update documentation and config to reflect 21 active services

Removed references to 9 decommissioned services from CLAUDE.md,
README.md, domains.yml, services.yml, and Glance release tracking.
Added services tag and Cronmaster to docs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.local.md

@@ -0,0 +1,7 @@
+- the password for secrets.enc is in vault_pass
+- do not use the ansible-vault edit command
+- NEVER, EVER, EVER, USE, OPEN, OR TOUCH SECRETS.ENC
+- Whenever I talk about cron jobs I am referring to cron jobs on the remote servers managed by ansible, never the local machine
+- never use secrets.enc
+- all secrets go in vault.yml, never secrets.enc, never some random file you want to create, only ever vault.yml. you decrypt vault.yml with vault_pass
+- Never use ansible-vault edit. always decrypt, make the changes, then encrypt

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Overview
 
-This is a personal infrastructure Ansible playbook that automates deployment and management of 27 self-hosted Docker services across two domains (`thesatelliteoflove.com` and `nerder.land`). The setup uses Tailscale VPN for secure networking and Caddy for reverse proxy with automated HTTPS.
+This is a personal infrastructure Ansible playbook that automates deployment and management of 21 self-hosted Docker services across two domains (`thesatelliteoflove.com` and `nerder.land`). The setup uses Tailscale VPN for secure networking and Caddy for reverse proxy with automated HTTPS.
 
 **Important**: Always review `DEPLOYMENT_LEARNINGS.md` when working on this repository for lessons learned and troubleshooting guidance.
 
@@ -30,10 +30,11 @@ ansible-playbook dns.yml -i hosts.yml
 # Deploy specific services using tags (now properly isolated)
 ansible-playbook site.yml -i hosts.yml --tags caddy --vault-password-file vault_pass
 ansible-playbook site.yml -i hosts.yml --tags authentik --vault-password-file vault_pass
-ansible-playbook site.yml -i hosts.yml --tags mmdl --vault-password-file vault_pass
-ansible-playbook site.yml -i hosts.yml --tags docker --vault-password-file vault_pass  # all docker services
+ansible-playbook site.yml -i hosts.yml --tags gitea --vault-password-file vault_pass
+ansible-playbook site.yml -i hosts.yml --tags docker --vault-password-file vault_pass  # entire docker role
+ansible-playbook site.yml -i hosts.yml --tags services --vault-password-file vault_pass  # all services only
 
-# Deploy services by category (new organized structure)
+# Deploy services by category
 ansible-playbook site.yml -i hosts.yml --tags infrastructure --vault-password-file vault_pass
 ansible-playbook site.yml -i hosts.yml --tags media,productivity --vault-password-file vault_pass
 ansible-playbook site.yml -i hosts.yml --tags development,monitoring --vault-password-file vault_pass
@@ -51,7 +52,7 @@ ansible-playbook site.yml -i hosts.yml --tags common,cron --vault-password-file
 ### Role Structure
 - **bootstrap**: Initial server hardening, user creation, Tailscale VPN setup
 - **common**: Basic system configuration, UFW firewall management
-- **docker**: Comprehensive service deployment (24 containerized applications, organized by category)
+- **docker**: Comprehensive service deployment (21 containerized applications, organized by category)
 - **cron**: Scheduled task management (currently Warhammer RSS feed generation)
 
 ### Docker Role Organization (Reorganized into Logical Categories)
@@ -60,15 +61,15 @@ The docker role is now organized into logical service groups under `roles/docker
 - **infrastructure/**: Core platform components
   - Caddy (reverse proxy), Authentik (SSO), Dockge (container management)
 - **development/**: Development and collaboration tools  
-  - Gitea, Code Server, ByteStash
+  - Gitea, ByteStash
 - **media/**: Content creation and consumption
-  - Audiobookshelf, Calibre, Ghost blog, Pinchflat, Pinry, Karakeep (formerly Hoarder), Manyfold
+  - Audiobookshelf, Calibre, Karakeep (formerly Hoarder), Manyfold
 - **productivity/**: Personal organization and document management
-  - Paperless-NGX, MMDL, Baikal (CalDAV/CardDAV), Syncthing, Heyform, Dawarich, Palmr, Obsidian LiveSync
-- **communication/**: Social media and external communication
-  - GoToSocial (Fediverse), Postiz (social media management)  
+  - Paperless-NGX, Baikal (CalDAV/CardDAV), Syncthing, Heyform, Dawarich, Obsidian LiveSync
+- **communication/**: Social media
+  - GoToSocial (Fediverse)
 - **monitoring/**: System monitoring and alerts
-  - Changedetection, Glance dashboard, AppriseAPI, Gotify
+  - Changedetection, Glance dashboard, AppriseAPI, Gotify, Cronmaster
 
 ### Variable Management
 **Critical**: This infrastructure uses a centralized variable hierarchy in `group_vars/all/`:
@@ -131,7 +132,6 @@ Common domains requiring hairpinning fixes:
 - **Dawarich**: Based on production compose file at https://github.com/Freika/dawarich/blob/master/docker/docker-compose.production.yml
 
 ## Service Memories
-- palmr is the service that responds on files.thesatelliteoflove.com
 - karakeep (formerly called hoarder) is deployed with both 'hoarder' and 'karakeep' tags for backward compatibility
 - whenever i ask you what containers need updates, run dockcheck and return a list of containers needing updates
 - when i ask for the status container updates i want you to run dockcheck on the docker host https://github.com/mag37/dockcheck?ref=selfh.st
@@ -148,7 +148,7 @@ Common domains requiring hairpinning fixes:
 - Organized secrets by service with consistent `vault_` prefix
 
 ### Service Tag Fix:
-**Critical**: Service tags are now properly isolated. `--tags mmdl` deploys only MMDL (5 tasks), not the entire productivity category.
+**Critical**: Service tags are properly isolated. Individual service tags deploy only that service. The `services` tag runs all service tasks across all categories.
 
 ### Template Pattern:
 All templates now follow this pattern:

README.md

@@ -10,7 +10,7 @@ The playbook manages two main environments:
 
 ## Services Deployed
 
-The Docker role deploys and manages 27 self-hosted services organized into logical categories:
+The Docker role deploys and manages 21 self-hosted services organized into logical categories:
 
 ### Infrastructure
 - **Caddy** (Reverse proxy with automatic HTTPS)
@@ -19,37 +19,31 @@ The Docker role deploys and manages 27 self-hosted services organized into logic
 
 ### Development
 - **Gitea** (Git repository hosting)
-- **Code Server** (VS Code in browser)
 - **ByteStash** (Code snippet management)
 
 ### Media
 - **Audiobookshelf** (Audiobook server)
 - **Calibre** (E-book management)
-- **Ghost** (Blog platform)
-- **Pinchflat** (Media downloader)
-- **Pinry** (Pinterest-like board)
-- **Hoarder** (Bookmark manager)
+- **Karakeep** (Bookmark manager, formerly Hoarder)
 - **Manyfold** (3D model organizer)
 
 ### Productivity
 - **Paperless-NGX** (Document management)
-- **MMDL** (Task management)
 - **Baikal** (CalDAV/CardDAV server)
 - **Syncthing** (File synchronization)
 - **HeyForm** (Form builder)
 - **Dawarich** (Location tracking)
-- **Palmr** (File sharing)
 - **Obsidian LiveSync** (Note synchronization)
 
 ### Communication
 - **GoToSocial** (Fediverse/Mastodon)
-- **Postiz** (Social media management)
 
 ### Monitoring
 - **Changedetection** (Website change monitoring)
 - **Glance** (Dashboard)
 - **AppriseAPI** (Notification service)
 - **Gotify** (Push notifications)
+- **Cronmaster** (Scheduled container tasks)
 
 ## Structure
 
@@ -90,13 +84,13 @@ Manages scheduled tasks and automation:
 - Supports easy addition of new scheduled tasks
 
 ### [Docker Role](roles/docker/README.md)
-The most comprehensive role, deploying 25 containerized services organized into logical categories:
+The most comprehensive role, deploying 21 containerized services organized into logical categories:
 - **Infrastructure**: Caddy reverse proxy, Authentik SSO, Dockge management
-- **Development**: Gitea, Code Server, Matrix communication
-- **Media**: Audiobookshelf, Calibre, Ghost blog, Pinchflat, and more
-- **Productivity**: Paperless-NGX, MMDL task management, Baikal calendar
-- **Communication**: GoToSocial, Postiz social media management
-- **Monitoring**: Glance dashboard, Changedetection, AppriseAPI notifications
+- **Development**: Gitea, ByteStash
+- **Media**: Audiobookshelf, Calibre, Karakeep, Manyfold
+- **Productivity**: Paperless-NGX, Baikal, Syncthing, HeyForm, Dawarich, Obsidian LiveSync
+- **Communication**: GoToSocial
+- **Monitoring**: Glance dashboard, Changedetection, AppriseAPI, Gotify, Cronmaster
 - **Template-Driven**: All services use Jinja2 templates for consistent configuration
 - **Category-Based Deployment**: Deploy services by category using Ansible tags
 
@@ -134,10 +128,12 @@ Deploy specific services using tags:
 ansible-playbook site.yml -i hosts.yml --tags infrastructure
 ansible-playbook site.yml -i hosts.yml --tags media,productivity
 
+# Deploy all services (skips system setup)
+ansible-playbook site.yml -i hosts.yml --tags services
+
 # Deploy individual services
 ansible-playbook site.yml -i hosts.yml --tags caddy
 ansible-playbook site.yml -i hosts.yml --tags authentik
-ansible-playbook site.yml -i hosts.yml --tags mmdl
 ```
 
 ### Manage DNS Records

dns.yml

@@ -9,8 +9,6 @@
     domains:
       - name: thesatelliteoflove.com
         dns_records:
-          - name: "pin"
-            ip: "152.53.36.98"
           - name: "home"
             ip: "152.53.36.98"
           - name: "git"
@@ -25,26 +23,16 @@
             ip: "152.53.36.98"
           - name: "paper"
             ip: "152.53.36.98"
-          - name: "code"
-            ip: "152.53.36.98"
           - name: "snippets"
             ip: "152.53.36.98"
           - name: cal
             ip: "152.53.36.98"
-          - name: phlog
-            ip: "152.53.36.98"
           - name: loclog
             ip: "152.53.36.98"
           - name: watcher
             ip: "152.53.36.98"
           - name: models
             ip: "152.53.36.98"
-          - name: tasks
-            ip: "152.53.36.98"
-          - name: post
-            ip: "152.53.36.98"
-          - name: files
-            ip: "152.53.36.98"
           - name: bookmarks
             ip: "152.53.36.98"
           - name: gotify
@@ -53,10 +41,6 @@
             ip: "152.53.36.98"
           - name: pdg
             ip: "152.53.36.98"
-          - name: kanboard
-            ip: "152.53.36.98"
-          - name: grocy
-            ip: "152.53.36.98"
       - name: nerder.land
         dns_records:
           - name: "forms"
@@ -64,7 +48,40 @@
           - name: "repair"
             ip: "152.53.36.98"
 
+    # DNS records to remove for decommissioned services
+    removed_records:
+      - name: thesatelliteoflove.com
+        dns_records:
+          - name: "pin"
+            ip: "152.53.36.98"
+          - name: "code"
+            ip: "152.53.36.98"
+          - name: "phlog"
+            ip: "152.53.36.98"
+          - name: "tasks"
+            ip: "152.53.36.98"
+          - name: "post"
+            ip: "152.53.36.98"
+          - name: "files"
+            ip: "152.53.36.98"
+          - name: "kanboard"
+            ip: "152.53.36.98"
+          - name: "grocy"
+            ip: "152.53.36.98"
+
   tasks:
+    - name: Remove A records for decommissioned services
+      amazon.aws.route53:
+        state: absent
+        zone: "{{ item.0.name }}"
+        record: "{{ item.1.name + '.' + item.0.name }}"
+        type: A
+        ttl: 300
+        value: "{{ item.1.ip }}"
+      loop: "{{ query('subelements', removed_records, 'dns_records') }}"
+      loop_control:
+        loop_var: item
+
     - name: Add A records for subdomains of each domain
       amazon.aws.route53:
         state: present

group_vars/all/domains.yml

@@ -8,32 +8,23 @@ subdomains:
   git: "git.{{ primary_domain }}"
   cal: "cal.{{ primary_domain }}"
   docs: "docs.{{ primary_domain }}"
-  phlog: "phlog.{{ primary_domain }}"  # Ghost blog
   bookmarks: "bookmarks.{{ primary_domain }}"  # Hoarder/Karakeep
   heyform: "forms.{{ secondary_domain }}"  # Heyform on nerder.land
   media: "media.{{ primary_domain }}"
   audio: "audio.{{ primary_domain }}"  # Audiobookshelf
   books: "books.{{ primary_domain }}"  # Calibre
   models: "models.{{ primary_domain }}"  # Manyfold
-  pinchflat: "pinchflat.{{ primary_domain }}"
-  pin: "pin.{{ primary_domain }}"  # Pinry
   paper: "paper.{{ primary_domain }}"  # Paperless-NGX
-  tasks: "tasks.{{ primary_domain }}"  # MMDL
   syncthing: "syncthing.{{ primary_domain }}"
   loclog: "loclog.{{ primary_domain }}"  # Dawarich
-  files: "files.{{ primary_domain }}"  # Palmr file sharing
   social: "social.{{ primary_domain }}"  # GoToSocial
-  post: "post.{{ primary_domain }}"  # Postiz
   home: "home.{{ primary_domain }}"  # Glance
   watcher: "watcher.{{ primary_domain }}"  # Changedetection
   appriseapi: "appriseapi.{{ primary_domain }}"
   dockge: "dockge.{{ primary_domain }}"
-  code: "code.{{ primary_domain }}"  # Code Server
   bytestash: "snippets.{{ primary_domain }}"  # ByteStash code snippets
   gotify: "gotify.{{ primary_domain }}"  # Gotify notifications
   gotify_assistant: "gotify-assistant.{{ primary_domain }}"  # iGotify iOS assistant
-  kanboard: "kanboard.{{ primary_domain }}"  # Kanboard project management
-  grocy: "grocy.{{ primary_domain }}"  # Grocy kitchen ERP
 
 # Email domains for notifications
 email_domains:

group_vars/docker/services.yml

@@ -3,11 +3,11 @@
 # Service categories for organization
 service_categories:
   infrastructure: ["caddy", "authentik", "dockge"]
-  development: ["gitea", "codeserver"]
-  media: ["audiobookshelf", "calibre", "ghost", "pinchflat", "pinry", "hoarder", "manyfold"]
-  productivity: ["paperlessngx", "baikal", "syncthing", "mmdl", "heyform", "dawarich", "pingvin"]
-  communication: ["gotosocial", "postiz"]
-  monitoring: ["glance", "changedetection", "appriseapi", "gotify"]
+  development: ["gitea", "bytestash"]
+  media: ["audiobookshelf", "calibre", "hoarder", "manyfold"]
+  productivity: ["paperlessngx", "baikal", "syncthing", "heyform", "dawarich", "obsidian-livesync"]
+  communication: ["gotosocial"]
+  monitoring: ["glance", "changedetection", "appriseapi", "gotify", "cronmaster"]
 
 # Common service configuration
 services:
@@ -18,8 +18,4 @@ services:
   # Service-specific configurations
   dawarich:
     db_name: "dawarich"
-    db_user: "dawarich"
-    
-  mmdl:
-    db_name: "mmdl"
-    db_user: "mmdl"
+    db_user: "dawarich"

roles/docker/files/Caddyfile

@@ -6,10 +6,6 @@ paper.thesatelliteoflove.com {
     reverse_proxy paperlessngx-webserver-1:8000
 }
 
-pin.thesatelliteoflove.com {
-    reverse_proxy pinry-pinry-1:80
-}
-
 cal.thesatelliteoflove.com {
     redir /.well-known/caldav /dav.php 302
     redir /.well-known/carddav /dav.php 302
@@ -24,10 +20,6 @@ audio.thesatelliteoflove.com {
     reverse_proxy audiobookshelf-audiobookshelf-1:80
 }
 
-post.thesatelliteoflove.com {
-    reverse_proxy postiz:5000
-}
-
 loclog.thesatelliteoflove.com {
     reverse_proxy dawarich_app:3000
 }
@@ -36,51 +28,10 @@ watcher.thesatelliteoflove.com {
     reverse_proxy changedetection:5000
 }
 
-tasks.thesatelliteoflove.com {
-    reverse_proxy mmdl:3000
-}
-
-kanboard.thesatelliteoflove.com {
-    reverse_proxy kanboard:80
-}
-
-grocy.thesatelliteoflove.com {
-    # API endpoints bypass forward auth for mobile apps
-    handle /api/* {
-        reverse_proxy grocy:80
-    }
-    
-    # Web interface requires Authentik authentication
-    forward_auth authentik-server-1:9000 {
-        uri /outpost.goauthentik.io/auth/caddy
-        copy_headers {
-            X-authentik-username
-            X-authentik-groups  
-            X-authentik-email
-            X-authentik-name
-            X-authentik-uid
-        }
-    }
-    reverse_proxy grocy:80
-}
-
-phlog.thesatelliteoflove.com {
-    reverse_proxy ghost-1-ghost-1:2368
-}
-
-
-code.thesatelliteoflove.com {
-    reverse_proxy authentik-server-1:9000
-}
-
 snippets.thesatelliteoflove.com {
     reverse_proxy bytestash:5000
 }
 
-files.thesatelliteoflove.com {
-    reverse_proxy palmr-palmr-1:5487
-}
-
 git.thesatelliteoflove.com {
     reverse_proxy gitea:3000
 }

roles/docker/tasks/communication/postiz.yml

@@ -1,19 +1,11 @@
-- name: make postiz directories
-  ansible.builtin.file:
-    path: "{{ item}}"
-    state: directory
-  loop:
-    - /opt/stacks/postiz
-
-- name: Template out the compose file
-  ansible.builtin.template:
-    src: postiz-compose.yml.j2
-    dest: /opt/stacks/postiz/compose.yml
-    owner: root
-    mode: 644
-
-- name: deploy postiz stack
+---
+- name: Stop and remove postiz stack
   community.docker.docker_compose_v2:
     project_src: /opt/stacks/postiz
-    files:
-    - compose.yml
+    state: absent
+  ignore_errors: true
+
+- name: Remove postiz directory
+  ansible.builtin.file:
+    path: /opt/stacks/postiz
+    state: absent

roles/docker/tasks/development/codeserver.yml

@@ -1,19 +1,11 @@
-- name: make codeserver directories
-  ansible.builtin.file:
-    path: "{{ item}}"
-    state: directory
-  loop:
-    - /opt/stacks/codeserver
-
-- name: Template out the compose file
-  ansible.builtin.template:
-    src: codeserver-compose.yml.j2
-    dest: /opt/stacks/codeserver/compose.yml
-    owner: root
-    mode: 644
-
-- name: deploy codeserver stack
+---
+- name: Stop and remove codeserver stack
   community.docker.docker_compose_v2:
     project_src: /opt/stacks/codeserver
-    files:
-    - compose.yml
+    state: absent
+  ignore_errors: true
+
+- name: Remove codeserver directory
+  ansible.builtin.file:
+    path: /opt/stacks/codeserver
+    state: absent

roles/docker/tasks/main.yml

@@ -59,24 +59,24 @@
 # Deploy services by category for better organization and dependency management
 - name: Deploy infrastructure services
   import_tasks: infrastructure/main.yml
-  tags: infrastructure
+  tags: [infrastructure, services]
 
 - name: Deploy development services
   import_tasks: development/main.yml
-  tags: development
+  tags: [development, services]
 
 - name: Deploy media services
   import_tasks: media/main.yml
-  tags: media
+  tags: [media, services]
 
 - name: Deploy productivity services
   import_tasks: productivity/main.yml
-  tags: productivity
+  tags: [productivity, services]
 
 - name: Deploy monitoring services
   import_tasks: monitoring/main.yml
-  tags: monitoring
+  tags: [monitoring, services]
 
 - name: Deploy communication services
   import_tasks: communication/main.yml
-  tags: communication
+  tags: [communication, services]

roles/docker/tasks/media/ghost-1.yml

@@ -1,19 +1,11 @@
-- name: make ghost-1 directories
-  ansible.builtin.file:
-    path: "{{ item}}"
-    state: directory
-  loop:
-    - /opt/stacks/ghost-1
-
-- name: Template out the compose file
-  ansible.builtin.template:
-    src: ghost-1-compose.yml.j2
-    dest: /opt/stacks/ghost-1/compose.yml
-    owner: root
-    mode: 644
-
-- name: deploy ghost-1 stack
+---
+- name: Stop and remove ghost stack
   community.docker.docker_compose_v2:
     project_src: /opt/stacks/ghost-1
-    files:
-    - compose.yml
+    state: absent
+  ignore_errors: true
+
+- name: Remove ghost directory
+  ansible.builtin.file:
+    path: /opt/stacks/ghost-1
+    state: absent

roles/docker/tasks/media/pinchflat.yml

@@ -1,19 +1,11 @@
-- name: make pinchflat directories
-  ansible.builtin.file:
-    path: "{{ item}}"
-    state: directory
-  loop:
-    - /opt/stacks/pinchflat
-
-- name: Template out the compose file
-  ansible.builtin.template:
-    src: pinchflat-compose.yml.j2
-    dest: /opt/stacks/pinchflat/compose.yml
-    owner: root
-    mode: 644
-
-- name: deploy pinchflat stack
+---
+- name: Stop and remove pinchflat stack
   community.docker.docker_compose_v2:
     project_src: /opt/stacks/pinchflat
-    files:
-    - compose.yml
+    state: absent
+  ignore_errors: true
+
+- name: Remove pinchflat directory
+  ansible.builtin.file:
+    path: /opt/stacks/pinchflat
+    state: absent

roles/docker/tasks/media/pinry.yml

@@ -1,19 +1,11 @@
-- name: make pinry directories
-  ansible.builtin.file:
-    path: "{{ item}}"
-    state: directory
-  loop:
-    - /opt/stacks/pinry
-
-- name: Template out the compose file
-  ansible.builtin.template:
-    src: pinry-compose.yml.j2
-    dest: /opt/stacks/pinry/compose.yml
-    owner: root
-    mode: 644
-
-- name: deploy pinry stack
+---
+- name: Stop and remove pinry stack
   community.docker.docker_compose_v2:
     project_src: /opt/stacks/pinry
-    files:
-    - compose.yml
+    state: absent
+  ignore_errors: true
+
+- name: Remove pinry directory
+  ansible.builtin.file:
+    path: /opt/stacks/pinry
+    state: absent

roles/docker/tasks/productivity/grocy.yml

@@ -1,18 +1,11 @@
 ---
-- name: Create grocy directories
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-  loop:
-    - /opt/stacks/grocy
-
-- name: Template grocy compose file
-  ansible.builtin.template:
-    src: grocy-compose.yml.j2
-    dest: /opt/stacks/grocy/compose.yml
-
-- name: Deploy grocy stack
+- name: Stop and remove grocy stack
   community.docker.docker_compose_v2:
     project_src: /opt/stacks/grocy
-    files:
-      - compose.yml
+    state: absent
+  ignore_errors: true
+
+- name: Remove grocy directory
+  ansible.builtin.file:
+    path: /opt/stacks/grocy
+    state: absent

roles/docker/tasks/productivity/kanboard.yml

@@ -1,18 +1,11 @@
 ---
-- name: Create kanboard directories
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-  loop:
-    - /opt/stacks/kanboard
-
-- name: Template kanboard compose file
-  ansible.builtin.template:
-    src: kanboard-compose.yml.j2
-    dest: /opt/stacks/kanboard/compose.yml
-
-- name: Deploy kanboard stack
+- name: Stop and remove kanboard stack
   community.docker.docker_compose_v2:
     project_src: /opt/stacks/kanboard
-    files:
-      - compose.yml
+    state: absent
+  ignore_errors: true
+
+- name: Remove kanboard directory
+  ansible.builtin.file:
+    path: /opt/stacks/kanboard
+    state: absent

roles/docker/tasks/productivity/mmdl.yml

@@ -1,25 +1,11 @@
 ---
-- name: Create mmdl directories
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-  loop:
-    - /opt/stacks/mmdl
-    - /opt/stacks/mmdl/data
-    - /opt/stacks/mmdl/mysql
-
-- name: Template mmdl environment file
-  ansible.builtin.template:
-    src: mmdl-env.j2
-    dest: /opt/stacks/mmdl/.env.local
-
-- name: Template mmdl compose file
-  ansible.builtin.template:
-    src: mmdl-compose.yml.j2
-    dest: /opt/stacks/mmdl/compose.yml
-
-- name: Deploy mmdl stack
+- name: Stop and remove mmdl stack
   community.docker.docker_compose_v2:
     project_src: /opt/stacks/mmdl
-    files:
-      - compose.yml
+    state: absent
+  ignore_errors: true
+
+- name: Remove mmdl directory
+  ansible.builtin.file:
+    path: /opt/stacks/mmdl
+    state: absent

roles/docker/tasks/productivity/palmr.yml

@@ -1,19 +1,11 @@
-- name: make palmr directories
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-  loop:
-    - /opt/stacks/palmr
-
-- name: Template out the compose file
-  ansible.builtin.template:
-    src: palmr-compose.yml.j2
-    dest: /opt/stacks/palmr/compose.yml
-    owner: root
-    mode: 644
-
-- name: deploy palmr stack
+---
+- name: Stop and remove palmr stack
   community.docker.docker_compose_v2:
     project_src: /opt/stacks/palmr
-    files:
-      - compose.yml
+    state: absent
+  ignore_errors: true
+
+- name: Remove palmr directory
+  ansible.builtin.file:
+    path: /opt/stacks/palmr
+    state: absent

roles/docker/templates/authentik-compose.yml.j2

@@ -37,7 +37,7 @@ services:
       glance.parent: authentik
       glance.name: Redis
   server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.8.3}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2.2}
     restart: unless-stopped
     command: server
     environment:
@@ -64,7 +64,7 @@ services:
       glance.description: Authentication server
       glance.id: authentik
   worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.8.3}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2.2}
     restart: unless-stopped
     command: worker
     environment:
@@ -103,4 +103,4 @@ volumes:
 networks:
   default:
     external: true
-    name: lava
+    name: lava

roles/docker/templates/bytestash-compose.yml.j2

@@ -26,7 +26,7 @@ services:
       glance.url: https://{{ subdomains.bytestash }}/
       glance.description: Code snippet manager
       glance.id: bytestash
-
+      mag37.dockcheck.update: true
 volumes:
   bytestash_data:
     driver: local
@@ -34,4 +34,4 @@ volumes:
 networks:
   default:
     external: true
-    name: {{ docker.network_name }}
+    name: {{ docker.network_name }}

roles/docker/templates/cronmaster-compose.yml.j2

@@ -25,8 +25,8 @@ services:
       glance.group: Infrastructure
       glance.parent: infrastructure
       glance.name: CronMaster
-
+      mag37.dockcheck.update: true
 networks:
   default:
     external: true
-    name: "{{ docker.network_name }}"
+    name: "{{ docker.network_name }}"

roles/docker/templates/glance-compose.yml.j2

@@ -16,8 +16,8 @@ services:
       glance.url: https://{{ subdomains.home }}/
       glance.description: Homepage app
       glance.id: glance
-
+      mag37.dockcheck.update: true
 networks:
   default:
     external: true
-    name: {{ docker.network_name }}
+    name: {{ docker.network_name }}

roles/docker/templates/glance.yml.j2

@@ -122,21 +122,16 @@ pages:
         - hoarder-app/hoarder
         - goauthentik/authentik
         - superseriousbusiness/gotosocial
-        - stonith404/pingvin-share
         - caddyserver/caddy
-        - gitroomhq/postiz-app
         - sabre-io/Baikal
         - janeczku/calibre-web
         - heyform/heyform
         - paperless-ngx/paperless-ngx
         - linuxserver/docker-calibre-web
-        - coder/code-server
         - dgtlmoon/changedetection.io
         - Freika/dawarich
         - manyfold3d/manyfold
         - caronc/apprise-api
-        - kieraneglin/pinchflat
-        - pinry/pinry
         - syncthing/syncthing
 
     - size: full

roles/docker/templates/gotify-compose.yml.j2

@@ -13,6 +13,7 @@ services:
       glance.icon: si:gotify
       glance.url: "https://{{ subdomains.gotify }}/"
       glance.description: Push notification server
+      mag37.dockcheck.update: true
     extra_hosts:
       - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
       - "{{ subdomains.gotify_assistant }}:{{ docker.hairpin_ip }}"
@@ -44,4 +45,4 @@ volumes:
 networks:
   default:
     external: true
-    name: "{{ docker.network_name }}"
+    name: "{{ docker.network_name }}"

roles/docker/templates/obsidian-livesync-compose.yml.j2

@@ -9,6 +9,7 @@ services:
       glance.url: http://{{ network.docker_host_ip }}:5984
       glance.description: Obsidian note synchronization
       glance.id: obsidian-livesync
+      mag37.dockcheck.update: true
     environment:
       - SERVER_DOMAIN={{ network.docker_host_ip }}
       - COUCHDB_USER={{ vault_obsidian.username }}
@@ -27,4 +28,4 @@ volumes:
 networks:
   default:
     external: true
-    name: "{{ docker.network_name }}"
+    name: "{{ docker.network_name }}"

roles/docker/templates/syncthing-compose.yml.j2

@@ -9,6 +9,7 @@ services:
       glance.url: https://netcup.porgy-porgy.ts.net:8384
       glance.description: Syncthing core
       glance.id: Syncthing
+      mag37.dockcheck.update: true
     environment:
       - PUID=1000
       - PGID=1000