added missing auto update labels

Add mag37.dockcheck.update labels to enable automated container update monitoring for:
- Gotify iOS assistant service
- Karakeep (Hoarder) bookmark manager and all components (Chrome, Meilisearch)
- MMDL task management service
- Postiz social media scheduler and all components (PostgreSQL, Redis)

This completes the rollout of dockcheck labels across all Docker services for consistent update monitoring.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

CLAUDE.local.md

@@ -0,0 +1,7 @@
+- the password for secrets.enc is in vault_pass
+- do not use the ansible-vault edit command
+- NEVER, EVER, EVER, USE, OPEN, OR TOUCH SECRETS.ENC
+- Whenever I talk about cron jobs I am referring to cron jobs on the remote servers managed by ansible, never the local machine
+- never use secrets.enc
+- all secrets go in vault.yml, never secrets.enc, never some random file you want to create, only ever vault.yml. you decrypt vault.yml with vault_pass
+- Never use ansible-vault edit. always decrypt, make the changes, then encrypt

roles/docker/tasks/monitoring/cronmaster.yml

@@ -0,0 +1,22 @@
+- name: make cronmaster directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/cronmaster
+    - /opt/stacks/cronmaster/scripts
+    - /opt/stacks/cronmaster/data
+    - /opt/stacks/cronmaster/snippets
+
+- name: Template out the compose file
+  ansible.builtin.template:
+    src: cronmaster-compose.yml.j2
+    dest: /opt/stacks/cronmaster/compose.yml
+    owner: root
+    mode: '0644'
+
+- name: deploy cronmaster stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/cronmaster
+    files:
+      - compose.yml

roles/docker/tasks/monitoring/main.yml

@@ -16,3 +16,7 @@
 - name: Install gotify
   import_tasks: gotify.yml
   tags: gotify
+
+- name: Install cronmaster
+  import_tasks: cronmaster.yml
+  tags: cronmaster

roles/docker/templates/appriseapi-compose.yml.j2

@@ -19,7 +19,7 @@ services:
       glance.url: https://{{ subdomains.appriseapi }}/
       glance.description: Apprise api server
       glance.id: apprise
-    
+      mag37.dockcheck.update: true
 volumes:
   config:
   attach:

roles/docker/templates/authentik-compose.yml.j2

@@ -37,7 +37,7 @@ services:
       glance.parent: authentik
       glance.name: Redis
   server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.3}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.8.4}
     restart: unless-stopped
     command: server
     environment:
@@ -64,7 +64,7 @@ services:
       glance.description: Authentication server
       glance.id: authentik
   worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.3}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.8.4}
     restart: unless-stopped
     command: worker
     environment:

roles/docker/templates/baikal-compose.yml.j2

@@ -10,7 +10,7 @@ services:
       glance.icon: si:protoncalendar
       glance.url: https://{{ subdomains.cal }}/
       glance.description: CalDav server
-
+      mag37.dockcheck.update: true
 volumes:
   config:
   data:

roles/docker/templates/bytestash-compose.yml.j2

@@ -26,7 +26,7 @@ services:
       glance.url: https://{{ subdomains.bytestash }}/
       glance.description: Code snippet manager
       glance.id: bytestash
-
+      mag37.dockcheck.update: true
 volumes:
   bytestash_data:
     driver: local

roles/docker/templates/cronmaster-compose.yml.j2

@@ -0,0 +1,32 @@
+services:
+  cronmaster:
+    image: ghcr.io/fccview/cronmaster:latest
+    container_name: cronmaster
+    restart: unless-stopped
+    user: "root"
+    privileged: true
+    pid: "host"
+    ports:
+      - "{{ network.docker_host_ip }}:40123:3000"
+    environment:
+      - DOCKER=true
+      - HOST_PROJECT_DIR=/opt/stacks/cronmaster/scripts
+      - HOST_CRONTAB_USER=root,phil
+      - AUTH_PASSWORD={{ vault_cronmaster.password }}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /opt/stacks/cronmaster/scripts:/app/scripts
+      - /opt/stacks/cronmaster/data:/app/data
+      - /opt/stacks/cronmaster/snippets:/app/snippets
+    labels:
+      glance.url: "http://{{ network.docker_host_ip }}:40123/"
+      glance.title: CronMaster
+      glance.description: Cron job management interface
+      glance.group: Infrastructure
+      glance.parent: infrastructure
+      glance.name: CronMaster
+      mag37.dockcheck.update: true
+networks:
+  default:
+    external: true
+    name: "{{ docker.network_name }}"

roles/docker/templates/dawarich-compose.yml.j2

@@ -36,7 +36,7 @@ services:
       timeout: 10s
 
   dawarich_app:
-    image: freikin/dawarich:0.28.1
+    image: freikin/dawarich:latest
     container_name: dawarich_app
     labels:
       glance.name: Dawarich
@@ -95,7 +95,7 @@ services:
           cpus: '0.50'
           memory: '2G'
   dawarich_sidekiq:
-    image: freikin/dawarich:0.28.1
+    image: freikin/dawarich:latest
     container_name: dawarich_sidekiq
     labels:
       glance.parent: dawarich

roles/docker/templates/glance-compose.yml.j2

@@ -16,7 +16,7 @@ services:
       glance.url: https://{{ subdomains.home }}/
       glance.description: Homepage app
       glance.id: glance
-
+      mag37.dockcheck.update: true
 networks:
   default:
     external: true

roles/docker/templates/gotify-compose.yml.j2

@@ -13,6 +13,7 @@ services:
       glance.icon: si:gotify
       glance.url: "https://{{ subdomains.gotify }}/"
       glance.description: Push notification server
+      mag37.dockcheck.update: true
     extra_hosts:
       - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
       - "{{ subdomains.gotify_assistant }}:{{ docker.hairpin_ip }}"
@@ -32,6 +33,7 @@ services:
       glance.icon: si:apple
       glance.url: "https://{{ subdomains.gotify_assistant }}/"
       glance.description: iOS notification assistant
+      mag37.dockcheck.update: true
     extra_hosts:
       - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
       - "{{ subdomains.gotify }}:{{ docker.hairpin_ip }}"

roles/docker/templates/gotosocial-compose.yml.j2

@@ -1,6 +1,6 @@
 services:
   gotosocial:
-    image: docker.io/superseriousbusiness/gotosocial:0.19.1
+    image: docker.io/superseriousbusiness/gotosocial:latest
     container_name: gotosocial
     user: 1000:1000
     extra_hosts:
@@ -44,23 +44,19 @@ services:
     labels:
       glance.parent: gotosocial
       glance.name: Backup
+      mag37.dockcheck.update: true
     environment:
-      BACKUP_FILENAME: backup-gts-%Y-%m-%dT%H-%M-%S.tar.gz
-      BACKUP_LATEST_SYMLINK: backup-latest.tar.gz
+      BACKUP_FILENAME: gts-backup-%Y-%m-%dT%H-%M-%S.tar.gz
       BACKUP_CRON_EXPRESSION: "0 9 * * *"
-      BACKUP_PRUNING_PREFIX: backup-
-      BACKUP_RETENTION_DAYS: 1
+      BACKUP_PRUNING_PREFIX: gts-
+      BACKUP_RETENTION_DAYS: 7
       AWS_S3_BUCKET_NAME: tsolbackups
       AWS_ENDPOINT: s3.us-west-004.backblazeb2.com 
       AWS_ACCESS_KEY_ID: {{ vault_backup.access_key_id }}
       AWS_SECRET_ACCESS_KEY: {{ vault_backup.secret_access_key }}
-      BACKUP_SKIP_BACKENDS_FROM_PRUNE: s3
-
-
     volumes:
-      - gotosocial:/backup/my-app-backup:ro
+      - gotosocial:/backup/gts-app-backup:ro
       - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ./backup:/archive
 
 volumes:
   gotosocial:

roles/docker/templates/hoarder-compose.yml.j2

@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   web:
-    image: ghcr.io/karakeep-app/karakeep:0.25.0
+    image: ghcr.io/karakeep-app/karakeep:latest
     restart: unless-stopped
     volumes:
       - data:/data
@@ -22,12 +22,14 @@ services:
       glance.url: https://{{ subdomains.bookmarks }}/
       glance.description: Bookmark manager
       glance.id: karakeep
+      mag37.dockcheck.update: true
   chrome:
     image: gcr.io/zenika-hub/alpine-chrome:123
     restart: unless-stopped
     labels:
       glance.name: Chrome
       glance.parent: karakeep
+      mag37.dockcheck.update: true
     command:
       - --no-sandbox
       - --disable-gpu
@@ -41,6 +43,7 @@ services:
     labels:
       glance.name: Meilisearch
       glance.parent: karakeep
+      mag37.dockcheck.update: true
     env_file:
       - .env
     environment:

roles/docker/templates/mmdl-compose.yml.j2

@@ -17,6 +17,7 @@ services:
       glance.url: https://{{ subdomains.tasks }}/
       glance.description: Task and calendar management
       glance.id: mmdl
+      mag37.dockcheck.update: true
 
   mmdl_db:
     image: mysql:8.0

roles/docker/templates/obsidian-livesync-compose.yml.j2

@@ -9,6 +9,7 @@ services:
       glance.url: http://{{ network.docker_host_ip }}:5984
       glance.description: Obsidian note synchronization
       glance.id: obsidian-livesync
+      mag37.dockcheck.update: true
     environment:
       - SERVER_DOMAIN={{ network.docker_host_ip }}
       - COUCHDB_USER={{ vault_obsidian.username }}

roles/docker/templates/paperlessngx-compose.yml.j2

@@ -57,6 +57,26 @@ services:
       glance.name: Tika
     restart: unless-stopped
 
+  backup:
+    image: offen/docker-volume-backup:v2
+    restart: always
+    labels:
+      glance.parent: paperlessngx
+      glance.name: Backup
+      mag37.dockcheck.update: true
+    environment:
+      BACKUP_FILENAME: pngx-backup-%Y-%m-%dT%H-%M-%S.tar.gz
+      BACKUP_CRON_EXPRESSION: "10 9 * * *"
+      BACKUP_PRUNING_PREFIX: pngx-
+      BACKUP_RETENTION_DAYS: 7
+      AWS_S3_BUCKET_NAME: tsolbackups
+      AWS_ENDPOINT: s3.us-west-004.backblazeb2.com 
+      AWS_ACCESS_KEY_ID: {{ vault_backup.access_key_id }}
+      AWS_SECRET_ACCESS_KEY: {{ vault_backup.secret_access_key }}
+    volumes:
+      - media:/backup/pngx-app-backup:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+
 volumes:
   data:
   media:

roles/docker/templates/postiz-compose.yml.j2

@@ -38,6 +38,7 @@ services:
       glance.url: https://{{ subdomains.post }}/
       glance.description: Social media scheduler
       glance.id: postiz
+      mag37.dockcheck.update: true
  
   postiz-postgres:
     image: postgres:14.5
@@ -57,6 +58,7 @@ services:
     labels:
       glance.parent: postiz
       glance.name: DB
+      mag37.dockcheck.update: true
   postiz-redis:
     image: redis:7.2
     container_name: postiz-redis
@@ -71,6 +73,7 @@ services:
     labels:
       glance.parent: postiz
       glance.name: Redis
+      mag37.dockcheck.update: true
 
  
  

roles/docker/templates/syncthing-compose.yml.j2

@@ -9,6 +9,7 @@ services:
       glance.url: https://netcup.porgy-porgy.ts.net:8384
       glance.description: Syncthing core
       glance.id: Syncthing
+      mag37.dockcheck.update: true
     environment:
       - PUID=1000
       - PGID=1000