Merge authentik-quadlet-fix: Integrate working authentik implementation

Merge completed authentik Quadlet implementation that resolves all deployment
issues and enables external HTTPS access. This brings the working solution
developed and tested on authentik-quadlet-fix branch into main.

All systemd services now generate correctly and authentik is fully operational
at https://auth.jnss.me with proper SSL termination via Caddy.

roles/postgresql/defaults/main.yml

@@ -13,13 +13,14 @@
 postgresql_service_enabled: true
 postgresql_service_state: "started"
 
-# Network Security (Unix socket only - no network listening)
-postgresql_listen_addresses: ""  # Empty string = no TCP/IP connections
+# Network Security
+postgresql_listen_addresses: "localhost"
 postgresql_port: 5432
 
-# Unix socket configuration
-postgresql_unix_socket_directories: "/run/postgresql"
-postgresql_unix_socket_permissions: 0777  # Allows container access
+# Unix Socket Configuration  
+postgresql_unix_socket_enabled: true
+postgresql_unix_socket_directories: "/var/run/postgresql"
+postgresql_unix_socket_permissions: "0770"
 
 # Authentication
 postgresql_auth_method: "scram-sha-256"

roles/postgresql/tasks/main.yml

@@ -67,37 +67,49 @@
     - reload systemd
     - restart postgresql
 
+- name: Create PostgreSQL Unix socket directory
+  file:
+    path: "{{ postgresql_unix_socket_directories }}"
+    state: directory
+    owner: postgres
+    group: postgres
+    mode: '0770'
+  when: postgresql_unix_socket_enabled
+
 - name: Enable and start PostgreSQL service
   systemd:
     name: postgresql
     enabled: "{{ postgresql_service_enabled }}"
     state: "{{ postgresql_service_state }}"
-    daemon_reload: yes
+    daemon_reload: true
 
-- name: Wait for PostgreSQL Unix socket to be ready
-  wait_for:
-    path: "{{ postgresql_unix_socket_directories }}/.s.PGSQL.{{ postgresql_port }}"
-    timeout: 30
-  when: 
-    - postgresql_service_state == "started"
-    - postgresql_listen_addresses == ""  # Socket-only mode
-
-- name: Wait for PostgreSQL TCP to be ready
+- name: Wait for PostgreSQL to be ready (TCP)
   wait_for:
     port: "{{ postgresql_port }}"
     host: "{{ postgresql_listen_addresses }}"
     timeout: 30
-  when: 
-    - postgresql_service_state == "started"
-    - postgresql_listen_addresses != ""  # TCP mode
+  when: postgresql_service_state == "started" and postgresql_listen_addresses != ""
+
+- name: Wait for PostgreSQL to be ready (Unix Socket)
+  postgresql_ping:
+    login_unix_socket: "{{ postgresql_unix_socket_directories }}"
+    login_user: postgres
+  become: true
+  become_user: postgres
+  register: postgresql_socket_ready
+  until: postgresql_socket_ready is succeeded
+  retries: 10
+  delay: 3
+  when: postgresql_service_state == "started" and postgresql_unix_socket_enabled and postgresql_listen_addresses == ""
 
 - name: Display PostgreSQL infrastructure status
   debug:
     msg: |
       ✅ PostgreSQL infrastructure ready!
       
-      📡 Service: {% if postgresql_listen_addresses == "" %}Unix socket only at {{ postgresql_unix_socket_directories }}{% else %}{{ postgresql_listen_addresses }}:{{ postgresql_port }}{% endif %}
+      📡 Service: {% if postgresql_unix_socket_enabled and postgresql_listen_addresses == "" %}Unix Socket ({{ postgresql_unix_socket_directories }}){% else %}{{ postgresql_listen_addresses }}:{{ postgresql_port }}{% endif %}
       🔒 Auth: {{ postgresql_auth_method }}
       📊 Checksums: {{ 'Enabled' if postgresql_data_checksums else 'Disabled' }}
+      {% if postgresql_unix_socket_enabled %}🔌 Socket: {{ postgresql_unix_socket_directories }} (mode {{ postgresql_unix_socket_permissions }}){% endif %}
       
       🏗️ Ready for applications to create databases/users

roles/postgresql/templates/postgresql.conf.j2

@@ -3,6 +3,11 @@
 # PostgreSQL's excellent defaults are used except for essentials
 
 # Network and Security
+{% if postgresql_unix_socket_enabled %}
+# Unix Socket Configuration
+unix_socket_directories = '{{ postgresql_unix_socket_directories }}'
+unix_socket_permissions = {{ postgresql_unix_socket_permissions }}
+{% endif %}
 listen_addresses = '{{ postgresql_listen_addresses }}'
 port = {{ postgresql_port }}