PhilandClaude Opus 5.5
6dfb58d3f1
StarPunk 2.0.0 logs in with Pocket ID and issues its own Micropub tokens (ADR-064 in the StarPunk repo), so the Gondulf IndieAuth server is no longer used. Removes its task, templates, Caddy route, subdomain and service entry, and moves its DNS record to removed_records. The StarPunk template was still on v1.6.0-rc.2 with Gondulf hairpin hosts; deploying it would have broken login. It now matches production: v2.0.0, Pocket ID hairpin, OIDC client from vault_starpunk.pocketid and the admin sub in starpunk_admin_sub. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
59 lines
2.2 KiB
Markdown
59 lines
2.2 KiB
Markdown
# Infrastructure Improvements TODO
|
|
|
|
Current state (2026-10-31): 24 services in 6 categories, all compose files
|
|
templated, Pocket ID as SSO (Authentik retired), multi-agent guard rails
|
|
(`bin/worktree`, `bin/deploy`, `bin/vault-run`, `deploy-guard.yml`).
|
|
|
|
## Done
|
|
- Split the docker role into categories with category and service tags.
|
|
- Central variables in `group_vars/all/` (`domains.yml`, `infrastructure.yml`,
|
|
`vault.yml`).
|
|
- Converted every static compose file to a template.
|
|
- Removed unused services, most recently Authentik, Calibre-Web, dir2opds,
|
|
kosync, Sneaky Klaus and Audiobookshelf podcasts.
|
|
- Reserved address range on the `lava` network so fixed IPs can't be taken.
|
|
- Automatic container updates with dockcheck for labelled containers.
|
|
|
|
## Open
|
|
|
|
### Reusable template patterns
|
|
Many compose templates repeat the same network, restart and label blocks.
|
|
Pull the shared parts into includes or macros.
|
|
|
|
### Health checks
|
|
Only Pocket ID, Dawarich, Listmonk and Syncthing define health checks
|
|
in their templates. Add them to the rest where the image supports it.
|
|
|
|
### Backups
|
|
Only Paperless-ngx and GoToSocial back up (daily to S3 with
|
|
`offen/docker-volume-backup`, 7-day retention). Still to do:
|
|
- Database dumps for the Postgres/MongoDB/CouchDB services.
|
|
- Volume backups for the file-based services (Kavita, Audiobookshelf, Gitea,
|
|
Pocket ID, …).
|
|
- A tested restore.
|
|
|
|
### Network segmentation
|
|
Every service shares the `lava` network. Consider separate frontend, backend
|
|
and database networks.
|
|
|
|
### Security hardening
|
|
- Add `no-new-privileges` and dropped capabilities where images allow it
|
|
(only Manyfold has them now). Cronmaster runs as root.
|
|
- fail2ban (or Caddy rate limits) in front of login pages.
|
|
|
|
### CI with Gitea Actions
|
|
Syntax check and `--check` runs on push, using the existing Gitea runner.
|
|
|
|
### Configuration drift detection
|
|
Catch manual changes on the server, e.g. a scheduled `bin/deploy --check`.
|
|
|
|
### Service start order
|
|
Apps that use Pocket ID don't wait for it to be up.
|
|
|
|
### Ansible clean-up
|
|
- Replace the deprecated `apt_key` task for Docker's repo (it also fetches the
|
|
Ubuntu key for a Debian repo).
|
|
- Use `ansible.builtin.` names everywhere.
|
|
- The Dockge compose file is templated twice (`tasks/main.yml` and
|
|
`tasks/infrastructure/main.yml`).
|