2
+    dest: /opt/stacks/kanboard/compose.yml
+
+- name: Deploy kanboard stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/kanboard
+    files:
+      - compose.yml

roles/docker/tasks/productivity/main.yml

@@ -25,6 +25,18 @@
   import_tasks: dawarich.yml
   tags: dawarich
 
-- name: Install pingvin
+- name: Install palmr
-  import_tasks: pingvin.yml
+  import_tasks: palmr.yml
-  tags: pingvin
+  tags: palmr
+
+- name: Install obsidian-livesync
+  import_tasks: obsidian-livesync.yml
+  tags: obsidian-livesync
+
+- name: Install kanboard
+  import_tasks: kanboard.yml
+  tags: kanboard
+
+- name: Install grocy
+  import_tasks: grocy.yml
+  tags: grocy

roles/docker/tasks/productivity/obsidian-livesync.yml

@@ -0,0 +1,20 @@
+---
+- name: make obsidian-livesync directories
+  ansible.builtin.file:
+    path: "{{ paths.stacks }}/obsidian-livesync"
+    state: directory
+    mode: '0755'
+
+- name: Template out the compose file
+  ansible.builtin.template:
+    src: obsidian-livesync-compose.yml.j2
+    dest: "{{ paths.stacks }}/obsidian-livesync/docker-compose.yml"
+    mode: '0644'
+  notify: restart obsidian-livesync
+
+- name: deploy obsidian-livesync stack
+  community.docker.docker_compose_v2:
+    project_src: "{{ paths.stacks }}/obsidian-livesync"
+    state: present
+  tags:
+    - obsidian-livesync

roles/docker/tasks/productivity/palmr.yml

@@ -0,0 +1,19 @@
+- name: make palmr directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/palmr
+
+- name: Template out the compose file
+  ansible.builtin.template:
+    src: palmr-compose.yml.j2
+    dest: /opt/stacks/palmr/compose.yml
+    owner: root
+    mode: 644
+
+- name: deploy palmr stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/palmr
+    files:
+      - compose.yml

roles/docker/templates/appriseapi-compose.yml.j2

@@ -12,14 +12,14 @@ services:
       - attach:/attach
     image: caronc/apprise:latest
     extra_hosts:
-      - "{{ subdomains.chat }}:{{ docker.hairpin_ip }}"
+      - "{{ subdomains.gotify }}:{{ docker.hairpin_ip }}"
     labels:
       glance.name: Apprise
       glance.icon: si:imessage
       glance.url: https://{{ subdomains.appriseapi }}/
       glance.description: Apprise api server
       glance.id: apprise
-    
+      mag37.dockcheck.update: true
 volumes:
   config:
   attach:

roles/docker/templates/audiobookshelf-compose.yml.j2

@@ -16,6 +16,7 @@ services:
       glance.icon: si:audiobookshelf
       glance.url: https://{{ subdomains.audio }}/
       glance.description: Audio book server
+      mag37.dockcheck.update: true
 volumes:
   audiobooks:
     driver: local

roles/docker/templates/authentik-compose.yml.j2

@@ -37,7 +37,7 @@ services:
       glance.parent: authentik
       glance.name: Redis
   server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.2}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.8.3}
     restart: unless-stopped
     command: server
     environment:
@@ -64,7 +64,7 @@ services:
       glance.description: Authentication server
       glance.id: authentik
   worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.2}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.8.3}
     restart: unless-stopped
     command: worker
     environment:

roles/docker/templates/baikal-compose.yml.j2

@@ -10,7 +10,7 @@ services:
       glance.icon: si:protoncalendar
       glance.url: https://{{ subdomains.cal }}/
       glance.description: CalDav server
-
+      mag37.dockcheck.update: true
 volumes:
   config:
   data:

roles/docker/templates/bytestash-compose.yml.j2

@@ -0,0 +1,37 @@
+services:
+  bytestash:
+    image: ghcr.io/jordan-dalby/bytestash:latest
+    container_name: bytestash
+    restart: unless-stopped
+    volumes:
+      - bytestash_data:/data/snippets
+    environment:
+      JWT_SECRET: "{{ vault_bytestash.jwt_secret }}"
+      TOKEN_EXPIRY: "24h"
+      ALLOW_NEW_ACCOUNTS: "true"
+      DEBUG: "false"
+      DISABLE_ACCOUNTS: "false"
+      DISABLE_INTERNAL_ACCOUNTS: "false"
+      OIDC_ENABLED: "true"
+      OIDC_DISPLAY_NAME: "Login with Authentik"
+      OIDC_ISSUER_URL: "https://{{ subdomains.auth }}/application/o/bytestash/"
+      OIDC_CLIENT_ID: "{{ vault_bytestash.oidc_client_id }}"
+      OIDC_CLIENT_SECRET: "{{ vault_bytestash.oidc_client_secret }}"
+      OIDC_SCOPES: "openid profile email"
+    extra_hosts:
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
+    labels:
+      glance.name: ByteStash
+      glance.icon: si:code
+      glance.url: https://{{ subdomains.bytestash }}/
+      glance.description: Code snippet manager
+      glance.id: bytestash
+
+volumes:
+  bytestash_data:
+    driver: local
+
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}

roles/docker/templates/caddy-compose.yml.j2

@@ -18,6 +18,7 @@ services:
       glance.icon: si:caddy
       glance.url: https://{{ primary_domain }}/
       glance.description: Reverse proxy
+      mag37.dockcheck.update: true
     networks:
       default:
         ipv4_address: {{ docker.hairpin_ip }}

roles/docker/templates/calibre-compose.yml.j2

@@ -18,6 +18,7 @@ services:
       glance.icon: si:calibreweb
       glance.url: https://{{ subdomains.books }}/
       glance.description: Book server
+      mag37.dockcheck.update: true
 volumes:
   config:
     driver: local

roles/docker/templates/changedetection-compose.yml.j2

@@ -10,6 +10,7 @@ services:
         glance.url: https://{{ subdomains.watcher }}/
         glance.description: Changedetection
         glance.id: changedetection
+        mag37.dockcheck.update: true
       volumes:
         - changedetection-data:/datastore
 # Configurable proxy list support, see https://github.com/dgtlmoon/changedetection.io/wiki/Proxy-configuration#proxy-list-support
@@ -96,6 +97,7 @@ services:
         labels:
           glance.parent: changedetection
           glance.name: Browser
+          mag37.dockcheck.update: true
         image: dgtlmoon/sockpuppetbrowser:latest
         cap_add:
             - SYS_ADMIN

roles/docker/templates/codeserver-compose.yml.j2

@@ -7,6 +7,7 @@ services:
       glance.icon: si:vscodium
       glance.url: https://{{ subdomains.code }}/
       glance.description: Code Server
+      mag37.dockcheck.update: true
     container_name: codeserver
     volumes:
       - home:/home

roles/docker/templates/cronmaster-compose.yml.j2

@@ -0,0 +1,32 @@
+services:
+  cronmaster:
+    image: ghcr.io/fccview/cronmaster:latest
+    container_name: cronmaster
+    restart: unless-stopped
+    user: "root"
+    privileged: true
+    pid: "host"
+    ports:
+      - "{{ network.docker_host_ip }}:40123:3000"
+    environment:
+      - DOCKER=true
+      - HOST_PROJECT_DIR=/opt/stacks/cronmaster/scripts
+      - HOST_CRONTAB_USER=root,phil
+      - AUTH_PASSWORD={{ vault_cronmaster.password }}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /opt/stacks/cronmaster/scripts:/app/scripts
+      - /opt/stacks/cronmaster/data:/app/data
+      - /opt/stacks/cronmaster/snippets:/app/snippets
+    labels:
+      glance.url: "http://{{ network.docker_host_ip }}:40123/"
+      glance.title: CronMaster
+      glance.description: Cron job management interface
+      glance.group: Infrastructure
+      glance.parent: infrastructure
+      glance.name: CronMaster
+
+networks:
+  default:
+    external: true
+    name: "{{ docker.network_name }}"

roles/docker/templates/dawarich-compose.yml.j2

@@ -36,7 +36,7 @@ services:
       timeout: 10s
 
   dawarich_app:
-    image: freikin/dawarich:0.28.1
+    image: freikin/dawarich:latest
     container_name: dawarich_app
     labels:
       glance.name: Dawarich
@@ -95,7 +95,7 @@ services:
           cpus: '0.50'
           memory: '2G'
   dawarich_sidekiq:
-    image: freikin/dawarich:0.28.1
+    image: freikin/dawarich:latest
     container_name: dawarich_sidekiq
     labels:
       glance.parent: dawarich

roles/docker/templates/ghost-1-compose.yml.j2

@@ -17,7 +17,7 @@ services:
       glance.icon: si:ghost
       glance.url: https://{{ subdomains.phlog }}/
       glance.description: Photo Blog
-
+      mag37.dockcheck.update: true
 volumes:
   ghost:
     driver: local

roles/docker/templates/gitea-compose.yml.j2

@@ -20,6 +20,7 @@ services:
       glance.url: https://{{ subdomains.git }}/
       glance.description: Code repo
       glance.id: gitea
+      mag37.dockcheck.update: true
     volumes:
       - gitea:/data
       - /etc/timezone:/etc/timezone:ro
@@ -46,6 +47,7 @@ services:
     labels:
       glance.parent: gitea
       glance.name: Worker
+      mag37.dockcheck.update: true
     volumes:
       - ./runner-config.yaml:/config.yaml
       - ./data:/data

roles/docker/templates/glance.yml.j2

@@ -1,48 +1,8 @@
 pages:
   - name: Home
-    columns:
+    head-widgets:
-      - size: small
-        widgets:
-          - type: calendar
-
-          - type: server-stats
-            servers:
-              - type: local
-                name: Services
-
-      - size: full
-        widgets:
-          - type: group
-            widgets:
-            - type: hacker-news
-            - type: rss
-              limit: 10
-              collapse-after: 3
-              cache: 3h
-              feeds:
-              - url: https://kill-the-newsletter.com/feeds/ij4twrnzhrwvyic13qcm.xml
-              - url: https://mrmoneymustache.ck.page/68f9e9826c
-            - type: rss
-              title: Gear
-              limit: 10
-              collapse-after: 3
-              cache: 3h
-              feeds:
-              - url: https://9to5toys.com/steals/feed
-              - url: https://hiro.report/rss/
-          - type: change-detection
-            instance-url: https://watcher.thesatelliteoflove.com
-            token: ac69ae11570548549d6706eac6dbb6a9
-          - type: docker-containers
-            hide-by-default: false
-
-      - size: small
-        widgets:
-          - type: weather
-            location: Nederland, Colorado, United States
-            units: imperial
-
       - type: markets
+        hide-header: true
         markets:
           - symbol: SPY
             name: S&P 500
@@ -54,12 +14,77 @@ pages:
             name: VanEck Uranium+Nuclear Energy
           - symbol: BITO
             name: Bitcoin ETF
-              - symbol: GOOGL
+    
-                name: Google
+    columns:
-              - symbol: AMD
+
-                name: AMD
+      - size: full
-              - symbol: DJT
+        widgets:
-                name: Trump Media
+          - type: search
+            search-engine: kagi
+            new-tab: true
+
+      - size: small
+        widgets:
+          - type: weather
+            location: Nederland, Colorado, United States
+            units: imperial
+
+          - type: custom-api
+            title: Air Quality
+            cache: 10m
+            url: https://api.waqi.info/feed/geo:39.9676367;-105.4037992/?token={{ vault_glance.air_quality_key }}
+            template: |
+              {% raw %}{{ $aqi := printf "%03s" (.JSON.String "data.aqi") }}
+              {{ $aqiraw := .JSON.String "data.aqi" }}
+              {{ $updated := .JSON.String "data.time.iso" }}
+              {{ $humidity := .JSON.String "data.iaqi.h.v" }}
+              {{ $ozone := .JSON.String "data.iaqi.o3.v" }}
+              {{ $pm25 := .JSON.String "data.iaqi.pm25.v" }}
+              {{ $pressure := .JSON.String "data.iaqi.p.v" }}
+
+              <div class="flex justify-between">
+                <div class="size-h5">
+                  {{ if le $aqi "050" }}
+                    <div class="color-positive">Good air quality</div>
+                  {{ else if le $aqi "100" }}
+                    <div class="color-primary">Moderate air quality</div>
+                  {{ else }}
+                    <div class="color-negative">Bad air quality</div>
+                  {{ end }}
+                </div>
+              </div>
+
+              <div class="color-highlight size-h2">AQI: {{ $aqiraw }}</div>
+              <div style="border-bottom: 1px solid; margin-block: 10px;"></div>
+
+              <div class="margin-block-2">
+                <div style="display: grid; grid-template-columns: 1fr 1fr; gap: 10px;">
+
+                  <div>
+                    <div class="size-h3 color-highlight">{{ $humidity }}%</div>
+                    <div class="size-h6">HUMIDITY</div>
+                  </div>
+
+                  <div>
+                    <div class="size-h3 color-highlight">{{ $ozone }} μg/m³</div>
+                    <div class="size-h6">OZONE</div>
+                  </div>
+
+                  <div>
+                    <div class="size-h3 color-highlight">{{ $pm25 }} μg/m³</div>
+                    <div class="size-h6">PM2.5</div>
+                  </div>
+
+                  <div>
+                    <div class="size-h3 color-highlight">{{ $pressure }} hPa</div>
+                    <div class="size-h6">PRESSURE</div>
+                  </div>
+
+                </div>
+
+                <div class="size-h6" style="margin-top: 10px;">Last Updated at {{ slice $updated 11 16 }}</div>
+              </div>{% endraw %}
+
   - name: Mini Painting
     columns:
     - size: small

roles/docker/templates/gotify-compose.yml.j2

@@ -1,6 +1,7 @@
 services:
   gotify:
     image: gotify/server:latest
+    container_name: gotify
     restart: unless-stopped
     volumes:
       - gotify_data:/app/data
@@ -19,10 +20,11 @@ services:
   igotify-assistant:
     image: ghcr.io/androidseb25/igotify-notification-assist:latest
     restart: unless-stopped
+    container_name: igotify-assistant
     volumes:
       - igotify_data:/app/data
     environment:
-      - TZ=America/Denver
+      TZ: America/Denver
     depends_on:
       - gotify
     labels:
@@ -30,6 +32,7 @@ services:
       glance.icon: si:apple
       glance.url: "https://{{ subdomains.gotify_assistant }}/"
       glance.description: iOS notification assistant
+      mag37.dockcheck.update: true
     extra_hosts:
       - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
       - "{{ subdomains.gotify }}:{{ docker.hairpin_ip }}"

roles/docker/templates/gotosocial-compose.yml.j2

@@ -1,6 +1,6 @@
 services:
   gotosocial:
-    image: docker.io/superseriousbusiness/gotosocial:0.19.1
+    image: docker.io/superseriousbusiness/gotosocial:latest
     container_name: gotosocial
     user: 1000:1000
     extra_hosts:
@@ -44,23 +44,19 @@ services:
     labels:
       glance.parent: gotosocial
       glance.name: Backup
+      mag37.dockcheck.update: true
     environment:
-      BACKUP_FILENAME: backup-gts-%Y-%m-%dT%H-%M-%S.tar.gz
+      BACKUP_FILENAME: gts-backup-%Y-%m-%dT%H-%M-%S.tar.gz
-      BACKUP_LATEST_SYMLINK: backup-latest.tar.gz
       BACKUP_CRON_EXPRESSION: "0 9 * * *"
-      BACKUP_PRUNING_PREFIX: backup-
+      BACKUP_PRUNING_PREFIX: gts-
-      BACKUP_RETENTION_DAYS: 1
+      BACKUP_RETENTION_DAYS: 7
       AWS_S3_BUCKET_NAME: tsolbackups
       AWS_ENDPOINT: s3.us-west-004.backblazeb2.com 
       AWS_ACCESS_KEY_ID: {{ vault_backup.access_key_id }}
       AWS_SECRET_ACCESS_KEY: {{ vault_backup.secret_access_key }}
-      BACKUP_SKIP_BACKENDS_FROM_PRUNE: s3
-
-
     volumes:
-      - gotosocial:/backup/my-app-backup:ro
+      - gotosocial:/backup/gts-app-backup:ro
       - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ./backup:/archive
 
 volumes:
   gotosocial:

roles/docker/templates/grocy-compose.yml.j2

@@ -0,0 +1,30 @@
+services:
+  grocy:
+    image: lscr.io/linuxserver/grocy:latest
+    container_name: grocy
+    restart: unless-stopped
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=America/Denver
+    volumes:
+      - ./config:/config
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
+    labels:
+      glance.name: Grocy
+      glance.icon: si:grocyapp
+      glance.url: https://{{ subdomains.grocy }}/
+      glance.description: Kitchen ERP and inventory management
+      glance.id: grocy
+      mag37.dockcheck.update: true
+
+volumes:
+  grocy_config:
+    driver: local
+
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}

roles/docker/templates/hoarder-compose.yml.j2

@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   web:
-    image: ghcr.io/karakeep-app/karakeep:0.25.0
+    image: ghcr.io/karakeep-app/karakeep:latest
     restart: unless-stopped
     volumes:
       - data:/data
@@ -22,12 +22,14 @@ services:
       glance.url: https://{{ subdomains.bookmarks }}/
       glance.description: Bookmark manager
       glance.id: karakeep
+      mag37.dockcheck.update: true
   chrome:
     image: gcr.io/zenika-hub/alpine-chrome:123
     restart: unless-stopped
     labels:
       glance.name: Chrome
       glance.parent: karakeep
+      mag37.dockcheck.update: true
     command:
       - --no-sandbox
       - --disable-gpu
@@ -41,6 +43,7 @@ services:
     labels:
       glance.name: Meilisearch
       glance.parent: karakeep
+      mag37.dockcheck.update: true
     env_file:
       - .env
     environment:

roles/docker/templates/kanboard-compose.yml.j2

@@ -0,0 +1,32 @@
+services:
+  kanboard:
+    image: kanboard/kanboard:latest
+    container_name: kanboard
+    restart: unless-stopped
+    environment:
+      - PLUGIN_INSTALLER=true
+      - DB_DRIVER=sqlite
+    volumes:
+      - kanboard_data:/var/www/app/data
+      - kanboard_plugins:/var/www/app/plugins
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
+    labels:
+      glance.name: Kanboard
+      glance.icon: si:kanboard
+      glance.url: https://{{ subdomains.kanboard }}/
+      glance.description: Project management and Kanban boards
+      glance.id: kanboard
+      mag37.dockcheck.update: true
+
+volumes:
+  kanboard_data:
+    driver: local
+  kanboard_plugins:
+    driver: local
+
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}

roles/docker/templates/manyfold-compose.yml.j2

@@ -12,23 +12,24 @@ services:
       # The container path can be anything; you will need to enter it in the "new library" form.
       - ./models:/models
     environment:
-      SECRET_KEY_BASE: {{manyfold_key}}
+      SECRET_KEY_BASE: {{ vault_manyfold.secret_key }}
       MULTIUSER: enabled 
-      OIDC_CLIENT_ID: {{ manyfold_oidc_client_id }}
+      OIDC_CLIENT_ID: {{ vault_manyfold.oidc.client_id }}
-      OIDC_CLIENT_SECRET: {{ manyfold_oidc_client_secret }}
+      OIDC_CLIENT_SECRET: {{ vault_manyfold.oidc.client_secret }}
-      OIDC_ISSUER: https://auth.thesatelliteoflove.com/application/o/manyfold/
+      OIDC_ISSUER: https://{{ subdomains.auth }}/application/o/manyfold/
       OIDC_NAME: Authentik
-      PUBLIC_HOSTNAME: models.thesatelliteoflove.com
+      PUBLIC_HOSTNAME: {{ subdomains.models }}
       MAX_FILE_UPLOAD_SIZE: 5368709120
       PUID: 1000
       PGID: 1000
     extra_hosts:
-      - 'auth.thesatelliteoflove.com:172.20.0.5'
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
     labels:
       glance.name: Manyfold
       glance.icon: si:open3d
-      glance.url: https://models.thesatelliteoflove.com/
+      glance.url: https://{{ subdomains.models }}/
       glance.description: STL Storage
+      mag37.dockcheck.update: true
     restart: unless-stopped
     # Optional, but recommended for better security
     security_opt:
@@ -44,4 +45,4 @@ services:
 networks:
   default:
     external: true
-    name: lava
+    name: "{{ docker.network_name }}"

roles/docker/templates/mmdl-compose.yml.j2

@@ -17,6 +17,7 @@ services:
       glance.url: https://{{ subdomains.tasks }}/
       glance.description: Task and calendar management
       glance.id: mmdl
+      mag37.dockcheck.update: true
 
   mmdl_db:
     image: mysql:8.0
@@ -35,6 +36,7 @@ services:
     labels:
       glance.parent: mmdl
       glance.name: DB
+      mag37.dockcheck.update: true
 
 volumes:
   mmdl_db:

roles/docker/templates/obsidian-livesync-compose.yml.j2

@@ -0,0 +1,30 @@
+services:
+  obsidian-livesync:
+    image: oleduc/docker-obsidian-livesync-couchdb:latest
+    container_name: obsidian-livesync
+    restart: unless-stopped
+    labels:
+      glance.name: Obsidian LiveSync
+      glance.icon: si:obsidian
+      glance.url: http://{{ network.docker_host_ip }}:5984
+      glance.description: Obsidian note synchronization
+      glance.id: obsidian-livesync
+    environment:
+      - SERVER_DOMAIN={{ network.docker_host_ip }}
+      - COUCHDB_USER={{ vault_obsidian.username }}
+      - COUCHDB_PASSWORD={{ vault_obsidian.password }}
+      - COUCHDB_DATABASE=obsidian
+    ports:
+      - "{{ network.docker_host_ip }}:5984:5984"
+    volumes:
+      - couchdb_data:/opt/couchdb/data
+    networks:
+      - default
+
+volumes:
+  couchdb_data:
+
+networks:
+  default:
+    external: true
+    name: "{{ docker.network_name }}"

roles/docker/templates/palmr-compose.yml.j2

@@ -0,0 +1,30 @@
+services:
+  palmr:
+    image: kyantech/palmr:latest
+    restart: unless-stopped
+    environment:
+      DISABLE_FILESYSTEM_ENCRYPTION: "false"
+      ENCRYPTION_KEY: "{{ vault_palmr.encryption_key }}"
+      PALMR_UID: "1000"
+      PALMR_GID: "1000"
+      SECURE_SITE: "true"
+      DEFAULT_LANGUAGE: "en-US"
+      TRUST_PROXY: "true"
+    extra_hosts:
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
+    labels:
+      glance.name: Palmr
+      glance.icon: si:files
+      glance.url: "https://{{ subdomains.files }}/"
+      glance.description: File sharing and storage
+      glance.id: palmr
+      mag37.dockcheck.update: true
+    volumes:
+      - palmr_data:/app/server
+volumes:
+  palmr_data:
+    driver: local
+networks:
+  default:
+    external: true
+    name: "{{ docker.network_name }}"

roles/docker/templates/paperlessngx-compose.yml.j2

@@ -57,6 +57,26 @@ services:
       glance.name: Tika
     restart: unless-stopped
 
+  backup:
+    image: offen/docker-volume-backup:v2
+    restart: always
+    labels:
+      glance.parent: paperlessngx
+      glance.name: Backup
+      mag37.dockcheck.update: true
+    environment:
+      BACKUP_FILENAME: pngx-backup-%Y-%m-%dT%H-%M-%S.tar.gz
+      BACKUP_CRON_EXPRESSION: "10 9 * * *"
+      BACKUP_PRUNING_PREFIX: pngx-
+      BACKUP_RETENTION_DAYS: 7
+      AWS_S3_BUCKET_NAME: tsolbackups
+      AWS_ENDPOINT: s3.us-west-004.backblazeb2.com 
+      AWS_ACCESS_KEY_ID: {{ vault_backup.access_key_id }}
+      AWS_SECRET_ACCESS_KEY: {{ vault_backup.secret_access_key }}
+    volumes:
+      - media:/backup/pngx-app-backup:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+
 volumes:
   data:
   media:

roles/docker/templates/pingvin-compose.yml.j2

@@ -1,24 +0,0 @@
-services:
-  pingvin-share:
-    image: stonith404/pingvin-share:latest
-    restart: unless-stopped
-    environment:
-      - TRUST_PROXY=true
-    extra_hosts:
-      - '{{ subdomains.auth }}:{{ docker.hairpin_ip }}'
-    labels:
-      glance.name: Pingvin
-      glance.icon: si:files
-      glance.url: https://{{ subdomains.files }}
-      glance.description: File sharing service
-      glance.id: pingvin
-    volumes:
-      - data:/opt/app/backend/data
-      - images:/opt/app/frontend/public/img
-volumes:
-  images:
-  data:
-networks:
-  default:
-    external: true
-    name: {{ docker.network_name }}

roles/docker/templates/postiz-compose.yml.j2

@@ -38,6 +38,7 @@ services:
       glance.url: https://{{ subdomains.post }}/
       glance.description: Social media scheduler
       glance.id: postiz
+      mag37.dockcheck.update: true
  
   postiz-postgres:
     image: postgres:14.5
@@ -57,6 +58,7 @@ services:
     labels:
       glance.parent: postiz
       glance.name: DB
+      mag37.dockcheck.update: true
   postiz-redis:
     image: redis:7.2
     container_name: postiz-redis
@@ -71,6 +73,7 @@ services:
     labels:
       glance.parent: postiz
       glance.name: Redis
+      mag37.dockcheck.update: true
 
  
  

todo.md

@@ -9,11 +9,11 @@
   roles/docker/tasks/
   ├── main.yml (orchestrator)
   ├── infrastructure/ (caddy, authentik, dockge)
-  ├── development/ (gitea, codeserver)
+  ├── development/ (gitea, codeserver, bytestash)
   ├── media/ (audiobookshelf, calibre, ghost, pinchflat, pinry, hoarder, manyfold)
-  ├── productivity/ (paperless, baikal, syncthing, mmdl, heyform, dawarich, pingvin)
+  ├── productivity/ (paperless, baikal, syncthing, mmdl, heyform, dawarich, palmr, obsidian-livesync)
   ├── communication/ (gotosocial, postiz)
-  └── monitoring/ (glance, changedetection, appriseapi)
+  └── monitoring/ (glance, changedetection, appriseapi, gotify)
   ```
 - **COMPLETED**: All services organized into logical categories with category-level tags