Files

T

PhilandClaude Opus 5.5 0c14ee5b1d Bring the docs up to date with the running stack

The READMEs, CLAUDE.md and todo.md still described Authentik, services
removed long ago (Ghost, MMDL, Postiz, Pinchflat...) and two servers. Now
they list the 24 services actually deployed (checked against docker ps),
explain that netcup and docker-01 are one machine, document Gondulf,
StarPunk, Listmonk, Gokapi and dockcheck, and use bin/deploy throughout.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-31 11:30:50 -06:00

2.2 KiB

Raw Blame History

Infrastructure Improvements TODO

Current state (2026-10-31): 24 services in 6 categories, all compose files templated, Pocket ID as SSO (Authentik retired), multi-agent guard rails (bin/worktree, bin/deploy, bin/vault-run, deploy-guard.yml).

Done

Split the docker role into categories with category and service tags.
Central variables in group_vars/all/ (domains.yml, infrastructure.yml, vault.yml).
Converted every static compose file to a template.
Removed unused services, most recently Authentik, Calibre-Web, dir2opds, kosync, Sneaky Klaus and Audiobookshelf podcasts.
Reserved address range on the lava network so fixed IPs can't be taken.
Automatic container updates with dockcheck for labelled containers.

Open

Reusable template patterns

Many compose templates repeat the same network, restart and label blocks. Pull the shared parts into includes or macros.

Health checks

Only Pocket ID, Gondulf, Dawarich, Listmonk and Syncthing define health checks in their templates. Add them to the rest where the image supports it.

Backups

Only Paperless-ngx and GoToSocial back up (daily to S3 with offen/docker-volume-backup, 7-day retention). Still to do:

Database dumps for the Postgres/MongoDB/CouchDB services.
Volume backups for the file-based services (Kavita, Audiobookshelf, Gitea, Pocket ID, …).
A tested restore.

Network segmentation

Every service shares the lava network. Consider separate frontend, backend and database networks.

Security hardening

Add no-new-privileges and dropped capabilities where images allow it (only Manyfold has them now). Cronmaster runs as root.
fail2ban (or Caddy rate limits) in front of login pages.

CI with Gitea Actions

Syntax check and --check runs on push, using the existing Gitea runner.

Configuration drift detection

Catch manual changes on the server, e.g. a scheduled bin/deploy --check.

Service start order

Apps that use Pocket ID don't wait for it to be up.

Ansible clean-up

Replace the deprecated apt_key task for Docker's repo (it also fetches the Ubuntu key for a Debian repo).
Use ansible.builtin. names everywhere.
The Dockge compose file is templated twice (tasks/main.yml and tasks/infrastructure/main.yml).

2.2 KiB Raw Blame History