Files

T

PhilandClaude Opus 5.5 6dfb58d3f1 Retire Gondulf and move StarPunk to v2.0.0 with Pocket ID login

StarPunk 2.0.0 logs in with Pocket ID and issues its own Micropub tokens
(ADR-064 in the StarPunk repo), so the Gondulf IndieAuth server is no
longer used. Removes its task, templates, Caddy route, subdomain and
service entry, and moves its DNS record to removed_records.

The StarPunk template was still on v1.6.0-rc.2 with Gondulf hairpin
hosts; deploying it would have broken login. It now matches production:
v2.0.0, Pocket ID hairpin, OIDC client from vault_starpunk.pocketid and
the admin sub in starpunk_admin_sub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-31 11:52:07 -06:00

2.2 KiB

Raw Blame History

Infrastructure Improvements TODO

Current state (2026-10-31): 24 services in 6 categories, all compose files templated, Pocket ID as SSO (Authentik retired), multi-agent guard rails (bin/worktree, bin/deploy, bin/vault-run, deploy-guard.yml).

Done

Split the docker role into categories with category and service tags.
Central variables in group_vars/all/ (domains.yml, infrastructure.yml, vault.yml).
Converted every static compose file to a template.
Removed unused services, most recently Authentik, Calibre-Web, dir2opds, kosync, Sneaky Klaus and Audiobookshelf podcasts.
Reserved address range on the lava network so fixed IPs can't be taken.
Automatic container updates with dockcheck for labelled containers.

Open

Reusable template patterns

Many compose templates repeat the same network, restart and label blocks. Pull the shared parts into includes or macros.

Health checks

Only Pocket ID, Dawarich, Listmonk and Syncthing define health checks in their templates. Add them to the rest where the image supports it.

Backups

Only Paperless-ngx and GoToSocial back up (daily to S3 with offen/docker-volume-backup, 7-day retention). Still to do:

Database dumps for the Postgres/MongoDB/CouchDB services.
Volume backups for the file-based services (Kavita, Audiobookshelf, Gitea, Pocket ID, …).
A tested restore.

Network segmentation

Every service shares the lava network. Consider separate frontend, backend and database networks.

Security hardening

Add no-new-privileges and dropped capabilities where images allow it (only Manyfold has them now). Cronmaster runs as root.
fail2ban (or Caddy rate limits) in front of login pages.

CI with Gitea Actions

Syntax check and --check runs on push, using the existing Gitea runner.

Configuration drift detection

Catch manual changes on the server, e.g. a scheduled bin/deploy --check.

Service start order

Apps that use Pocket ID don't wait for it to be up.

Ansible clean-up

Replace the deprecated apt_key task for Docker's repo (it also fetches the Ubuntu key for a Debian repo).
Use ansible.builtin. names everywhere.
The Dockge compose file is templated twice (tasks/main.yml and tasks/infrastructure/main.yml).

2.2 KiB Raw Blame History