Repointed every infisical read_secrets path onto the restructured
two-level layout. New paths: /apps/dawarich /identity/oidc /platform/notify
Destinations were populated and hash-verified during PS-9 Phase 1
(215 keys, match/missing/mismatch = 215/0/0). The old flat folders are
untouched, so reverting this commit fully restores the previous state.
Ref: homelab-docs docs/projects/secrets-restructure.md
Co-Authored-By: Claude Opus 5 <[email protected]>
Add/standardize a ## Secrets section listing the vault_* keys pulled from Infisical at deploy time, grouped by folder. Part of a fleet-wide README secrets-documentation sweep.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Restarts any container that goes unhealthy, giving the 'healthcheck on every
container' convention teeth (previously only mediapvr had autoheal, and in
opt-in label mode = inert). Raw docker.sock RW (restart needs POST; can't use
the read-only socket-proxy). Sweep 2b.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Image must exist in the registry >=24h before Watchtower adopts it, so a
compromised/broken just-pushed :latest isn't pulled instantly. Per-container
override via com.centurylinklabs.watchtower.cooldown-delay. Fleet-wide.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
The pinned 1.40 client can't recreate containers that use newer-API features
(VolumeOptions.Subpath needs 1.45), which silently deleted the sonarr container
on its watchtower update (2026-07-05). Unset = the nicholas-fedor fork negotiates
the daemon's max API version per host. Fleet-wide sweep.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Fleet-wide the WATCHTOWER_NOTIFICATIONS_HOSTNAME / _TITLE_TAG had drifted into
4 styles (FQDN, ALLCAPS, abbreviations like Dash/NC, lowercase). Standardize on
HOSTNAME=<host>.balders.ca + TITLE_TAG=<Host> (capitalized Loki/DNS host label)
so every Watchtower update notification reads consistently:
[Mediapvr] Watchtower updates on mediapvr.balders.ca
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Dawarich ← Immich: pulls GPS/EXIF from geotagged photos onto the map.
Not env-driven (per-user in the Dawarich Settings UI), so this is a
rebuild-reference note + the canonical Immich URL. API keys stay
per-user (asset.read/view scopes), never in Infisical.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Backfill the byte-identical deploy-notification callback (Gotify on every run,
Pushover on failure) that the other LXC repos already ship. Auto-discovered via
the existing ansible.cfg callbacks_enabled line, gated by NOTIFY_ENABLED env
(default off, so inert until Semaphore enables it).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Self-hosted location history. 4-container compose: Rails 8 app + Sidekiq
+ PostGIS 16-3.4 + Redis 7, plus watchtower. Authentik OIDC end-to-end.
Image pinned at freikin/dawarich:1.7.11 (OIDC support requires >= 1.7.8).
PostGIS DB lives in this LXC, not on the central DB VM (.172) — central
image is postgres:16-alpine without postgis, swapping it carries broader
blast radius than colocating here. Convention exception captured in
homelab-docs project_dawarich memory.
Roles:
- dawarich: system + Docker + compose + weekly prune timer
- alloy: logs+journald → Loki, node metrics → Prometheus
Bring-up sequence proven 2026-06-01. README documents the 5-trap build
chain (image version, entrypoint scripts, solid_cache SQLite bind mount,
APPLICATION_HOSTS+localhost, force_ssl+healthcheck).
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
