feat: update container versions for Baikal, Karakeep, and Postiz

- Update Baikal to v0.10.1 (PostgreSQL support, PHP 8.4 compatibility) - Update Karakeep to v0.25.0 (Safari extension, PDF screenshots, bulk tag deletion) - Update Postiz to v1.48.4 (AI image generation, drag-drop uploads, enhanced platform support) All services tested and running successfully with no errors. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
fix: add NEXT_API_DEBUG_MODE environment variable to MMDL
2025-06-08 21:04:24 -06:00 · 2025-06-08 20:37:08 -06:00 · 2025-06-07 12:49:44 -06:00 · 2025-06-06 15:45:52 -06:00 · 2025-06-06 15:14:47 -06:00
55 changed files with 439 additions and 799 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,4 @@
 .python-version
 secrets.enc
 vault_pass
-DEPLOYMENT_LEARNINGS.md
-group_vars/all/vault.yml
+DEPLOYMENT_LEARNINGS.md
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co

 ## Overview

-This is a personal infrastructure Ansible playbook that automates deployment and management of 27 self-hosted Docker services across two domains (`thesatelliteoflove.com` and `nerder.land`). The setup uses Tailscale VPN for secure networking and Caddy for reverse proxy with automated HTTPS.
+This is a personal infrastructure Ansible playbook that automates deployment and management of 22+ self-hosted Docker services across two domains (`thesatelliteoflove.com` and `nerder.land`). The setup uses Tailscale VPN for secure networking and Caddy for reverse proxy with automated HTTPS.

 **Important**: Always review `DEPLOYMENT_LEARNINGS.md` when working on this repository for lessons learned and troubleshooting guidance.

@@ -28,18 +28,18 @@ ansible-playbook dns.yml -i hosts.yml
 ### Service Management
 ```bash
 # Deploy specific services using tags (now properly isolated)
-ansible-playbook site.yml -i hosts.yml --tags caddy --vault-password-file vault_pass
-ansible-playbook site.yml -i hosts.yml --tags authentik --vault-password-file vault_pass
-ansible-playbook site.yml -i hosts.yml --tags mmdl --vault-password-file vault_pass
-ansible-playbook site.yml -i hosts.yml --tags docker --vault-password-file vault_pass  # all docker services
+ansible-playbook site.yml -i hosts.yml --tags caddy --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags authentik --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags mmdl --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags docker --vault-password-file vault_pass --extra-vars "@secrets.enc"  # all docker services

 # Deploy services by category (new organized structure)
-ansible-playbook site.yml -i hosts.yml --tags infrastructure --vault-password-file vault_pass
-ansible-playbook site.yml -i hosts.yml --tags media,productivity --vault-password-file vault_pass
-ansible-playbook site.yml -i hosts.yml --tags development,monitoring --vault-password-file vault_pass
+ansible-playbook site.yml -i hosts.yml --tags infrastructure --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags media,productivity --vault-password-file vault_pass --extra-vars "@secrets.enc"
+ansible-playbook site.yml -i hosts.yml --tags development,monitoring --vault-password-file vault_pass --extra-vars "@secrets.enc"

 # Deploy only infrastructure components
-ansible-playbook site.yml -i hosts.yml --tags common,cron --vault-password-file vault_pass
+ansible-playbook site.yml -i hosts.yml --tags common,cron --vault-password-file vault_pass --extra-vars "@secrets.enc"
 ```

 ## Architecture
@@ -51,7 +51,7 @@ ansible-playbook site.yml -i hosts.yml --tags common,cron --vault-password-file
 ### Role Structure
 - **bootstrap**: Initial server hardening, user creation, Tailscale VPN setup
 - **common**: Basic system configuration, UFW firewall management
- **docker**: Comprehensive service deployment (24 containerized applications, organized by category)
+- **docker**: Comprehensive service deployment (22+ containerized applications, organized by category)
 - **cron**: Scheduled task management (currently Warhammer RSS feed generation)

 ### Docker Role Organization (Reorganized into Logical Categories)
@@ -60,15 +60,15 @@ The docker role is now organized into logical service groups under `roles/docker
 - **infrastructure/**: Core platform components
  - Caddy (reverse proxy), Authentik (SSO), Dockge (container management)
 - **development/**: Development and collaboration tools  
-  - Gitea, Code Server, ByteStash
+  - Gitea, Code Server, Matrix (Conduit)
 - **media/**: Content creation and consumption
-  - Audiobookshelf, Calibre, Ghost blog, Pinchflat, Pinry, Karakeep (formerly Hoarder), Manyfold
+  - Audiobookshelf, Calibre, Ghost blog, Pinchflat, Pinry, Karakeep, Manyfold
 - **productivity/**: Personal organization and document management
-  - Paperless-NGX, MMDL, Baikal (CalDAV/CardDAV), Syncthing, Heyform, Dawarich, Palmr, Obsidian LiveSync
+  - Paperless-NGX, MMDL, Baikal (CalDAV/CardDAV), Syncthing, Heyform, Dawarich, Pingvin
 - **communication/**: Social media and external communication
  - GoToSocial (Fediverse), Postiz (social media management)  
 - **monitoring/**: System monitoring and alerts
-  - Changedetection, Glance dashboard, AppriseAPI, Gotify
+  - Changedetection, Glance dashboard, AppriseAPI

 ### Variable Management
 **Critical**: This infrastructure uses a centralized variable hierarchy in `group_vars/all/`:
@@ -131,11 +131,7 @@ Common domains requiring hairpinning fixes:
 - **Dawarich**: Based on production compose file at https://github.com/Freika/dawarich/blob/master/docker/docker-compose.production.yml

 ## Service Memories
- palmr is the service that responds on files.thesatelliteoflove.com
- karakeep (formerly called hoarder) is deployed with both 'hoarder' and 'karakeep' tags for backward compatibility
- whenever i ask you what containers need updates, run dockcheck and return a list of containers needing updates
- when i ask for the status container updates i want you to run dockcheck on the docker host https://github.com/mag37/dockcheck?ref=selfh.st
- this is your reference for glance configuration https://github.com/glanceapp/glance/blob/main/docs/configuration.md#configuring-glance
+- pingvin is the service that responds on files.thesatelliteoflove.com

 ## Variable Management Implementation Notes
 **Major Infrastructure Update**: Variable management system was implemented to replace all hardcoded values with centralized variables.
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@ The playbook manages two main environments:

 ## Services Deployed

-The Docker role deploys and manages 27 self-hosted services organized into logical categories:
+The Docker role deploys and manages 22+ self-hosted services organized into logical categories:

 ### Infrastructure
 - **Caddy** (Reverse proxy with automatic HTTPS)
@@ -20,7 +20,7 @@ The Docker role deploys and manages 27 self-hosted services organized into logic
 ### Development
 - **Gitea** (Git repository hosting)
 - **Code Server** (VS Code in browser)
- **ByteStash** (Code snippet management)
+- **Matrix Conduit** (Communication/chat)

 ### Media
 - **Audiobookshelf** (Audiobook server)
@@ -28,7 +28,7 @@ The Docker role deploys and manages 27 self-hosted services organized into logic
 - **Ghost** (Blog platform)
 - **Pinchflat** (Media downloader)
 - **Pinry** (Pinterest-like board)
- **Hoarder** (Bookmark manager)
+- **Karakeep** (Bookmark manager)
 - **Manyfold** (3D model organizer)

 ### Productivity
@@ -38,8 +38,7 @@ The Docker role deploys and manages 27 self-hosted services organized into logic
 - **Syncthing** (File synchronization)
 - **HeyForm** (Form builder)
 - **Dawarich** (Location tracking)
- **Palmr** (File sharing)
- **Obsidian LiveSync** (Note synchronization)
+- **Pingvin Share** (File sharing)

 ### Communication
 - **GoToSocial** (Fediverse/Mastodon)
@@ -49,7 +48,6 @@ The Docker role deploys and manages 27 self-hosted services organized into logic
 - **Changedetection** (Website change monitoring)
 - **Glance** (Dashboard)
 - **AppriseAPI** (Notification service)
- **Gotify** (Push notifications)

 ## Structure

@@ -90,7 +88,7 @@ Manages scheduled tasks and automation:
 - Supports easy addition of new scheduled tasks

 ### [Docker Role](roles/docker/README.md)
-The most comprehensive role, deploying 25 containerized services organized into logical categories:
+The most comprehensive role, deploying 22+ containerized services organized into logical categories:
 - **Infrastructure**: Caddy reverse proxy, Authentik SSO, Dockge management
 - **Development**: Gitea, Code Server, Matrix communication
 - **Media**: Audiobookshelf, Calibre, Ghost blog, Pinchflat, and more
--- a/dns.yml
+++ b/dns.yml
@@ -27,8 +27,6 @@
            ip: "152.53.36.98"
          - name: "code"
            ip: "152.53.36.98"
-          - name: "snippets"
-            ip: "152.53.36.98"
          - name: cal
            ip: "152.53.36.98"
          - name: phlog
@@ -37,6 +35,8 @@
            ip: "152.53.36.98"
          - name: watcher
            ip: "152.53.36.98"
+          - name: chat
+            ip: "152.53.36.98"
          - name: models
            ip: "152.53.36.98"
          - name: tasks
@@ -47,16 +47,6 @@
            ip: "152.53.36.98"
          - name: bookmarks
            ip: "152.53.36.98"
-          - name: gotify
-            ip: "152.53.36.98"
-          - name: gotify-assistant
-            ip: "152.53.36.98"
-          - name: pdg
-            ip: "152.53.36.98"
-          - name: kanboard
-            ip: "152.53.36.98"
-          - name: grocy
-            ip: "152.53.36.98"
      - name: nerder.land
        dns_records:
          - name: "forms"
--- a/group_vars/all/domains.yml
+++ b/group_vars/all/domains.yml
@@ -21,7 +21,7 @@ subdomains:
  tasks: "tasks.{{ primary_domain }}"  # MMDL
  syncthing: "syncthing.{{ primary_domain }}"
  loclog: "loclog.{{ primary_domain }}"  # Dawarich
-  files: "files.{{ primary_domain }}"  # Palmr file sharing
+  files: "files.{{ primary_domain }}"  # Pingvin file sharing
  social: "social.{{ primary_domain }}"  # GoToSocial
  post: "post.{{ primary_domain }}"  # Postiz
  home: "home.{{ primary_domain }}"  # Glance
@@ -29,11 +29,7 @@ subdomains:
  appriseapi: "appriseapi.{{ primary_domain }}"
  dockge: "dockge.{{ primary_domain }}"
  code: "code.{{ primary_domain }}"  # Code Server
-  bytestash: "snippets.{{ primary_domain }}"  # ByteStash code snippets
-  gotify: "gotify.{{ primary_domain }}"  # Gotify notifications
-  gotify_assistant: "gotify-assistant.{{ primary_domain }}"  # iGotify iOS assistant
-  kanboard: "kanboard.{{ primary_domain }}"  # Kanboard project management
-  grocy: "grocy.{{ primary_domain }}"  # Grocy kitchen ERP
+  chat: "chat.{{ primary_domain }}"  # Conduit Matrix

 # Email domains for notifications
 email_domains:
--- a/group_vars/all/infrastructure.yml
+++ b/group_vars/all/infrastructure.yml
@@ -19,8 +19,4 @@ network:

 # Paths
 paths:
-  stacks: "{{ docker.stacks_path }}"
-
-# Notification services
-notifications:
-  appriseapi_endpoint: "http://apprise:8000/notify/apprise"
+  stacks: "{{ docker.stacks_path }}"
--- a/group_vars/all/vault.yml
+++ b/group_vars/all/vault.yml
@@ -0,0 +1,178 @@
+$ANSIBLE_VAULT;1.1;AES256
+36656631633631613335386230623438383533396639633766663966636134336662376337646537
+3735623737386630386463666563633961303235653962380a623065373135363239633931363365
+64303031653865663366363536316265376362623463383133326165353436363062643232356364
+3239373332393264630a623736313132306434333936306638393831636636316439396162643636
+34356631653265373835636563643631396162396533376430323538613462616535353134383732
+31656533633365616566373837633535396636656638313964346164363435303263333766323236
+35373965376630323235666562663539326162306436353934326664353264636436663063343932
+33383334336637626436383761393232383337303663653264363333323231653166633865326566
+63383763336335663932383530303338393937613334666564626136666366656561386231653030
+62323734393162373432363834613365616431326162306338303862663865396533643637343236
+39343337636239616430396533366362623236616166346364343166393731666364633664633639
+39666262323963393562353939396631326237323061396364663834356634353762323735343130
+38393462303561373065353034613339613130383534666265626539646465666339336432376334
+36346364626363666332303064396161303737383864633933653064623064303837373037346138
+32303937346432343038626562386232373633343164643065373833613031616162343432313666
+32613935373165643636653064653630366462313462376634323664343938616635666365326431
+62343966613361656161616530356564396231616166336363373864653166303534396431313732
+33363463613834393266363562346533626435313939373165633430356134343436613662636331
+35653866333034633436336130323835303362626238343831316339636135316266336662643136
+37633231393334666661303230656336343834643539373238333931316339623338323362343935
+33313731383965373930306135623864396162346334393466363435623334643464363163633731
+65313964613732336661626465666562643966336363336338633538336535623362376164643938
+62313665343434363436363338316433643835666536663734316534663238316264616239333531
+62306336393565623233386162333933613430343835616237303837343666623033363132353361
+64316135306563313833396437396633633139333963663564643965313232643364386465363438
+66393663356663666437663164373664633039653733393361333233663430356233316238666361
+66633835623436646362373233326433366533616335396166623833626431376663376138373839
+36396162366565343861626233326637313530663666623338653236656232343037343435323439
+62383563346230393266336138373763653235343839336536636634303765346463333832323831
+36633434663035376465376433343839343534343463353436623664333435333662326661346431
+36396463623731363761373264373761383931636338386135366236393434623261613131643165
+36613366663830666234393462386530626162623862363430306361373838363336313862313034
+34323562636631373766353635666462646533313863323831333136383937353163356436313930
+65633832303431386266356566333665303838393363306534623231393035316637346130653064
+61373361333366373031646538333661383133376138393431663732353735643061303139653765
+30613733636161366465376438636237663361646138323337666463396535346339306230313135
+63633731343735663166616533623962343033396266623061373065306638613230653933626537
+32396235313134663731616564393837626666613539363531623665353432366564306661373538
+30616337323232663462616563366362616264383037356233626232353137386261626235333238
+61633935343766326637373632363236383637643064396366353137376137346334346432313439
+31326364633739363164386334376432633532643635343734306433636436386239346138376365
+61333864373961313565383533343738363537356466396464666363316166653662626430626139
+32353063636136643830343161616563663365393439323765323235373966393232623166366335
+61303331353232366237613061333863373232373763613130636462633863646137623461383339
+64356262393061616562636331636439623365663762313139376163656137393463303065383235
+63613331626538613737666234623330623462646639326139346164333365313233326539383963
+39346636653962623538643666623261396564613734626533343932643464343762366436383666
+36333230386438633435643434386566313835626432663331313231666432306363373530633562
+30346563626639353061393764346437666264333635613131356464333530633266643838623933
+33613733653264323438333363613737326439393764613238316665313764643835303565663462
+36633361653339306335383865663330616265623462613162336132633630353261313462616363
+33623261656432636232653961306535343633386466376130343264366662396162666365653231
+35343132373865656531646234333763393934333433376563356632313664656331616264313861
+61303263373364633663666133616332653665613362356238633865636361653830316462333063
+38303634373566313966633865303763666538613966323037656339373837383833326130313037
+35653666353864343734646161363061663331306262313764653864356261306465616664393339
+31353039636131643961323132643834343030326430343433393034663162303633356666386462
+66623166623135653938336532636434613431633366626637306563386434613738383937643937
+39636531646139633037386462383261663164653466383739373564633563646164643166336539
+30313162356331333538336235306163303366396262313366376531323833373430386162313962
+64313265393836343031656339393162313162303835386230313834383030653361363430663532
+37613631633232333964333636646636356532653065363639336234303761346435613831343835
+62376633643166643437626537346164326133396532393232333365316335393239333230343062
+61656534616536373164343064313061366538363961646533623265666663626439333266363466
+37336331333333366530636634323938653363643237343465653733656563346532623633636138
+38353761383562353434666438646436653033613761383466383962626134366237346530666539
+66353837613361313861353631613934376435343765396332353532326439663836333365386234
+32396339373765643731303738336330613066386362316538396136346236393630333939343939
+34663231363561333836636562666639346463666565613730613837663138333730303330653166
+61363763663631653061623333666437346463376264656338363462666130323031306636646532
+39343764303432346530666630316330666136346432396439343334333532363165666362356234
+64373936316438323230396263393739313665386663656263396335383461643030363463646434
+65353633636336623661616466303061376438663636656238343464366664393438633837393538
+61636461663930623661336432306237353239306334626430633662623034316635323936303534
+33663732613438353832316531353933303236306531393639633566643631356330646365333035
+38343933633139643965303864653263663965323465343331323666323239353666346336356134
+36623038393533646566303066383566323235396434663939393661356638623663653530366663
+65393934373537663265336139303033386631633038656564646438306362633230373930636335
+35353833643731373963313563613164383063666335636639656338316437393336323234393239
+63326361616161373966303663373537393462633264613639643262393163343363646163373961
+33306532636431633436633661333232303231653065653264323961303031316164653366353865
+33643437663532313638333661633464373732383838363439623235636261373839663533656362
+39373035393664336261643866623531343437666366313938376461646435333731326464613739
+39353335643766383162313161393339363465333464663335393830313638656633376466333236
+39376534613530336632373662366365343365343438666465343063653632333236343066353562
+39613864346634656233326261306231663436666339393762356531656164383531623032626537
+62363732343237656230383535343133343437643464663337623735326635353762313133313438
+61663339666537386365353335656237316336373732333330616435353461646637363362316637
+30343062643863663738373732393236666166336235333637393364376366663136356166333831
+35373534656430643030323638663933383766623533393832616461363536343361313336303030
+37636432373137346363626264616432373861663739303263393837643565623766313932303337
+62353230353065383930366532336336326437376339613933653137326166643532376238383330
+64356435386330613262363461623338656565666639386634613538373063323532316638623736
+63643461613833306161383237653161353537303036303238323234353934633032656631646139
+32633766623434666661366365346638313033613530336164653130646466373362646139333761
+65316337373766326262383932373965303532353133303331653965313136323364323230663566
+62323866366537343862343533373734383839326261383938313066643934626562663334643135
+36666435373138656562613335666230333534323432303932613364316666326239313230326230
+65653236353761306232346537653431306264353464633765346366336236396263363332383062
+30323035336165636236656262323231383539323166346534373532613439386466633039333338
+31626432366363306264626233306261613634343333366563623738336637643836343434306462
+30626535386230623838633430393466386561663062366439303337643536316237343738643331
+38616533653030363132356134356461366365633337646632663266333865313733376335333364
+66303135643932656265626164373264303263363534303161306366393835313663636164346133
+33383362653764303637343531626362336632613532313662303864626235626638653136366665
+65306530306462613937353631363931626261333634626665663739333562313536353938313134
+37343833653764663035313433633931303639656166636232353937346530373365376536616432
+39353933346532383730663637633964656535333034643832306365306432396463316538313731
+38323837653936323231306438383136373232663437646135326134633266613237393639613339
+31633633666361356366376635643631353938343861666531383664343236366661313530316166
+66313637626665626136613732323237396231316633666264613130613032666362313566653565
+30363333313933393835636431653931383031636138376662326437333435323035666661646666
+61636665613839346530623464326135643834313533323032643335636663623265326162323766
+37333233313962396138336665393438313937383731343739626134643230393766303662386131
+32623336303736653736353438623561613061306130383535303836643138613931373336626565
+34643533393936336262633239376135356632613061633962633762356637303032643435346263
+64356132666636636262363864303236623263343833643134656433646134356439646665323365
+65333733636330323766616539626635303364376431396531633131366333636636626339303363
+31613836363531653034346530333236313531363737356538313931316130323631376164396438
+66306563333561636133613462336331376363303431343761633265346338663836643337633137
+36383064383862636363303562353861643065613564646661633130623763303637343066373763
+35376136383438316233303936613637393230613339343932393533653661326164643430356535
+37373834646437613539343437316639663665656565633836653532346532636466616530383036
+38373035356665643863323666376337653930626663636631396662356165663734353539373464
+36393138613063326130623266356431663839636266623830306136653530623035623562613763
+31643038323332666632323433646139643766363737656262336334336538343066663438393261
+37626438386130323566356231656434326336333631643334303764343535306265633438353366
+62633363363762643331623165316265376363366639303532373236313961333462343362653565
+64313061376261356438316638653633376231363830303137316663666661663539323932396531
+30373738356330343336623731353030303434393739613531303034313136353164363962663538
+65646432346265393938656162313835326337653431326133343632633265376663303032636539
+62623932383462356134316637373832303863653733383133616138303264633165313461353139
+63326138366530363930333337333939663763633764646437616438383239313433323463393734
+63363339636536323561363062653238373133306661626235396234383138346137653161316238
+36333235663063356636363737663862323061326335383738383133386161393835393462656136
+38633635343561303634393430393738613330303535363561333739373963313930396263373535
+65396333386662663065656331643330386633643835323365363133396364646130666131666339
+63626166366662383531623830626664656239333562323166366431663661646331326432656537
+32643137666662313738373863303239336638363266623561636561333261613131383134343533
+64386362666235643734393738343036313664333539376166396132333131636538653030643136
+38646331363633383332313937323535396564303336303531316339383130653734623633626534
+62346136346533373037663632353836343332346233386634663534303133393964346139336130
+64643662613332306363643139653135323633613635303065336636636333376562366665373163
+65376338313264316464636162313337363439366165336137613235313466633638393836366265
+62333134393038653133383366626637313066393863303663303539643462633264653837393232
+30376331306662393431613135613366616537393162663266653034656661633236323566623963
+32313465333539333562363639663162393835373739366134363536393035616231376138373261
+39316366393562303566366533336563313937373864643732613266653239353335363031376362
+62623236346232333466613264303434653430636137386637303765303031666230303630323430
+37363331396163643963346637616665343366313736646437313234323132356565623730323334
+64613330656637326633306266373537613437366133393031656239316465636531623464323034
+32373237623864303437616363613063663233663864393462613433616333396431653563373338
+32663832396231313633316262343832653439653230316565663635376565393265356563356561
+37316432303839336533643761626635353935313632333065373063386635363934326431646535
+65353965363562653637646137383366636463336632376230373330333233393234656636363139
+63613633313834356236666638623764396164633466336164346139643631316234666434316663
+30626262353738313264636565626664363039356136306361626466356461656331336430643335
+61613363363837383430623765343863386331323437383235393933653237373465383066393439
+62613562356537616133613034663963626662333638353639396432656539633466303437393436
+33396330663133623961376462316630363431306436386137313238303431393734636262323335
+39386234323734313530363564303331623864616537346335633736376665636132376230386234
+35623733663362343165653330626635306330396237323861313530636465336437306262343238
+63373237303337316562633065633533383163373034373734346562363531393334336239306139
+65636362653238356439643038376362356338326235373337313930633337316565376131326231
+34313866336265666133643965383765343366643034373334343331373363663736643638313033
+35396239396537343230376466386133313365323732333063663066393331336133313035383064
+33633734633836613431636166666232663037626131313834336264636438303435633434646638
+64366463616365643864396533663061346262303631386134653465653933353437343134363361
+34626431643438633638333566306563396337336533653532633961336635623231393431306232
+32613831653762616264303939636264633931316432613138653039366331323739393431656263
+33623138383161646134633666623366366361373836666138633837393961623566356266663661
+33353437363334373135323835333163363939393765636264333039623663633632363533356537
+63303638656235653739326432363164343236343430636436626232313864396565363066656135
+38386535636231386166633635333837643630383765346333626136623362366232643065313938
+31613537386262336661633637666639626332343532653839313134656338343531383466616230
+63313036646533376639336439366539346132373939386634656235323836633630333265386165
+39623637306562626534353930633361323532636361393562353931336661373531
--- a/group_vars/docker/services.yml
+++ b/group_vars/docker/services.yml
@@ -3,11 +3,11 @@
 # Service categories for organization
 service_categories:
  infrastructure: ["caddy", "authentik", "dockge"]
-  development: ["gitea", "codeserver"]
+  development: ["gitea", "codeserver", "conduit"]
  media: ["audiobookshelf", "calibre", "ghost", "pinchflat", "pinry", "hoarder", "manyfold"]
  productivity: ["paperlessngx", "baikal", "syncthing", "mmdl", "heyform", "dawarich", "pingvin"]
  communication: ["gotosocial", "postiz"]
-  monitoring: ["glance", "changedetection", "appriseapi", "gotify"]
+  monitoring: ["glance", "changedetection", "appriseapi"]

 # Common service configuration
 services:
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -1,8 +1,6 @@
- name: Install common packages
+- name: Install aptitude
  apt:
-    name: 
-      - aptitude
-      - jq
+    name: aptitude
    state: latest
    update_cache: true

--- a/roles/cron/handlers/main.yml
+++ b/roles/cron/handlers/main.yml
@@ -1,6 +0,0 @@
---
-# Handler to restart systemd-journald service
- name: restart rsyslog
-  systemd:
-    name: systemd-journald
-    state: restarted
--- a/roles/cron/tasks/main.yml
+++ b/roles/cron/tasks/main.yml
@@ -1,7 +1,4 @@
 ---
-# Enable cron logging in systemd-journald (already enabled by default)
-# We'll rely on journalctl for cron execution logs
-
 # Ensure the script is copied to the target machine
 - name: Copy the warhammer feed update script
  copy:
@@ -19,97 +16,3 @@
    hour: "9"
    user: root
    job: "/usr/local/bin/update_warhammer_feed.sh"
-
-# Create .local/bin directory for phil user
- name: Ensure .local/bin directory exists for phil
-  file:
-    path: /home/phil/.local/bin
-    state: directory
-    mode: '0755'
-    owner: phil
-    group: phil
-
-# Install dockcheck script in phil's .local/bin
- name: Download dockcheck.sh script
-  get_url:
-    url: https://raw.githubusercontent.com/mag37/dockcheck/main/dockcheck.sh
-    dest: /home/phil/.local/bin/dockcheck.sh
-    mode: '0755'
-    owner: phil
-    group: phil
-
-# Create .config directory for phil user
- name: Ensure .config directory exists for phil
-  file:
-    path: /home/phil/.config
-    state: directory
-    mode: '0755'
-    owner: phil
-    group: phil
-
-# Create notify_templates directory alongside dockcheck.sh
- name: Ensure notify_templates directory exists in .local/bin
-  file:
-    path: /home/phil/.local/bin/notify_templates
-    state: directory
-    mode: '0755'
-    owner: phil
-    group: phil
-
-# Download notify_v2.sh script for dockcheck notifications
- name: Download notify_v2.sh script
-  get_url:
-    url: https://raw.githubusercontent.com/mag37/dockcheck/main/notify_templates/notify_v2.sh
-    dest: /home/phil/.local/bin/notify_templates/notify_v2.sh
-    mode: '0755'
-    owner: phil
-    group: phil
-
-# Download notify_gotify.sh script for dockcheck notifications
- name: Download notify_gotify.sh script
-  get_url:
-    url: https://raw.githubusercontent.com/mag37/dockcheck/main/notify_templates/notify_gotify.sh
-    dest: /home/phil/.local/bin/notify_templates/notify_gotify.sh
-    mode: '0755'
-    owner: phil
-    group: phil
-
-# Template dockcheck configuration file
- name: Template dockcheck configuration
-  template:
-    src: dockcheck.config.j2
-    dest: /home/phil/.config/dockcheck.config
-    mode: '0644'
-    owner: phil
-    group: phil
-
-# Create log directory for dockcheck
- name: Create dockcheck log directory
-  file:
-    path: /var/log/dockcheck
-    state: directory
-    mode: '0755'
-    owner: phil
-    group: phil
-
-# Create dockcheck wrapper script to avoid cron escaping issues
- name: Create dockcheck wrapper script
-  copy:
-    dest: /home/phil/.local/bin/run_dockcheck.sh
-    mode: '0755'
-    owner: phil
-    group: phil
-    content: |
-      #!/bin/bash
-      cd /home/phil
-      /home/phil/.local/bin/dockcheck.sh >> /var/log/dockcheck/dockcheck.log 2>&1
-      echo "$(date "+%Y-%m-%d %H:%M:%S") - Dockcheck completed with exit code $?" >> /var/log/dockcheck/dockcheck.log
-
-# Create cron job for dockcheck as phil user with logging
- name: Create cron job for dockcheck container updates
-  cron:
-    name: "Check Docker container updates"
-    minute: "0"
-    hour: "8"
-    user: phil
-    job: "/home/phil/.local/bin/run_dockcheck.sh"
--- a/roles/cron/templates/dockcheck.config.j2
+++ b/roles/cron/templates/dockcheck.config.j2
@@ -1,18 +0,0 @@
-# Dockcheck Configuration - Check only, no updates
-# Don't update, just check for updates
-# DontUpdate=true
-OnlyLabel=true
-AutoMode=true 
-
-# Enable notifications
-Notify=true
-
-# Exclude containers from checking
-Exclude="authentik-postgresql-1,dawarich_redis,dawarich_db"
-
-# Notification channels
-NOTIFY_CHANNELS="gotify"
-
-# Gotify notification configuration
-GOTIFY_DOMAIN="https://{{ subdomains.gotify }}"
-GOTIFY_TOKEN="{{ vault_dockcheck.gotify_token }}"
--- a/roles/docker/README.md
+++ b/roles/docker/README.md
@@ -1,7 +1,7 @@
 # Docker Role

 ## Purpose
-Deploys and manages a comprehensive self-hosted infrastructure with 24 containerized services organized into logical categories, transforming a server into a personal cloud platform with authentication, media management, productivity tools, and development services.
+Deploys and manages a comprehensive self-hosted infrastructure with 22+ containerized services organized into logical categories, transforming a server into a personal cloud platform with authentication, media management, productivity tools, and development services.

 ## Architecture Overview

@@ -28,7 +28,7 @@ Deploys and manages a comprehensive self-hosted infrastructure with 24 container
 ### Development (`development/`)
 - **Gitea** - Self-hosted Git with CI/CD runners
 - **Code Server** - VS Code in the browser
- **ByteStash** - Code snippet management and organization
+- **Conduit** - Matrix homeserver for communication

 ### Media (`media/`)
 - **Audiobookshelf** - Audiobook and podcast server
@@ -46,8 +46,7 @@ Deploys and manages a comprehensive self-hosted infrastructure with 24 container
 - **Syncthing** - Decentralized file sync
 - **Heyform** - Form builder and surveys
 - **Dawarich** - Location tracking
- **Palmr** - File sharing service
- **Obsidian LiveSync** - CouchDB backend for note synchronization
+- **Pingvin Share** - File sharing service

 ### Communication (`communication/`)
 - **GoToSocial** - Lightweight ActivityPub server
@@ -57,7 +56,6 @@ Deploys and manages a comprehensive self-hosted infrastructure with 24 container
 - **Glance** - Customizable dashboard with monitoring
 - **Change Detection** - Website monitoring
 - **Apprise API** - Unified notifications
- **Gotify** - Self-hosted push notification service

 ## Deployment Patterns

@@ -94,7 +92,8 @@ roles/docker/
 │   ├── development/
 │   │   ├── main.yml               # Development category orchestrator
 │   │   ├── gitea.yml              # Git hosting
-│   │   └── codeserver.yml         # VS Code server
+│   │   ├── codeserver.yml         # VS Code server
+│   │   └── conduit.yml            # Matrix server
 │   ├── media/                     # Media services (7 services)
 │   ├── productivity/              # Productivity services (7 services)
 │   ├── communication/             # Communication services (2 services)
--- a/roles/docker/files/Caddyfile
+++ b/roles/docker/files/Caddyfile
@@ -40,30 +40,6 @@ tasks.thesatelliteoflove.com {
    reverse_proxy mmdl:3000
 }

-kanboard.thesatelliteoflove.com {
-    reverse_proxy kanboard:80
-}
-
-grocy.thesatelliteoflove.com {
-    # API endpoints bypass forward auth for mobile apps
-    handle /api/* {
-        reverse_proxy grocy:80
-    }
-    
-    # Web interface requires Authentik authentication
-    forward_auth authentik-server-1:9000 {
-        uri /outpost.goauthentik.io/auth/caddy
-        copy_headers {
-            X-authentik-username
-            X-authentik-groups  
-            X-authentik-email
-            X-authentik-name
-            X-authentik-uid
-        }
-    }
-    reverse_proxy grocy:80
-}
-
 phlog.thesatelliteoflove.com {
    reverse_proxy ghost-1-ghost-1:2368
 }
@@ -73,12 +49,8 @@ code.thesatelliteoflove.com {
    reverse_proxy authentik-server-1:9000
 }

-snippets.thesatelliteoflove.com {
-    reverse_proxy bytestash:5000
-}
-
 files.thesatelliteoflove.com {
-    reverse_proxy palmr-palmr-1:5487
+    reverse_proxy pingvin-pingvin-share-1:3000
 }

 git.thesatelliteoflove.com {
@@ -92,6 +64,15 @@ thesatelliteoflove.com {
    file_server
 }

+chat.thesatelliteoflove.com, chat.thesatelliteoflove.com:8448 {
+    handle /.well-known/* {
+        root * /srv/matrix
+        file_server
+    }
+    reverse_proxy /_matrix/* conduit-homeserver-1:6167
+}
+
+
 bookmarks.thesatelliteoflove.com {
    reverse_proxy hoarder-web-1:3000
 }
@@ -109,25 +90,6 @@ home.thesatelliteoflove.com {
    reverse_proxy authentik-server-1:9000
 }

-gotify.thesatelliteoflove.com {
-    reverse_proxy gotify:80
-}
-
-gotify-assistant.thesatelliteoflove.com {
-    reverse_proxy igotify-assistant:8080
-}
-
-pdg.thesatelliteoflove.com {
-    root * /srv/pdg
-    try_files {path} {path}.html {path}/ =404
-    file_server
-    encode gzip
- 
-    handle_errors {
-        rewrite * /{err.status_code}.html
-        file_server
-    }
-}

 repair.nerder.land {
    root * /srv/repair
--- a/roles/docker/files/client
+++ b/roles/docker/files/client
@@ -0,0 +1,5 @@
+{
+    "m.homeserver": {
+        "base_url": "https://chat.thesatelliteoflove.com"
+    }
+}
--- a/roles/docker/files/server
+++ b/roles/docker/files/server
@@ -0,0 +1,3 @@
+{
+    "m.server": "chat.thesatelliteoflove.com:443"
+}
--- a/roles/docker/handlers/main.yml
+++ b/roles/docker/handlers/main.yml
@@ -11,11 +11,4 @@
    project_src: /opt/stacks/caddy
    files:
      - compose.yml
-    state: restarted
-
- name: restart obsidian-livesync
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/obsidian-livesync
-    files:
-      - docker-compose.yml
    state: restarted
--- a/roles/docker/tasks/development/conduit.yml
+++ b/roles/docker/tasks/development/conduit.yml
@@ -0,0 +1,29 @@
+- name: make conduit directories
+  ansible.builtin.file:
+    path: "{{ item}}"
+    state: directory
+  loop:
+    - /opt/stacks/conduit
+
+- name: copy well-known files
+  ansible.builtin.copy:
+    src: "{{item}}"
+    dest: /opt/stacks/caddy/site/matrix/
+    owner: root
+    mode: 644
+  loop:
+    - client
+    - server
+
+- name: Template out the compose file
+  ansible.builtin.template:
+    src: conduit-compose.yml.j2
+    dest: /opt/stacks/conduit/compose.yml
+    owner: root
+    mode: 644
+
+- name: deploy conduit stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/conduit
+    files:
+    - compose.yml
--- a/roles/docker/tasks/development/main.yml
+++ b/roles/docker/tasks/development/main.yml
@@ -9,7 +9,6 @@
  import_tasks: codeserver.yml
  tags: codeserver

- name: Install bytestash
-  import_tasks: bytestash.yml
-  tags: bytestash
-
+- name: Install conduit
+  import_tasks: conduit.yml
+  tags: conduit
--- a/roles/docker/tasks/monitoring/gotify.yml
+++ b/roles/docker/tasks/monitoring/gotify.yml
@@ -1,19 +0,0 @@
- name: Create gotify directories
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-  loop:
-    - /opt/stacks/gotify
-
- name: Template out the gotify compose file
-  ansible.builtin.template:
-    src: gotify-compose.yml.j2
-    dest: /opt/stacks/gotify/compose.yml
-    owner: root
-    mode: 644
-
- name: Deploy gotify stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/gotify
-    files:
-      - compose.yml
--- a/roles/docker/tasks/monitoring/main.yml
+++ b/roles/docker/tasks/monitoring/main.yml
@@ -11,8 +11,4 @@

 - name: Install appriseapi
  import_tasks: appriseapi.yml 
-  tags: appriseapi
-
- name: Install gotify
-  import_tasks: gotify.yml
-  tags: gotify
+  tags: appriseapi
--- a/roles/docker/tasks/productivity/grocy.yml
+++ b/roles/docker/tasks/productivity/grocy.yml
@@ -1,18 +0,0 @@
---
- name: Create grocy directories
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-  loop:
-    - /opt/stacks/grocy
-
- name: Template grocy compose file
-  ansible.builtin.template:
-    src: grocy-compose.yml.j2
-    dest: /opt/stacks/grocy/compose.yml
-
- name: Deploy grocy stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/grocy
-    files:
-      - compose.yml
--- a/roles/docker/tasks/productivity/kanboard.yml
+++ b/roles/docker/tasks/productivity/kanboard.yml
@@ -1,18 +0,0 @@
---
- name: Create kanboard directories
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-  loop:
-    - /opt/stacks/kanboard
-
- name: Template kanboard compose file
-  ansible.builtin.template:
-    src: kanboard-compose.yml.j2
-    dest: /opt/stacks/kanboard/compose.yml
-
- name: Deploy kanboard stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/kanboard
-    files:
-      - compose.yml
--- a/roles/docker/tasks/productivity/main.yml
+++ b/roles/docker/tasks/productivity/main.yml
@@ -25,18 +25,6 @@
  import_tasks: dawarich.yml
  tags: dawarich

- name: Install palmr
-  import_tasks: palmr.yml
-  tags: palmr
-
- name: Install obsidian-livesync
-  import_tasks: obsidian-livesync.yml
-  tags: obsidian-livesync
-
- name: Install kanboard
-  import_tasks: kanboard.yml
-  tags: kanboard
-
- name: Install grocy
-  import_tasks: grocy.yml
-  tags: grocy
+- name: Install pingvin
+  import_tasks: pingvin.yml
+  tags: pingvin
--- a/roles/docker/tasks/productivity/obsidian-livesync.yml
+++ b/roles/docker/tasks/productivity/obsidian-livesync.yml
@@ -1,20 +0,0 @@
---
- name: make obsidian-livesync directories
-  ansible.builtin.file:
-    path: "{{ paths.stacks }}/obsidian-livesync"
-    state: directory
-    mode: '0755'
-
- name: Template out the compose file
-  ansible.builtin.template:
-    src: obsidian-livesync-compose.yml.j2
-    dest: "{{ paths.stacks }}/obsidian-livesync/docker-compose.yml"
-    mode: '0644'
-  notify: restart obsidian-livesync
-
- name: deploy obsidian-livesync stack
-  community.docker.docker_compose_v2:
-    project_src: "{{ paths.stacks }}/obsidian-livesync"
-    state: present
-  tags:
-    - obsidian-livesync
--- a/roles/docker/tasks/productivity/palmr.yml
+++ b/roles/docker/tasks/productivity/palmr.yml
@@ -1,19 +0,0 @@
- name: make palmr directories
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-  loop:
-    - /opt/stacks/palmr
-
- name: Template out the compose file
-  ansible.builtin.template:
-    src: palmr-compose.yml.j2
-    dest: /opt/stacks/palmr/compose.yml
-    owner: root
-    mode: 644
-
- name: deploy palmr stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/palmr
-    files:
-      - compose.yml
--- a/roles/docker/tasks/development/bytestash.yml
+++ b/roles/docker/tasks/development/bytestash.yml
@@ -1,19 +1,19 @@
- name: make bytestash directories
+- name: make pingvin directories
  ansible.builtin.file:
    path: "{{ item}}"
    state: directory
  loop:
-    - /opt/stacks/bytestash
+    - /opt/stacks/pingvin

 - name: Template out the compose file
  ansible.builtin.template:
-    src: bytestash-compose.yml.j2
-    dest: /opt/stacks/bytestash/compose.yml
+    src: pingvin-compose.yml.j2
+    dest: /opt/stacks/pingvin/compose.yml
    owner: root
    mode: 644

- name: deploy bytestash stack
+- name: deploy pingvin stack
  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/bytestash
+    project_src: /opt/stacks/pingvin
    files:
    - compose.yml
--- a/roles/docker/templates/appriseapi-compose.yml.j2
+++ b/roles/docker/templates/appriseapi-compose.yml.j2
@@ -11,15 +11,13 @@ services:
      - plugin:/plugin
      - attach:/attach
    image: caronc/apprise:latest
-    extra_hosts:
-      - "{{ subdomains.gotify }}:{{ docker.hairpin_ip }}"
    labels:
      glance.name: Apprise
      glance.icon: si:imessage
      glance.url: https://{{ subdomains.appriseapi }}/
      glance.description: Apprise api server
      glance.id: apprise
-      mag37.dockcheck.update: true
+    
 volumes:
  config:
  attach:
--- a/roles/docker/templates/audiobookshelf-compose.yml.j2
+++ b/roles/docker/templates/audiobookshelf-compose.yml.j2
@@ -16,7 +16,6 @@ services:
      glance.icon: si:audiobookshelf
      glance.url: https://{{ subdomains.audio }}/
      glance.description: Audio book server
-      mag37.dockcheck.update: true
 volumes:
  audiobooks:
    driver: local
--- a/roles/docker/templates/authentik-compose.yml.j2
+++ b/roles/docker/templates/authentik-compose.yml.j2
@@ -37,7 +37,7 @@ services:
      glance.parent: authentik
      glance.name: Redis
  server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.4}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.1}
    restart: unless-stopped
    command: server
    environment:
@@ -64,7 +64,7 @@ services:
      glance.description: Authentication server
      glance.id: authentik
  worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.4}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.1}
    restart: unless-stopped
    command: worker
    environment:
--- a/roles/docker/templates/baikal-compose.yml.j2
+++ b/roles/docker/templates/baikal-compose.yml.j2
@@ -10,7 +10,7 @@ services:
      glance.icon: si:protoncalendar
      glance.url: https://{{ subdomains.cal }}/
      glance.description: CalDav server
-      mag37.dockcheck.update: true
+
 volumes:
  config:
  data:
--- a/roles/docker/templates/bytestash-compose.yml.j2
+++ b/roles/docker/templates/bytestash-compose.yml.j2
@@ -1,37 +0,0 @@
-services:
-  bytestash:
-    image: ghcr.io/jordan-dalby/bytestash:latest
-    container_name: bytestash
-    restart: unless-stopped
-    volumes:
-      - bytestash_data:/data/snippets
-    environment:
-      JWT_SECRET: "{{ vault_bytestash.jwt_secret }}"
-      TOKEN_EXPIRY: "24h"
-      ALLOW_NEW_ACCOUNTS: "true"
-      DEBUG: "false"
-      DISABLE_ACCOUNTS: "false"
-      DISABLE_INTERNAL_ACCOUNTS: "false"
-      OIDC_ENABLED: "true"
-      OIDC_DISPLAY_NAME: "Login with Authentik"
-      OIDC_ISSUER_URL: "https://{{ subdomains.auth }}/application/o/bytestash/"
-      OIDC_CLIENT_ID: "{{ vault_bytestash.oidc_client_id }}"
-      OIDC_CLIENT_SECRET: "{{ vault_bytestash.oidc_client_secret }}"
-      OIDC_SCOPES: "openid profile email"
-    extra_hosts:
-      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
-    labels:
-      glance.name: ByteStash
-      glance.icon: si:code
-      glance.url: https://{{ subdomains.bytestash }}/
-      glance.description: Code snippet manager
-      glance.id: bytestash
-
-volumes:
-  bytestash_data:
-    driver: local
-
-networks:
-  default:
-    external: true
-    name: {{ docker.network_name }}
--- a/roles/docker/templates/caddy-compose.yml.j2
+++ b/roles/docker/templates/caddy-compose.yml.j2
@@ -18,7 +18,6 @@ services:
      glance.icon: si:caddy
      glance.url: https://{{ primary_domain }}/
      glance.description: Reverse proxy
-      mag37.dockcheck.update: true
    networks:
      default:
        ipv4_address: {{ docker.hairpin_ip }}
--- a/roles/docker/templates/calibre-compose.yml.j2
+++ b/roles/docker/templates/calibre-compose.yml.j2
@@ -18,7 +18,6 @@ services:
      glance.icon: si:calibreweb
      glance.url: https://{{ subdomains.books }}/
      glance.description: Book server
-      mag37.dockcheck.update: true
 volumes:
  config:
    driver: local
--- a/roles/docker/templates/changedetection-compose.yml.j2
+++ b/roles/docker/templates/changedetection-compose.yml.j2
@@ -4,13 +4,14 @@ services:
      image: ghcr.io/dgtlmoon/changedetection.io
      container_name: changedetection
      hostname: changedetection
+      extra_hosts:
+        - '{{ subdomains.chat }}:172.20.0.5'
      labels:
        glance.name: Changedetection
        glance.icon: si:watchtower
        glance.url: https://{{ subdomains.watcher }}/
        glance.description: Changedetection
        glance.id: changedetection
-        mag37.dockcheck.update: true
      volumes:
        - changedetection-data:/datastore
 # Configurable proxy list support, see https://github.com/dgtlmoon/changedetection.io/wiki/Proxy-configuration#proxy-list-support
@@ -76,8 +77,6 @@ services:
  #    ports:
  #      - 5000:5000
      restart: unless-stopped
-      extra_hosts:
-        - "{{ subdomains.gotify }}:{{ docker.hairpin_ip }}"

     # Used for fetching pages via WebDriver+Chrome where you need Javascript support.
     # Now working on arm64 (needs testing on rPi - tested on Oracle ARM instance)
@@ -97,7 +96,6 @@ services:
        labels:
          glance.parent: changedetection
          glance.name: Browser
-          mag37.dockcheck.update: true
        image: dgtlmoon/sockpuppetbrowser:latest
        cap_add:
            - SYS_ADMIN
@@ -108,8 +106,6 @@ services:
            - SCREEN_HEIGHT=1024
            - SCREEN_DEPTH=16
            - MAX_CONCURRENT_CHROME_PROCESSES=10
-        extra_hosts:
-            - "{{ subdomains.gotify }}:{{ docker.hairpin_ip }}"

     # Used for fetching pages via Playwright+Chrome where you need Javascript support.
     # Note: Works well but is deprecated, does not fetch full page screenshots (doesnt work with Visual Selector)
--- a/roles/docker/templates/codeserver-compose.yml.j2
+++ b/roles/docker/templates/codeserver-compose.yml.j2
@@ -7,7 +7,6 @@ services:
      glance.icon: si:vscodium
      glance.url: https://{{ subdomains.code }}/
      glance.description: Code Server
-      mag37.dockcheck.update: true
    container_name: codeserver
    volumes:
      - home:/home
--- a/roles/docker/templates/conduit-compose.yml.j2
+++ b/roles/docker/templates/conduit-compose.yml.j2
@@ -0,0 +1,46 @@
+services:
+    homeserver:
+        image: matrixconduit/matrix-conduit:next
+        restart: unless-stopped
+        volumes:
+            - db:/var/lib/matrix-conduit/
+        labels:
+          glance.name: Conduit
+          glance.icon: si:matrix
+          glance.url: https://{{ subdomains.chat }}/
+          glance.description: Matrix server
+        environment:
+            CONDUIT_SERVER_NAME: {{ subdomains.chat }} # EDIT THIS
+            CONDUIT_DATABASE_PATH: /var/lib/matrix-conduit/
+            CONDUIT_DATABASE_BACKEND: rocksdb
+            CONDUIT_PORT: 6167
+            CONDUIT_MAX_REQUEST_SIZE: 20000000 # in bytes, ~20 MB
+            CONDUIT_ALLOW_REGISTRATION: 'true'
+            CONDUIT_ALLOW_FEDERATION: 'true'
+            CONDUIT_ALLOW_CHECK_FOR_UPDATES: 'true'
+            CONDUIT_TRUSTED_SERVERS: '["matrix.org"]'
+            #CONDUIT_MAX_CONCURRENT_REQUESTS: 100
+            CONDUIT_ADDRESS: 0.0.0.0
+            CONDUIT_CONFIG: '' # Ignore this
+    #
+    ### Uncomment if you want to use your own Element-Web App.
+    ### Note: You need to provide a config.json for Element and you also need a second
+    ###       Domain or Subdomain for the communication between Element and Conduit
+    ### Config-Docs: https://github.com/vector-im/element-web/blob/develop/docs/config.md
+    # element-web:
+    #     image: vectorim/element-web:latest
+    #     restart: unless-stopped
+    #     ports:
+    #         - 8009:80
+    #     volumes:
+    #         - ./element_config.json:/app/config.json
+    #     depends_on:
+    #         - homeserver
+
+volumes:
+    db:
+
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}
--- a/roles/docker/templates/dawarich-compose.yml.j2
+++ b/roles/docker/templates/dawarich-compose.yml.j2
@@ -1,19 +1,4 @@
 services:
-  dawarich_redis:
-    image: redis:7.4-alpine
-    container_name: dawarich_redis
-    labels:
-      glance.parent: dawarich
-      glance.name: Redis
-    volumes:
-      - dawarich_redis_data:/data
-    restart: always
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 10s
-      retries: 5
-      start_period: 30s
-      timeout: 10s
  dawarich_db:
    image: postgis/postgis:17-3.5-alpine
    shm_size: 1G
@@ -34,9 +19,8 @@ services:
      retries: 5
      start_period: 30s
      timeout: 10s
-
  dawarich_app:
-    image: freikin/dawarich:latest
+    image: freikin/dawarich:0.27.3
    container_name: dawarich_app
    labels:
      glance.name: Dawarich
@@ -48,6 +32,7 @@ services:
      - dawarich_public:/var/app/public
      - dawarich_watched:/var/app/tmp/imports/watched
      - dawarich_storage:/var/app/storage
+      - dawarich_db_data:/dawarich_db_data
    stdin_open: true
    tty: true
    entrypoint: web-entrypoint.sh
@@ -55,12 +40,13 @@ services:
    restart: on-failure
    environment:
      RAILS_ENV: production
+      QUEUE_DATABASE_PATH: /dawarich_db_data/dawarich_production_queue.sqlite3
+      CACHE_DATABASE_PATH: /dawarich_db_data/dawarich_production_cache.sqlite3
      DATABASE_HOST: dawarich_db
      DATABASE_PORT: 5432
      DATABASE_USERNAME: postgres
      DATABASE_PASSWORD: {{ vault_dawarich.postgres_password }}
      DATABASE_NAME: dawarich_production
-      REDIS_URL: redis://dawarich_redis:6379
      MIN_MINUTES_SPENT_IN_CITY: 60
      APPLICATION_HOSTS: {{ subdomains.loclog }},localhost,::1,127.0.0.1
      TIME_ZONE: America/Denver
@@ -69,7 +55,7 @@ services:
      PROMETHEUS_EXPORTER_ENABLED: false
      PROMETHEUS_EXPORTER_HOST: 0.0.0.0
      PROMETHEUS_EXPORTER_PORT: 9394
-      SECRET_KEY_BASE: {{ vault_dawarich.secret_key_base }}
+      SECRET_KEY_BASE: 1234567890
      RAILS_LOG_TO_STDOUT: "true"
    logging:
      driver: "json-file"
@@ -86,69 +72,13 @@ services:
      dawarich_db:
        condition: service_healthy
        restart: true
-      dawarich_redis:
-        condition: service_healthy
-        restart: true
    deploy:
      resources:
        limits:
-          cpus: '0.50'
-          memory: '2G'
-  dawarich_sidekiq:
-    image: freikin/dawarich:latest
-    container_name: dawarich_sidekiq
-    labels:
-      glance.parent: dawarich
-      glance.name: Sidekiq
-    volumes:
-      - dawarich_public:/var/app/public
-      - dawarich_watched:/var/app/tmp/imports/watched
-      - dawarich_storage:/var/app/storage
-    stdin_open: true
-    tty: true
-    entrypoint: sidekiq-entrypoint.sh
-    command: ['sidekiq']
-    restart: on-failure
-    environment:
-      RAILS_ENV: production
-      DATABASE_HOST: dawarich_db
-      DATABASE_PORT: 5432
-      DATABASE_USERNAME: postgres
-      DATABASE_PASSWORD: {{ vault_dawarich.postgres_password }}
-      DATABASE_NAME: dawarich_production
-      REDIS_URL: redis://dawarich_redis:6379
-      MIN_MINUTES_SPENT_IN_CITY: 60
-      APPLICATION_HOSTS: {{ subdomains.loclog }},localhost,::1,127.0.0.1
-      TIME_ZONE: America/Denver
-      APPLICATION_PROTOCOL: http
-      DISTANCE_UNIT: mi
-      PROMETHEUS_EXPORTER_ENABLED: false
-      SECRET_KEY_BASE: {{ vault_dawarich.secret_key_base }}
-      RAILS_LOG_TO_STDOUT: "true"
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "100m"
-        max-file: "5"
-    healthcheck:
-      test: ["CMD-SHELL", "ps aux | grep '[s]idekiq' || exit 1"]
-      interval: 10s
-      retries: 30
-      start_period: 30s
-      timeout: 10s
-    depends_on:
-      dawarich_app:
-        condition: service_healthy
-        restart: true
-      dawarich_db:
-        condition: service_healthy
-        restart: true
-      dawarich_redis:
-        condition: service_healthy
-        restart: true
+          cpus: '0.50'    # Limit CPU usage to 50% of one core
+          memory: '2G'    # Limit memory usage to 2GB
 volumes:
  dawarich_db_data:
-  dawarich_redis_data:
  dawarich_public:
  dawarich_watched:
  dawarich_storage:
--- a/roles/docker/templates/ghost-1-compose.yml.j2
+++ b/roles/docker/templates/ghost-1-compose.yml.j2
@@ -17,7 +17,7 @@ services:
      glance.icon: si:ghost
      glance.url: https://{{ subdomains.phlog }}/
      glance.description: Photo Blog
-      mag37.dockcheck.update: true
+
 volumes:
  ghost:
    driver: local
--- a/roles/docker/templates/gitea-compose.yml.j2
+++ b/roles/docker/templates/gitea-compose.yml.j2
@@ -20,7 +20,6 @@ services:
      glance.url: https://{{ subdomains.git }}/
      glance.description: Code repo
      glance.id: gitea
-      mag37.dockcheck.update: true
    volumes:
      - gitea:/data
      - /etc/timezone:/etc/timezone:ro
@@ -47,7 +46,6 @@ services:
    labels:
      glance.parent: gitea
      glance.name: Worker
-      mag37.dockcheck.update: true
    volumes:
      - ./runner-config.yaml:/config.yaml
      - ./data:/data
--- a/roles/docker/templates/glance-compose.yml.j2
+++ b/roles/docker/templates/glance-compose.yml.j2
@@ -1,6 +1,6 @@
 services:
  glance:
-    image: glanceapp/glance:latest
+    image: glanceapp/glance:v0.8.3
    volumes:
      - ./config:/app/config
      - /etc/timezone:/etc/timezone:ro
--- a/roles/docker/templates/glance.yml.j2
+++ b/roles/docker/templates/glance.yml.j2
@@ -1,27 +1,40 @@
 pages:
  - name: Home
-    head-widgets:
-      - type: markets
-        hide-header: true
-        markets:
-          - symbol: SPY
-            name: S&P 500
-          - symbol: VTSAX
-            name: Vanguard Total Stock Market
-          - symbol: BAI
-            name: Blackrock AI
-          - symbol: NLR
-            name: VanEck Uranium+Nuclear Energy
-          - symbol: BITO
-            name: Bitcoin ETF
-    
    columns:
+      - size: small
+        widgets:
+          - type: calendar
+
+          - type: server-stats
+            servers:
+              - type: local
+                name: Services

      - size: full
        widgets:
-          - type: search
-            search-engine: kagi
-            new-tab: true
+          - type: group
+            widgets:
+            - type: hacker-news
+            - type: rss
+              limit: 10
+              collapse-after: 3
+              cache: 3h
+              feeds:
+              - url: https://kill-the-newsletter.com/feeds/ij4twrnzhrwvyic13qcm.xml
+              - url: https://mrmoneymustache.ck.page/68f9e9826c
+            - type: rss
+              title: Gear
+              limit: 10
+              collapse-after: 3
+              cache: 3h
+              feeds:
+              - url: https://9to5toys.com/steals/feed
+              - url: https://hiro.report/rss/
+          - type: change-detection
+            instance-url: https://watcher.thesatelliteoflove.com
+            token: ac69ae11570548549d6706eac6dbb6a9
+          - type: docker-containers
+            hide-by-default: false

      - size: small
        widgets:
@@ -29,62 +42,24 @@ pages:
            location: Nederland, Colorado, United States
            units: imperial

-          - type: custom-api
-            title: Air Quality
-            cache: 10m
-            url: https://api.waqi.info/feed/geo:39.9676367;-105.4037992/?token={{ vault_glance.air_quality_key }}
-            template: |
-              {% raw %}{{ $aqi := printf "%03s" (.JSON.String "data.aqi") }}
-              {{ $aqiraw := .JSON.String "data.aqi" }}
-              {{ $updated := .JSON.String "data.time.iso" }}
-              {{ $humidity := .JSON.String "data.iaqi.h.v" }}
-              {{ $ozone := .JSON.String "data.iaqi.o3.v" }}
-              {{ $pm25 := .JSON.String "data.iaqi.pm25.v" }}
-              {{ $pressure := .JSON.String "data.iaqi.p.v" }}
-
-              <div class="flex justify-between">
-                <div class="size-h5">
-                  {{ if le $aqi "050" }}
-                    <div class="color-positive">Good air quality</div>
-                  {{ else if le $aqi "100" }}
-                    <div class="color-primary">Moderate air quality</div>
-                  {{ else }}
-                    <div class="color-negative">Bad air quality</div>
-                  {{ end }}
-                </div>
-              </div>
-
-              <div class="color-highlight size-h2">AQI: {{ $aqiraw }}</div>
-              <div style="border-bottom: 1px solid; margin-block: 10px;"></div>
-
-              <div class="margin-block-2">
-                <div style="display: grid; grid-template-columns: 1fr 1fr; gap: 10px;">
-
-                  <div>
-                    <div class="size-h3 color-highlight">{{ $humidity }}%</div>
-                    <div class="size-h6">HUMIDITY</div>
-                  </div>
-
-                  <div>
-                    <div class="size-h3 color-highlight">{{ $ozone }} μg/m³</div>
-                    <div class="size-h6">OZONE</div>
-                  </div>
-
-                  <div>
-                    <div class="size-h3 color-highlight">{{ $pm25 }} μg/m³</div>
-                    <div class="size-h6">PM2.5</div>
-                  </div>
-
-                  <div>
-                    <div class="size-h3 color-highlight">{{ $pressure }} hPa</div>
-                    <div class="size-h6">PRESSURE</div>
-                  </div>
-
-                </div>
-
-                <div class="size-h6" style="margin-top: 10px;">Last Updated at {{ slice $updated 11 16 }}</div>
-              </div>{% endraw %}
-
+          - type: markets
+            markets:
+              - symbol: SPY
+                name: S&P 500
+              - symbol: VTSAX
+                name: Vanguard Total Stock Market
+              - symbol: BAI
+                name: Blackrock AI
+              - symbol: NLR
+                name: VanEck Uranium+Nuclear Energy
+              - symbol: BITO
+                name: Bitcoin ETF
+              - symbol: GOOGL
+                name: Google
+              - symbol: AMD
+                name: AMD
+              - symbol: DJT
+                name: Trump Media
  - name: Mini Painting
    columns:
    - size: small
--- a/roles/docker/templates/gotify-compose.yml.j2
+++ b/roles/docker/templates/gotify-compose.yml.j2
@@ -1,47 +0,0 @@
-services:
-  gotify:
-    image: gotify/server:latest
-    container_name: gotify
-    restart: unless-stopped
-    volumes:
-      - gotify_data:/app/data
-    environment:
-      - GOTIFY_DEFAULTUSER_PASS={{ vault_gotify.admin_password }}
-      - TZ=America/Denver
-    labels:
-      glance.name: Gotify
-      glance.icon: si:gotify
-      glance.url: "https://{{ subdomains.gotify }}/"
-      glance.description: Push notification server
-    extra_hosts:
-      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
-      - "{{ subdomains.gotify_assistant }}:{{ docker.hairpin_ip }}"
-
-  igotify-assistant:
-    image: ghcr.io/androidseb25/igotify-notification-assist:latest
-    restart: unless-stopped
-    container_name: igotify-assistant
-    volumes:
-      - igotify_data:/app/data
-    environment:
-      TZ: America/Denver
-    depends_on:
-      - gotify
-    labels:
-      glance.name: iGotify Assistant
-      glance.icon: si:apple
-      glance.url: "https://{{ subdomains.gotify_assistant }}/"
-      glance.description: iOS notification assistant
-      mag37.dockcheck.update: true
-    extra_hosts:
-      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
-      - "{{ subdomains.gotify }}:{{ docker.hairpin_ip }}"
-
-volumes:
-  gotify_data:
-  igotify_data:
-
-networks:
-  default:
-    external: true
-    name: "{{ docker.network_name }}"
--- a/roles/docker/templates/gotosocial-compose.yml.j2
+++ b/roles/docker/templates/gotosocial-compose.yml.j2
@@ -44,19 +44,23 @@ services:
    labels:
      glance.parent: gotosocial
      glance.name: Backup
-      mag37.dockcheck.update: true
    environment:
-      BACKUP_FILENAME: gts-backup-%Y-%m-%dT%H-%M-%S.tar.gz
+      BACKUP_FILENAME: backup-gts-%Y-%m-%dT%H-%M-%S.tar.gz
+      BACKUP_LATEST_SYMLINK: backup-latest.tar.gz
      BACKUP_CRON_EXPRESSION: "0 9 * * *"
-      BACKUP_PRUNING_PREFIX: gts-
-      BACKUP_RETENTION_DAYS: 7
+      BACKUP_PRUNING_PREFIX: backup-
+      BACKUP_RETENTION_DAYS: 1
      AWS_S3_BUCKET_NAME: tsolbackups
      AWS_ENDPOINT: s3.us-west-004.backblazeb2.com 
      AWS_ACCESS_KEY_ID: {{ vault_backup.access_key_id }}
      AWS_SECRET_ACCESS_KEY: {{ vault_backup.secret_access_key }}
+      BACKUP_SKIP_BACKENDS_FROM_PRUNE: s3
+
+
    volumes:
-      - gotosocial:/backup/gts-app-backup:ro
+      - gotosocial:/backup/my-app-backup:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./backup:/archive

 volumes:
  gotosocial:
--- a/roles/docker/templates/grocy-compose.yml.j2
+++ b/roles/docker/templates/grocy-compose.yml.j2
@@ -1,30 +0,0 @@
-services:
-  grocy:
-    image: lscr.io/linuxserver/grocy:latest
-    container_name: grocy
-    restart: unless-stopped
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=America/Denver
-    volumes:
-      - ./config:/config
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
-    labels:
-      glance.name: Grocy
-      glance.icon: si:grocyapp
-      glance.url: https://{{ subdomains.grocy }}/
-      glance.description: Kitchen ERP and inventory management
-      glance.id: grocy
-      mag37.dockcheck.update: true
-
-volumes:
-  grocy_config:
-    driver: local
-
-networks:
-  default:
-    external: true
-    name: {{ docker.network_name }}
--- a/roles/docker/templates/hoarder-compose.yml.j2
+++ b/roles/docker/templates/hoarder-compose.yml.j2
@@ -1,7 +1,7 @@
 version: "3.8"
 services:
  web:
-    image: ghcr.io/karakeep-app/karakeep:latest
+    image: ghcr.io/karakeep-app/karakeep:0.25.0
    restart: unless-stopped
    volumes:
      - data:/data
@@ -22,14 +22,12 @@ services:
      glance.url: https://{{ subdomains.bookmarks }}/
      glance.description: Bookmark manager
      glance.id: karakeep
-      mag37.dockcheck.update: true
  chrome:
    image: gcr.io/zenika-hub/alpine-chrome:123
    restart: unless-stopped
    labels:
      glance.name: Chrome
      glance.parent: karakeep
-      mag37.dockcheck.update: true
    command:
      - --no-sandbox
      - --disable-gpu
@@ -43,7 +41,6 @@ services:
    labels:
      glance.name: Meilisearch
      glance.parent: karakeep
-      mag37.dockcheck.update: true
    env_file:
      - .env
    environment:
--- a/roles/docker/templates/kanboard-compose.yml.j2
+++ b/roles/docker/templates/kanboard-compose.yml.j2
@@ -1,32 +0,0 @@
-services:
-  kanboard:
-    image: kanboard/kanboard:latest
-    container_name: kanboard
-    restart: unless-stopped
-    environment:
-      - PLUGIN_INSTALLER=true
-      - DB_DRIVER=sqlite
-    volumes:
-      - kanboard_data:/var/www/app/data
-      - kanboard_plugins:/var/www/app/plugins
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
-    labels:
-      glance.name: Kanboard
-      glance.icon: si:kanboard
-      glance.url: https://{{ subdomains.kanboard }}/
-      glance.description: Project management and Kanban boards
-      glance.id: kanboard
-      mag37.dockcheck.update: true
-
-volumes:
-  kanboard_data:
-    driver: local
-  kanboard_plugins:
-    driver: local
-
-networks:
-  default:
-    external: true
-    name: {{ docker.network_name }}
--- a/roles/docker/templates/manyfold-compose.yml.j2
+++ b/roles/docker/templates/manyfold-compose.yml.j2
@@ -12,24 +12,23 @@ services:
      # The container path can be anything; you will need to enter it in the "new library" form.
      - ./models:/models
    environment:
-      SECRET_KEY_BASE: {{ vault_manyfold.secret_key }}
+      SECRET_KEY_BASE: {{manyfold_key}}
      MULTIUSER: enabled 
-      OIDC_CLIENT_ID: {{ vault_manyfold.oidc.client_id }}
-      OIDC_CLIENT_SECRET: {{ vault_manyfold.oidc.client_secret }}
-      OIDC_ISSUER: https://{{ subdomains.auth }}/application/o/manyfold/
+      OIDC_CLIENT_ID: {{ manyfold_oidc_client_id }}
+      OIDC_CLIENT_SECRET: {{ manyfold_oidc_client_secret }}
+      OIDC_ISSUER: https://auth.thesatelliteoflove.com/application/o/manyfold/
      OIDC_NAME: Authentik
-      PUBLIC_HOSTNAME: {{ subdomains.models }}
+      PUBLIC_HOSTNAME: models.thesatelliteoflove.com
      MAX_FILE_UPLOAD_SIZE: 5368709120
      PUID: 1000
      PGID: 1000
    extra_hosts:
-      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
+      - 'auth.thesatelliteoflove.com:172.20.0.5'
    labels:
      glance.name: Manyfold
      glance.icon: si:open3d
-      glance.url: https://{{ subdomains.models }}/
+      glance.url: https://models.thesatelliteoflove.com/
      glance.description: STL Storage
-      mag37.dockcheck.update: true
    restart: unless-stopped
    # Optional, but recommended for better security
    security_opt:
@@ -45,4 +44,4 @@ services:
 networks:
  default:
    external: true
-    name: "{{ docker.network_name }}"
+    name: lava
--- a/roles/docker/templates/mmdl-compose.yml.j2
+++ b/roles/docker/templates/mmdl-compose.yml.j2
@@ -17,7 +17,6 @@ services:
      glance.url: https://{{ subdomains.tasks }}/
      glance.description: Task and calendar management
      glance.id: mmdl
-      mag37.dockcheck.update: true

  mmdl_db:
    image: mysql:8.0
@@ -36,7 +35,6 @@ services:
    labels:
      glance.parent: mmdl
      glance.name: DB
-      mag37.dockcheck.update: true

 volumes:
  mmdl_db:
--- a/roles/docker/templates/obsidian-livesync-compose.yml.j2
+++ b/roles/docker/templates/obsidian-livesync-compose.yml.j2
@@ -1,30 +0,0 @@
-services:
-  obsidian-livesync:
-    image: oleduc/docker-obsidian-livesync-couchdb:latest
-    container_name: obsidian-livesync
-    restart: unless-stopped
-    labels:
-      glance.name: Obsidian LiveSync
-      glance.icon: si:obsidian
-      glance.url: http://{{ network.docker_host_ip }}:5984
-      glance.description: Obsidian note synchronization
-      glance.id: obsidian-livesync
-    environment:
-      - SERVER_DOMAIN={{ network.docker_host_ip }}
-      - COUCHDB_USER={{ vault_obsidian.username }}
-      - COUCHDB_PASSWORD={{ vault_obsidian.password }}
-      - COUCHDB_DATABASE=obsidian
-    ports:
-      - "{{ network.docker_host_ip }}:5984:5984"
-    volumes:
-      - couchdb_data:/opt/couchdb/data
-    networks:
-      - default
-
-volumes:
-  couchdb_data:
-
-networks:
-  default:
-    external: true
-    name: "{{ docker.network_name }}"
--- a/roles/docker/templates/palmr-compose.yml.j2
+++ b/roles/docker/templates/palmr-compose.yml.j2
@@ -1,30 +0,0 @@
-services:
-  palmr:
-    image: kyantech/palmr:latest
-    restart: unless-stopped
-    environment:
-      DISABLE_FILESYSTEM_ENCRYPTION: "false"
-      ENCRYPTION_KEY: "{{ vault_palmr.encryption_key }}"
-      PALMR_UID: "1000"
-      PALMR_GID: "1000"
-      SECURE_SITE: "true"
-      DEFAULT_LANGUAGE: "en-US"
-      TRUST_PROXY: "true"
-    extra_hosts:
-      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
-    labels:
-      glance.name: Palmr
-      glance.icon: si:files
-      glance.url: "https://{{ subdomains.files }}/"
-      glance.description: File sharing and storage
-      glance.id: palmr
-      mag37.dockcheck.update: true
-    volumes:
-      - palmr_data:/app/server
-volumes:
-  palmr_data:
-    driver: local
-networks:
-  default:
-    external: true
-    name: "{{ docker.network_name }}"
--- a/roles/docker/templates/paperlessngx-compose.yml.j2
+++ b/roles/docker/templates/paperlessngx-compose.yml.j2
@@ -57,26 +57,6 @@ services:
      glance.name: Tika
    restart: unless-stopped

-  backup:
-    image: offen/docker-volume-backup:v2
-    restart: always
-    labels:
-      glance.parent: paperlessngx
-      glance.name: Backup
-      mag37.dockcheck.update: true
-    environment:
-      BACKUP_FILENAME: pngx-backup-%Y-%m-%dT%H-%M-%S.tar.gz
-      BACKUP_CRON_EXPRESSION: "10 9 * * *"
-      BACKUP_PRUNING_PREFIX: pngx-
-      BACKUP_RETENTION_DAYS: 7
-      AWS_S3_BUCKET_NAME: tsolbackups
-      AWS_ENDPOINT: s3.us-west-004.backblazeb2.com 
-      AWS_ACCESS_KEY_ID: {{ vault_backup.access_key_id }}
-      AWS_SECRET_ACCESS_KEY: {{ vault_backup.secret_access_key }}
-    volumes:
-      - media:/backup/pngx-app-backup:ro
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-
 volumes:
  data:
  media:
--- a/roles/docker/templates/pingvin-compose.yml.j2
+++ b/roles/docker/templates/pingvin-compose.yml.j2
@@ -0,0 +1,24 @@
+services:
+  pingvin-share:
+    image: stonith404/pingvin-share:latest
+    restart: unless-stopped
+    environment:
+      - TRUST_PROXY=true
+    extra_hosts:
+      - '{{ subdomains.auth }}:{{ docker.hairpin_ip }}'
+    labels:
+      glance.name: Pingvin
+      glance.icon: si:files
+      glance.url: https://{{ subdomains.files }}
+      glance.description: File sharing service
+      glance.id: pingvin
+    volumes:
+      - data:/opt/app/backend/data
+      - images:/opt/app/frontend/public/img
+volumes:
+  images:
+  data:
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}
--- a/roles/docker/templates/postiz-compose.yml.j2
+++ b/roles/docker/templates/postiz-compose.yml.j2
@@ -1,6 +1,6 @@
 services:
  postiz:
-    image: ghcr.io/gitroomhq/postiz-app:latest
+    image: ghcr.io/gitroomhq/postiz-app:v1.48.4
    container_name: postiz
    restart: always
    environment:
@@ -38,7 +38,6 @@ services:
      glance.url: https://{{ subdomains.post }}/
      glance.description: Social media scheduler
      glance.id: postiz
-      mag37.dockcheck.update: true
 
  postiz-postgres:
    image: postgres:14.5
@@ -58,7 +57,6 @@ services:
    labels:
      glance.parent: postiz
      glance.name: DB
-      mag37.dockcheck.update: true
  postiz-redis:
    image: redis:7.2
    container_name: postiz-redis
@@ -73,7 +71,6 @@ services:
    labels:
      glance.parent: postiz
      glance.name: Redis
-      mag37.dockcheck.update: true

 
 
--- a/todo.md
+++ b/todo.md
@@ -9,26 +9,26 @@
  roles/docker/tasks/
  ├── main.yml (orchestrator)
  ├── infrastructure/ (caddy, authentik, dockge)
-  ├── development/ (gitea, codeserver, bytestash)
+  ├── development/ (gitea, codeserver, conduit)
  ├── media/ (audiobookshelf, calibre, ghost, pinchflat, pinry, hoarder, manyfold)
-  ├── productivity/ (paperless, baikal, syncthing, mmdl, heyform, dawarich, palmr, obsidian-livesync)
+  ├── productivity/ (paperless, baikal, syncthing, mmdl, heyform, dawarich, pingvin)
  ├── communication/ (gotosocial, postiz)
-  └── monitoring/ (glance, changedetection, appriseapi, gotify)
+  └── monitoring/ (glance, changedetection, appriseapi)
  ```
 - **COMPLETED**: All services organized into logical categories with category-level tags

-### 2. Standardize variable management ✅ COMPLETED
+### 2. Standardize variable management
 - **Current Issue**: Secrets in single encrypted file, no clear variable hierarchy
 - **Solution**: Create proper variable structure:
  ```
  group_vars/
  ├── all/
-  │   ├── domains.yml (domain and subdomain mappings)
-  │   ├── infrastructure.yml (network config, Docker settings)
-  │   ├── vault.yml (encrypted secrets with vault_ prefix)
-  │   └── services.yml (service configuration flags)
+  │   ├── common.yml (shared config)
+  │   └── secrets.yml (vault encrypted)
+  ├── docker/
+  │   ├── services.yml (service configs)
+  │   └── networking.yml (network settings)
  ```
- **COMPLETED**: Implemented comprehensive variable hierarchy, updated all templates to use centralized variables, fixed service tag isolation

 ### 3. Template consolidation ✅ PARTIALLY COMPLETED
 - **Current Issue**: Many compose templates repeat patterns, some services used static files
@@ -43,7 +43,7 @@
 - **Solution**: Implement comprehensive health monitoring with standardized healthcheck patterns

 ### 5. Implement backup strategy
- **Issue**: No automated backups for 25 services and their data
+- **Issue**: No automated backups for 25+ services and their data
 - **Solution**: Add backup role with:
  - Database dumps for PostgreSQL services
  - Volume backups for file-based services
@@ -99,7 +99,7 @@
 - [x] Convert static compose files to templates
 - [x] Remove unused services (beaver, grist, stirlingpdf, tasksmd, redlib)
 - [x] Clean up templates and files directories
- [x] Implement variable hierarchy
+- [ ] Implement variable hierarchy
 - [ ] Create reusable template patterns

 ### Week 2: Security & Monitoring  
@@ -124,12 +124,10 @@
 - **Template Standardization**: Converted all static compose files to Jinja2 templates
 - **Service Cleanup**: Removed 5 unused/broken services (beaver, grist, stirlingpdf, tasksmd, redlib)
 - **Category-Based Deployment**: Can now deploy services by category using tags (infrastructure, media, etc.)
- **Variable Management**: Implemented comprehensive centralized variable hierarchy with proper secret organization
- **Service Tag Isolation**: Fixed service tags to deploy individual services only (not entire categories)
- **Documentation Updates**: Updated all README files and CLAUDE.md to reflect new architecture
+- **Documentation Updates**: Updated CLAUDE.md to reflect new architecture

 ### 📊 Current Stats
- **25 active services** organized into 6 categories
+- **22+ active services** organized into 6 categories
 - **100% templated** compose files (no static files)
 - **6 service directories** for logical organization
 - **Clean file structure** with only essential static files
Author	SHA1	Message	Date
Phil	e13393b82c	feat: update container versions for Baikal, Karakeep, and Postiz - Update Baikal to v0.10.1 (PostgreSQL support, PHP 8.4 compatibility) - Update Karakeep to v0.25.0 (Safari extension, PDF screenshots, bulk tag deletion) - Update Postiz to v1.48.4 (AI image generation, drag-drop uploads, enhanced platform support) All services tested and running successfully with no errors. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-06-08 21:04:24 -06:00
Phil	8edcea2f91	fix: add NEXT_API_DEBUG_MODE environment variable to MMDL Resolves calendar creation issue where clicking save would fail with 'Cannot read properties of undefined (Reading 'toUpperCase')' error. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-06-08 20:37:08 -06:00
Phil	bd50feb484	feat: update Glance to v0.8.3 - Updated image version from latest to v0.8.3 - Deployed and verified successful upgrade - New features available: theme picker, authentication, to-do widget 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-06-07 12:49:44 -06:00
Phil	dad7e887a8	feat: complete variable management implementation and update documentation - Update remaining Docker Compose templates with centralized variables - Fix service tag isolation to deploy individual services only - Update all README files with variable management architecture - Document variable hierarchy in DEPLOYMENT_LEARNINGS.md - Add comprehensive variable usage patterns to CLAUDE.md - Standardize domain references using {{ subdomains.* }} pattern - Replace hardcoded network names with {{ docker.network_name }} - Update hairpinning configuration to use variables 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-06-06 15:45:52 -06:00
Phil	0268e49b4d	feat: implement comprehensive variable management system - Create standardized group_vars directory structure - Add domains.yml with centralized subdomain mappings - Add infrastructure.yml with network, SMTP, and path config - Reorganize vault.yml secrets by service with consistent naming - Update 15+ Docker compose templates to use new variable structure - Simplify playbook commands by removing --extra-vars requirement - Replace hardcoded domains/IPs with template variables - Standardize secret references across all services 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-06-06 15:14:47 -06:00