.gitignore

@@ -1,3 +1,2 @@
 .python-version
-secrets.enc
-vault_pass
+secrets.enc

dns.yml

@@ -53,7 +53,7 @@
       amazon.aws.route53:
         state: present
         zone: "{{ item.0.name }}"
-        record: "{{ item.0.name if item.1.name == '@' else item.1.name + '.' + item.0.name }}"
+        record: "{{ item.1.name }}.{{ item.0.name }}"
         type: A
         ttl: 300
         value: "{{ item.1.ip }}"

roles/docker/files/Caddyfile

@@ -115,11 +115,6 @@ repair.nerder.land {
     file_server
 }
 
-nerder.land {
-    root * /srv/nerderland
-    file_server
-}
-
 forms.nerder.land {
     reverse_proxy heyform-heyform-1:8000
 }

roles/docker/templates/authentik-compose.yml.j2

@@ -37,7 +37,7 @@ services:
       glance.parent: authentik
       glance.name: Redis
   server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.4}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.2.1}
     restart: unless-stopped
     command: server
     environment:
@@ -64,7 +64,7 @@ services:
       glance.description: Authentication server
       glance.id: authentik
   worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.4}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.2.1}
     restart: unless-stopped
     command: worker
     environment:

roles/docker/templates/gotosocial-compose.yml.j2

@@ -1,6 +1,6 @@
 services:
   gotosocial:
-    image: superseriousbusiness/gotosocial:latest
+    image: superseriousbusiness/gotosocial:0.18.2
     container_name: gotosocial
     user: 1000:1000
     extra_hosts:

roles/docker/templates/manyfold-compose.yml.j2

@@ -19,7 +19,6 @@ services:
       OIDC_ISSUER: https://auth.thesatelliteoflove.com/application/o/manyfold/
       OIDC_NAME: Authentik
       PUBLIC_HOSTNAME: models.thesatelliteoflove.com
-      MAX_FILE_UPLOAD_SIZE: 5368709120
       PUID: 1000
       PGID: 1000
     extra_hosts:

roles/docker/templates/redlib-compose.yml.j2

@@ -1,24 +0,0 @@
-services:
-  redlib:
-    image: quay.io/redlib/redlib:latest
-    restart: always
-    container_name: "redlib"
-    user: nobody
-    read_only: true
-    security_opt:
-      - no-new-privileges:true
-      # - seccomp=seccomp-redlib.json
-    cap_drop:
-      - ALL
-    env_file: .env
-    networks:
-      - redlib
-    healthcheck:
-      test: ["CMD", "wget", "--spider", "-q", "--tries=1", "http://localhost:8080/settings"]
-      interval: 5m
-      timeout: 3s
-
-networks:
-  default:
-    external: true
-    name: lava