add Redlib Reddit frontend service with security hardening

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

.gitignore

@@ -1,2 +1,3 @@
 .python-version
-secrets.enc
+secrets.enc
+vault_pass

dns.yml

@@ -53,7 +53,7 @@
       amazon.aws.route53:
         state: present
         zone: "{{ item.0.name }}"
-        record: "{{ item.1.name }}.{{ item.0.name }}"
+        record: "{{ item.0.name if item.1.name == '@' else item.1.name + '.' + item.0.name }}"
         type: A
         ttl: 300
         value: "{{ item.1.ip }}"

roles/docker/files/Caddyfile

@@ -115,6 +115,11 @@ repair.nerder.land {
     file_server
 }
 
+nerder.land {
+    root * /srv/nerderland
+    file_server
+}
+
 forms.nerder.land {
     reverse_proxy heyform-heyform-1:8000
 }

roles/docker/templates/authentik-compose.yml.j2

@@ -37,7 +37,7 @@ services:
       glance.parent: authentik
       glance.name: Redis
   server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.2.1}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.4}
     restart: unless-stopped
     command: server
     environment:
@@ -64,7 +64,7 @@ services:
       glance.description: Authentication server
       glance.id: authentik
   worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.2.1}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.4}
     restart: unless-stopped
     command: worker
     environment:

roles/docker/templates/gotosocial-compose.yml.j2

@@ -1,6 +1,6 @@
 services:
   gotosocial:
-    image: superseriousbusiness/gotosocial:0.18.2
+    image: superseriousbusiness/gotosocial:latest
     container_name: gotosocial
     user: 1000:1000
     extra_hosts:

roles/docker/templates/manyfold-compose.yml.j2

@@ -19,6 +19,7 @@ services:
       OIDC_ISSUER: https://auth.thesatelliteoflove.com/application/o/manyfold/
       OIDC_NAME: Authentik
       PUBLIC_HOSTNAME: models.thesatelliteoflove.com
+      MAX_FILE_UPLOAD_SIZE: 5368709120
       PUID: 1000
       PGID: 1000
     extra_hosts:

roles/docker/templates/redlib-compose.yml.j2

@@ -0,0 +1,24 @@
+services:
+  redlib:
+    image: quay.io/redlib/redlib:latest
+    restart: always
+    container_name: "redlib"
+    user: nobody
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+      # - seccomp=seccomp-redlib.json
+    cap_drop:
+      - ALL
+    env_file: .env
+    networks:
+      - redlib
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "--tries=1", "http://localhost:8080/settings"]
+      interval: 5m
+      timeout: 3s
+
+networks:
+  default:
+    external: true
+    name: lava