Karakeep had DISABLE_SIGNUPS unset, so anyone could make an account on
bookmarks. and use the OpenAI key behind it. The server also had no
automatic updates and three security updates waiting; the common role now
installs unattended-upgrades with Debian's default security-only origins.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>