feat: add dockcheck auto-update labels to remaining services

Add mag37.dockcheck.update labels to enable automated container update monitoring for:
- Gotify iOS assistant service
- Karakeep (Hoarder) bookmark manager and all components (Chrome, Meilisearch)
- MMDL task management service
- Postiz social media scheduler and all components (PostgreSQL, Redis)

This completes the rollout of dockcheck labels across all Docker services for consistent update monitoring.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Overview
 
-This is a personal infrastructure Ansible playbook that automates deployment and management of 24 self-hosted Docker services across two domains (`thesatelliteoflove.com` and `nerder.land`). The setup uses Tailscale VPN for secure networking and Caddy for reverse proxy with automated HTTPS.
+This is a personal infrastructure Ansible playbook that automates deployment and management of 27 self-hosted Docker services across two domains (`thesatelliteoflove.com` and `nerder.land`). The setup uses Tailscale VPN for secure networking and Caddy for reverse proxy with automated HTTPS.
 
 **Important**: Always review `DEPLOYMENT_LEARNINGS.md` when working on this repository for lessons learned and troubleshooting guidance.
 
@@ -28,18 +28,18 @@ ansible-playbook dns.yml -i hosts.yml
 ### Service Management
 ```bash
 # Deploy specific services using tags (now properly isolated)
-ansible-playbook site.yml -i hosts.yml --tags caddy --vault-password-file vault_pass --extra-vars "@secrets.enc"
-ansible-playbook site.yml -i hosts.yml --tags authentik --vault-password-file vault_pass --extra-vars "@secrets.enc"
-ansible-playbook site.yml -i hosts.yml --tags mmdl --vault-password-file vault_pass --extra-vars "@secrets.enc"
-ansible-playbook site.yml -i hosts.yml --tags docker --vault-password-file vault_pass --extra-vars "@secrets.enc"  # all docker services
+ansible-playbook site.yml -i hosts.yml --tags caddy --vault-password-file vault_pass
+ansible-playbook site.yml -i hosts.yml --tags authentik --vault-password-file vault_pass
+ansible-playbook site.yml -i hosts.yml --tags mmdl --vault-password-file vault_pass
+ansible-playbook site.yml -i hosts.yml --tags docker --vault-password-file vault_pass  # all docker services
 
 # Deploy services by category (new organized structure)
-ansible-playbook site.yml -i hosts.yml --tags infrastructure --vault-password-file vault_pass --extra-vars "@secrets.enc"
-ansible-playbook site.yml -i hosts.yml --tags media,productivity --vault-password-file vault_pass --extra-vars "@secrets.enc"
-ansible-playbook site.yml -i hosts.yml --tags development,monitoring --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags infrastructure --vault-password-file vault_pass
+ansible-playbook site.yml -i hosts.yml --tags media,productivity --vault-password-file vault_pass
+ansible-playbook site.yml -i hosts.yml --tags development,monitoring --vault-password-file vault_pass
 
 # Deploy only infrastructure components
-ansible-playbook site.yml -i hosts.yml --tags common,cron --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags common,cron --vault-password-file vault_pass
 ```
 
 ## Architecture
@@ -60,15 +60,15 @@ The docker role is now organized into logical service groups under `roles/docker
 - **infrastructure/**: Core platform components
   - Caddy (reverse proxy), Authentik (SSO), Dockge (container management)
 - **development/**: Development and collaboration tools  
-  - Gitea, Code Server
+  - Gitea, Code Server, ByteStash
 - **media/**: Content creation and consumption
   - Audiobookshelf, Calibre, Ghost blog, Pinchflat, Pinry, Karakeep (formerly Hoarder), Manyfold
 - **productivity/**: Personal organization and document management
-  - Paperless-NGX, MMDL, Baikal (CalDAV/CardDAV), Syncthing, Heyform, Dawarich, Pingvin
+  - Paperless-NGX, MMDL, Baikal (CalDAV/CardDAV), Syncthing, Heyform, Dawarich, Palmr, Obsidian LiveSync
 - **communication/**: Social media and external communication
   - GoToSocial (Fediverse), Postiz (social media management)  
 - **monitoring/**: System monitoring and alerts
-  - Changedetection, Glance dashboard, AppriseAPI
+  - Changedetection, Glance dashboard, AppriseAPI, Gotify
 
 ### Variable Management
 **Critical**: This infrastructure uses a centralized variable hierarchy in `group_vars/all/`:
@@ -131,7 +131,7 @@ Common domains requiring hairpinning fixes:
 - **Dawarich**: Based on production compose file at https://github.com/Freika/dawarich/blob/master/docker/docker-compose.production.yml
 
 ## Service Memories
-- pingvin is the service that responds on files.thesatelliteoflove.com
+- palmr is the service that responds on files.thesatelliteoflove.com
 - karakeep (formerly called hoarder) is deployed with both 'hoarder' and 'karakeep' tags for backward compatibility
 - whenever i ask you what containers need updates, run dockcheck and return a list of containers needing updates
 - when i ask for the status container updates i want you to run dockcheck on the docker host https://github.com/mag37/dockcheck?ref=selfh.st

README.md

@@ -10,7 +10,7 @@ The playbook manages two main environments:
 
 ## Services Deployed
 
-The Docker role deploys and manages 24 self-hosted services organized into logical categories:
+The Docker role deploys and manages 27 self-hosted services organized into logical categories:
 
 ### Infrastructure
 - **Caddy** (Reverse proxy with automatic HTTPS)
@@ -20,6 +20,7 @@ The Docker role deploys and manages 24 self-hosted services organized into logic
 ### Development
 - **Gitea** (Git repository hosting)
 - **Code Server** (VS Code in browser)
+- **ByteStash** (Code snippet management)
 
 ### Media
 - **Audiobookshelf** (Audiobook server)
@@ -37,7 +38,8 @@ The Docker role deploys and manages 24 self-hosted services organized into logic
 - **Syncthing** (File synchronization)
 - **HeyForm** (Form builder)
 - **Dawarich** (Location tracking)
-- **Pingvin Share** (File sharing)
+- **Palmr** (File sharing)
+- **Obsidian LiveSync** (Note synchronization)
 
 ### Communication
 - **GoToSocial** (Fediverse/Mastodon)
@@ -47,6 +49,7 @@ The Docker role deploys and manages 24 self-hosted services organized into logic
 - **Changedetection** (Website change monitoring)
 - **Glance** (Dashboard)
 - **AppriseAPI** (Notification service)
+- **Gotify** (Push notifications)
 
 ## Structure
 

dns.yml

@@ -53,6 +53,10 @@
             ip: "152.53.36.98"
           - name: pdg
             ip: "152.53.36.98"
+          - name: kanboard
+            ip: "152.53.36.98"
+          - name: grocy
+            ip: "152.53.36.98"
       - name: nerder.land
         dns_records:
           - name: "forms"

group_vars/all/domains.yml

@@ -21,7 +21,7 @@ subdomains:
   tasks: "tasks.{{ primary_domain }}"  # MMDL
   syncthing: "syncthing.{{ primary_domain }}"
   loclog: "loclog.{{ primary_domain }}"  # Dawarich
-  files: "files.{{ primary_domain }}"  # Pingvin file sharing
+  files: "files.{{ primary_domain }}"  # Palmr file sharing
   social: "social.{{ primary_domain }}"  # GoToSocial
   post: "post.{{ primary_domain }}"  # Postiz
   home: "home.{{ primary_domain }}"  # Glance
@@ -32,6 +32,8 @@ subdomains:
   bytestash: "snippets.{{ primary_domain }}"  # ByteStash code snippets
   gotify: "gotify.{{ primary_domain }}"  # Gotify notifications
   gotify_assistant: "gotify-assistant.{{ primary_domain }}"  # iGotify iOS assistant
+  kanboard: "kanboard.{{ primary_domain }}"  # Kanboard project management
+  grocy: "grocy.{{ primary_domain }}"  # Grocy kitchen ERP
 
 # Email domains for notifications
 email_domains:

roles/docker/README.md

@@ -28,6 +28,7 @@ Deploys and manages a comprehensive self-hosted infrastructure with 24 container
 ### Development (`development/`)
 - **Gitea** - Self-hosted Git with CI/CD runners
 - **Code Server** - VS Code in the browser
+- **ByteStash** - Code snippet management and organization
 
 ### Media (`media/`)
 - **Audiobookshelf** - Audiobook and podcast server
@@ -45,7 +46,8 @@ Deploys and manages a comprehensive self-hosted infrastructure with 24 container
 - **Syncthing** - Decentralized file sync
 - **Heyform** - Form builder and surveys
 - **Dawarich** - Location tracking
-- **Pingvin Share** - File sharing service
+- **Palmr** - File sharing service
+- **Obsidian LiveSync** - CouchDB backend for note synchronization
 
 ### Communication (`communication/`)
 - **GoToSocial** - Lightweight ActivityPub server
@@ -55,6 +57,7 @@ Deploys and manages a comprehensive self-hosted infrastructure with 24 container
 - **Glance** - Customizable dashboard with monitoring
 - **Change Detection** - Website monitoring
 - **Apprise API** - Unified notifications
+- **Gotify** - Self-hosted push notification service
 
 ## Deployment Patterns
 

roles/docker/files/Caddyfile

@@ -40,6 +40,30 @@ tasks.thesatelliteoflove.com {
     reverse_proxy mmdl:3000
 }
 
+kanboard.thesatelliteoflove.com {
+    reverse_proxy kanboard:80
+}
+
+grocy.thesatelliteoflove.com {
+    # API endpoints bypass forward auth for mobile apps
+    handle /api/* {
+        reverse_proxy grocy:80
+    }
+    
+    # Web interface requires Authentik authentication
+    forward_auth authentik-server-1:9000 {
+        uri /outpost.goauthentik.io/auth/caddy
+        copy_headers {
+            X-authentik-username
+            X-authentik-groups  
+            X-authentik-email
+            X-authentik-name
+            X-authentik-uid
+        }
+    }
+    reverse_proxy grocy:80
+}
+
 phlog.thesatelliteoflove.com {
     reverse_proxy ghost-1-ghost-1:2368
 }
@@ -54,7 +78,7 @@ snippets.thesatelliteoflove.com {
 }
 
 files.thesatelliteoflove.com {
-    reverse_proxy pingvin-pingvin-share-1:3000
+    reverse_proxy palmr-palmr-1:5487
 }
 
 git.thesatelliteoflove.com {

roles/docker/tasks/productivity/grocy.yml

@@ -0,0 +1,18 @@
+---
+- name: Create grocy directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/grocy
+
+- name: Template grocy compose file
+  ansible.builtin.template:
+    src: grocy-compose.yml.j2
+    dest: /opt/stacks/grocy/compose.yml
+
+- name: Deploy grocy stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/grocy
+    files:
+      - compose.yml

roles/docker/tasks/productivity/kanboard.yml

@@ -0,0 +1,18 @@
+---
+- name: Create kanboard directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/kanboard
+
+- name: Template kanboard compose file
+  ansible.builtin.template:
+    src: kanboard-compose.yml.j2
+    dest: /opt/stacks/kanboard/compose.yml
+
+- name: Deploy kanboard stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/kanboard
+    files:
+      - compose.yml

roles/docker/tasks/productivity/main.yml

@@ -25,10 +25,18 @@
   import_tasks: dawarich.yml
   tags: dawarich
 
-- name: Install pingvin
-  import_tasks: pingvin.yml
-  tags: pingvin
+- name: Install palmr
+  import_tasks: palmr.yml
+  tags: palmr
 
 - name: Install obsidian-livesync
   import_tasks: obsidian-livesync.yml
-  tags: obsidian-livesync
+  tags: obsidian-livesync
+
+- name: Install kanboard
+  import_tasks: kanboard.yml
+  tags: kanboard
+
+- name: Install grocy
+  import_tasks: grocy.yml
+  tags: grocy

roles/docker/tasks/productivity/palmr.yml

@@ -0,0 +1,19 @@
+- name: make palmr directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/palmr
+
+- name: Template out the compose file
+  ansible.builtin.template:
+    src: palmr-compose.yml.j2
+    dest: /opt/stacks/palmr/compose.yml
+    owner: root
+    mode: 644
+
+- name: deploy palmr stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/palmr
+    files:
+      - compose.yml

roles/docker/tasks/productivity/pingvin.yml

@@ -1,19 +0,0 @@
-- name: make pingvin directories
-  ansible.builtin.file:
-    path: "{{ item}}"
-    state: directory
-  loop:
-    - /opt/stacks/pingvin
-
-- name: Template out the compose file
-  ansible.builtin.template:
-    src: pingvin-compose.yml.j2
-    dest: /opt/stacks/pingvin/compose.yml
-    owner: root
-    mode: 644
-
-- name: deploy pingvin stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/pingvin
-    files:
-    - compose.yml

roles/docker/templates/appriseapi-compose.yml.j2

@@ -19,7 +19,7 @@ services:
       glance.url: https://{{ subdomains.appriseapi }}/
       glance.description: Apprise api server
       glance.id: apprise
-    
+      mag37.dockcheck.update: true
 volumes:
   config:
   attach:

roles/docker/templates/authentik-compose.yml.j2

@@ -37,7 +37,7 @@ services:
       glance.parent: authentik
       glance.name: Redis
   server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.3}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.4}
     restart: unless-stopped
     command: server
     environment:
@@ -64,7 +64,7 @@ services:
       glance.description: Authentication server
       glance.id: authentik
   worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.3}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.4}
     restart: unless-stopped
     command: worker
     environment:

roles/docker/templates/baikal-compose.yml.j2

@@ -10,7 +10,7 @@ services:
       glance.icon: si:protoncalendar
       glance.url: https://{{ subdomains.cal }}/
       glance.description: CalDav server
-
+      mag37.dockcheck.update: true
 volumes:
   config:
   data:

roles/docker/templates/dawarich-compose.yml.j2

@@ -36,7 +36,7 @@ services:
       timeout: 10s
 
   dawarich_app:
-    image: freikin/dawarich:0.28.1
+    image: freikin/dawarich:latest
     container_name: dawarich_app
     labels:
       glance.name: Dawarich
@@ -95,7 +95,7 @@ services:
           cpus: '0.50'
           memory: '2G'
   dawarich_sidekiq:
-    image: freikin/dawarich:0.28.1
+    image: freikin/dawarich:latest
     container_name: dawarich_sidekiq
     labels:
       glance.parent: dawarich

roles/docker/templates/gotify-compose.yml.j2

@@ -32,6 +32,7 @@ services:
       glance.icon: si:apple
       glance.url: "https://{{ subdomains.gotify_assistant }}/"
       glance.description: iOS notification assistant
+      mag37.dockcheck.update: true
     extra_hosts:
       - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
       - "{{ subdomains.gotify }}:{{ docker.hairpin_ip }}"

roles/docker/templates/gotosocial-compose.yml.j2

@@ -44,23 +44,19 @@ services:
     labels:
       glance.parent: gotosocial
       glance.name: Backup
+      mag37.dockcheck.update: true
     environment:
-      BACKUP_FILENAME: backup-gts-%Y-%m-%dT%H-%M-%S.tar.gz
-      BACKUP_LATEST_SYMLINK: backup-latest.tar.gz
+      BACKUP_FILENAME: gts-backup-%Y-%m-%dT%H-%M-%S.tar.gz
       BACKUP_CRON_EXPRESSION: "0 9 * * *"
-      BACKUP_PRUNING_PREFIX: backup-
-      BACKUP_RETENTION_DAYS: 1
+      BACKUP_PRUNING_PREFIX: gts-
+      BACKUP_RETENTION_DAYS: 7
       AWS_S3_BUCKET_NAME: tsolbackups
       AWS_ENDPOINT: s3.us-west-004.backblazeb2.com 
       AWS_ACCESS_KEY_ID: {{ vault_backup.access_key_id }}
       AWS_SECRET_ACCESS_KEY: {{ vault_backup.secret_access_key }}
-      BACKUP_SKIP_BACKENDS_FROM_PRUNE: s3
-
-
     volumes:
-      - gotosocial:/backup/my-app-backup:ro
+      - gotosocial:/backup/gts-app-backup:ro
       - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ./backup:/archive
 
 volumes:
   gotosocial:

roles/docker/templates/grocy-compose.yml.j2

@@ -0,0 +1,30 @@
+services:
+  grocy:
+    image: lscr.io/linuxserver/grocy:latest
+    container_name: grocy
+    restart: unless-stopped
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=America/Denver
+    volumes:
+      - ./config:/config
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
+    labels:
+      glance.name: Grocy
+      glance.icon: si:grocyapp
+      glance.url: https://{{ subdomains.grocy }}/
+      glance.description: Kitchen ERP and inventory management
+      glance.id: grocy
+      mag37.dockcheck.update: true
+
+volumes:
+  grocy_config:
+    driver: local
+
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}

roles/docker/templates/hoarder-compose.yml.j2

@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   web:
-    image: ghcr.io/karakeep-app/karakeep:0.25.0
+    image: ghcr.io/karakeep-app/karakeep:latest
     restart: unless-stopped
     volumes:
       - data:/data
@@ -22,12 +22,14 @@ services:
       glance.url: https://{{ subdomains.bookmarks }}/
       glance.description: Bookmark manager
       glance.id: karakeep
+      mag37.dockcheck.update: true
   chrome:
     image: gcr.io/zenika-hub/alpine-chrome:123
     restart: unless-stopped
     labels:
       glance.name: Chrome
       glance.parent: karakeep
+      mag37.dockcheck.update: true
     command:
       - --no-sandbox
       - --disable-gpu
@@ -41,6 +43,7 @@ services:
     labels:
       glance.name: Meilisearch
       glance.parent: karakeep
+      mag37.dockcheck.update: true
     env_file:
       - .env
     environment:

roles/docker/templates/kanboard-compose.yml.j2

@@ -0,0 +1,32 @@
+services:
+  kanboard:
+    image: kanboard/kanboard:latest
+    container_name: kanboard
+    restart: unless-stopped
+    environment:
+      - PLUGIN_INSTALLER=true
+      - DB_DRIVER=sqlite
+    volumes:
+      - kanboard_data:/var/www/app/data
+      - kanboard_plugins:/var/www/app/plugins
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
+    labels:
+      glance.name: Kanboard
+      glance.icon: si:kanboard
+      glance.url: https://{{ subdomains.kanboard }}/
+      glance.description: Project management and Kanban boards
+      glance.id: kanboard
+      mag37.dockcheck.update: true
+
+volumes:
+  kanboard_data:
+    driver: local
+  kanboard_plugins:
+    driver: local
+
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}

roles/docker/templates/mmdl-compose.yml.j2

@@ -17,6 +17,7 @@ services:
       glance.url: https://{{ subdomains.tasks }}/
       glance.description: Task and calendar management
       glance.id: mmdl
+      mag37.dockcheck.update: true
 
   mmdl_db:
     image: mysql:8.0

roles/docker/templates/palmr-compose.yml.j2

@@ -0,0 +1,30 @@
+services:
+  palmr:
+    image: kyantech/palmr:latest
+    restart: unless-stopped
+    environment:
+      DISABLE_FILESYSTEM_ENCRYPTION: "false"
+      ENCRYPTION_KEY: "{{ vault_palmr.encryption_key }}"
+      PALMR_UID: "1000"
+      PALMR_GID: "1000"
+      SECURE_SITE: "true"
+      DEFAULT_LANGUAGE: "en-US"
+      TRUST_PROXY: "true"
+    extra_hosts:
+      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
+    labels:
+      glance.name: Palmr
+      glance.icon: si:files
+      glance.url: "https://{{ subdomains.files }}/"
+      glance.description: File sharing and storage
+      glance.id: palmr
+      mag37.dockcheck.update: true
+    volumes:
+      - palmr_data:/app/server
+volumes:
+  palmr_data:
+    driver: local
+networks:
+  default:
+    external: true
+    name: "{{ docker.network_name }}"

roles/docker/templates/paperlessngx-compose.yml.j2

@@ -57,6 +57,26 @@ services:
       glance.name: Tika
     restart: unless-stopped
 
+  backup:
+    image: offen/docker-volume-backup:v2
+    restart: always
+    labels:
+      glance.parent: paperlessngx
+      glance.name: Backup
+      mag37.dockcheck.update: true
+    environment:
+      BACKUP_FILENAME: pngx-backup-%Y-%m-%dT%H-%M-%S.tar.gz
+      BACKUP_CRON_EXPRESSION: "10 9 * * *"
+      BACKUP_PRUNING_PREFIX: pngx-
+      BACKUP_RETENTION_DAYS: 7
+      AWS_S3_BUCKET_NAME: tsolbackups
+      AWS_ENDPOINT: s3.us-west-004.backblazeb2.com 
+      AWS_ACCESS_KEY_ID: {{ vault_backup.access_key_id }}
+      AWS_SECRET_ACCESS_KEY: {{ vault_backup.secret_access_key }}
+    volumes:
+      - media:/backup/pngx-app-backup:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+
 volumes:
   data:
   media:

roles/docker/templates/pingvin-compose.yml.j2

@@ -1,24 +0,0 @@
-services:
-  pingvin-share:
-    image: stonith404/pingvin-share:latest
-    restart: unless-stopped
-    environment:
-      - TRUST_PROXY=true
-    extra_hosts:
-      - '{{ subdomains.auth }}:{{ docker.hairpin_ip }}'
-    labels:
-      glance.name: Pingvin
-      glance.icon: si:files
-      glance.url: https://{{ subdomains.files }}
-      glance.description: File sharing service
-      glance.id: pingvin
-    volumes:
-      - data:/opt/app/backend/data
-      - images:/opt/app/frontend/public/img
-volumes:
-  images:
-  data:
-networks:
-  default:
-    external: true
-    name: {{ docker.network_name }}

roles/docker/templates/postiz-compose.yml.j2

@@ -38,6 +38,7 @@ services:
       glance.url: https://{{ subdomains.post }}/
       glance.description: Social media scheduler
       glance.id: postiz
+      mag37.dockcheck.update: true
  
   postiz-postgres:
     image: postgres:14.5
@@ -57,6 +58,7 @@ services:
     labels:
       glance.parent: postiz
       glance.name: DB
+      mag37.dockcheck.update: true
   postiz-redis:
     image: redis:7.2
     container_name: postiz-redis
@@ -71,6 +73,7 @@ services:
     labels:
       glance.parent: postiz
       glance.name: Redis
+      mag37.dockcheck.update: true
 
  
  

todo.md

@@ -9,11 +9,11 @@
   roles/docker/tasks/
   ├── main.yml (orchestrator)
   ├── infrastructure/ (caddy, authentik, dockge)
-  ├── development/ (gitea, codeserver)
+  ├── development/ (gitea, codeserver, bytestash)
   ├── media/ (audiobookshelf, calibre, ghost, pinchflat, pinry, hoarder, manyfold)
-  ├── productivity/ (paperless, baikal, syncthing, mmdl, heyform, dawarich, pingvin)
+  ├── productivity/ (paperless, baikal, syncthing, mmdl, heyform, dawarich, palmr, obsidian-livesync)
   ├── communication/ (gotosocial, postiz)
-  └── monitoring/ (glance, changedetection, appriseapi)
+  └── monitoring/ (glance, changedetection, appriseapi, gotify)
   ```
 - **COMPLETED**: All services organized into logical categories with category-level tags