Fix: Complete authentik Quadlet implementation with networking solution

Resolves authentik deployment issues by implementing proper Podman Quadlet
configuration and fixing networking for external access through Caddy.

Core Fixes:
• Add missing [Install] sections to container Quadlet files for systemd service generation
• Fix pod references from 'systemd-authentik' to 'authentik.pod' for proper Quadlet linking
• Remove problematic --userns=host to use proper rootless user namespaces
• Configure subuid/subgid ranges for authentik user (200000:65536)
• Update networking to bind 0.0.0.0:9000 only (remove unnecessary HTTPS port 9443)
• Add AUTHENTIK_LISTEN__HTTP=0.0.0.0:9000 environment configuration
• Fix Caddy reverse proxy to use HTTP backend instead of HTTPS

Infrastructure Updates:
• Enhance PostgreSQL role with Unix socket configuration and user management
• Improve Valkey role with proper systemd integration and socket permissions
• Add comprehensive service integration documentation
• Update deployment playbooks with backup and restore capabilities

Security Improvements:
• Secure network isolation with Caddy SSL termination
• Reduced attack surface by removing direct HTTPS container exposure
• Proper rootless container configuration with user namespace mapping

Result: authentik now fully operational with external HTTPS access via auth.jnss.me
All systemd services (authentik-pod, authentik-server, authentik-worker) running correctly.

roles/sigvild-gallery/README.md

@@ -44,6 +44,10 @@ sigvild_gallery_host: "127.0.0.1"
 sigvild_gallery_home: "/opt/sigvild-gallery"
 sigvild_gallery_web_root: "/var/www/sigvild-gallery"
 sigvild_gallery_local_project_path: "{{ ansible_env.PWD }}/sigvild-gallery"
+
+# Backup configuration
+sigvild_gallery_backup_enabled: true
+sigvild_gallery_backup_local_path: "{{ playbook_dir }}/backups/sigvild-gallery"
 ```
 
 ## Usage
@@ -71,6 +75,62 @@ ansible-playbook site.yml --tags="backend"
 ansible-playbook site.yml --tags="caddy"
 ```
 
+### Data Backup and Restoration
+
+#### Creating a Backup
+
+Before formatting your server or making major changes, create a backup of all production data:
+
+```bash
+# Create backup of production data
+ansible-playbook playbooks/backup-sigvild.yml
+
+# Backup will be saved to: ./backups/sigvild-gallery/sigvild-gallery-backup-YYYYMMDDTHHMMSS.tar.gz
+```
+
+The backup includes:
+- PocketBase SQLite database (`data.db`, `auxiliary.db`)
+- All uploaded wedding photos and media files
+- PocketBase logs and system state
+
+#### Automatic Restoration
+
+When deploying to a fresh server, the role automatically detects and restores from the latest backup:
+
+```bash
+# Normal deployment will auto-restore if backup exists
+ansible-playbook playbooks/deploy-sigvild.yml
+
+# Or deploy full infrastructure (includes auto-restore)
+ansible-playbook site.yml
+```
+
+#### Manual Restoration
+
+To restore data manually or from a specific backup:
+
+```bash
+# Restore with specific backup file
+ansible-playbook playbooks/deploy-sigvild.yml --tags="restore" \
+  --extra-vars="sigvild_gallery_backup_local_path=/path/to/backup/directory"
+
+# Force restoration (overwrite existing data)
+ansible-playbook playbooks/deploy-sigvild.yml --tags="backend,restore"
+```
+
+#### Backup Management
+
+```bash
+# List available backups
+ls -la ./backups/sigvild-gallery/
+
+# Verify backup contents
+tar -tzf ./backups/sigvild-gallery/sigvild-gallery-backup-YYYYMMDDTHHMMSS.tar.gz
+
+# Extract backup for inspection (local)
+tar -xzf ./backups/sigvild-gallery/sigvild-gallery-backup-YYYYMMDDTHHMMSS.tar.gz
+```
+
 ## Security Features
 
 ### Environment Variables
@@ -169,6 +229,21 @@ systemctl reload caddy
 - `/opt/sigvild-gallery/` (application directory)
 - `/var/www/sigvild-gallery/` (frontend files)
 
+## Data Protection
+
+### Backup Strategy
+- **Automated**: Backup creation via dedicated playbook
+- **Comprehensive**: Includes database, uploaded files, and system state
+- **Consistent**: Service temporarily stopped during backup for data integrity
+- **Local storage**: Backups stored in `./backups/sigvild-gallery/` directory
+- **Timestamped**: Each backup includes ISO timestamp for easy identification
+
+### Recovery Process
+- **Automatic detection**: Deployment automatically detects available backups
+- **Zero-downtime restore**: Restoration happens before service startup
+- **Integrity verification**: Backups verified before and after restoration
+- **Permission preservation**: User/group ownership maintained during restore
+
 ## Tags
 
 - `sigvild`: Complete Sigvild Gallery deployment
@@ -177,4 +252,6 @@ systemctl reload caddy
 - `build`: Local build processes
 - `service`: SystemD service management
 - `caddy`: Caddy configuration
-- `verify`: Post-deployment verification
+- `verify`: Post-deployment verification
+- `backup`: Data backup operations
+- `restore`: Data restoration operations

roles/sigvild-gallery/defaults/main.yml

@@ -31,6 +31,10 @@ sigvild_gallery_local_project_path: "{{ ansible_env.PWD }}/sigvild-gallery"
 sigvild_gallery_service_enabled: true
 sigvild_gallery_service_state: started
 
+# Backup configuration
+sigvild_gallery_backup_enabled: true
+sigvild_gallery_backup_local_path: "{{ playbook_dir }}/backups/sigvild-gallery"
+
 # Caddy integration (assumes caddy role provides these)
 # caddy_sites_enabled_dir: /etc/caddy/sites-enabled
 # caddy_user: caddy

roles/sigvild-gallery/tasks/backup.yml

@@ -0,0 +1,100 @@
+---
+# Sigvild Gallery Data Backup Tasks
+
+- name: Create local backup directory
+  local_action:
+    module: file
+    path: "{{ sigvild_gallery_backup_local_path }}/{{ ansible_date_time.iso8601_basic_short }}"
+    state: directory
+    mode: '0755'
+  become: false
+  run_once: true
+
+- name: Display backup information
+  debug:
+    msg:
+      - "Creating backup of Sigvild Gallery data..."
+      - "Data directory: {{ sigvild_gallery_data_dir }}"
+      - "Backup will be saved to: {{ sigvild_gallery_backup_local_path }}"
+      - "Timestamp: {{ ansible_date_time.iso8601_basic_short }}"
+
+- name: Check if data directory exists
+  stat:
+    path: "{{ sigvild_gallery_data_dir }}"
+  register: data_dir_stat
+
+- name: Fail if no data directory found
+  fail:
+    msg: "No data directory found at {{ sigvild_gallery_data_dir }}. Nothing to backup."
+  when: not data_dir_stat.stat.exists
+
+- name: Display data directory size
+  command: du -sh {{ sigvild_gallery_data_dir }}
+  register: data_size
+  changed_when: false
+
+- name: Show data size
+  debug:
+    msg: "Data directory size: {{ data_size.stdout }}"
+
+- name: Stop sigvild-gallery service for consistent backup
+  systemd:
+    name: sigvild-gallery
+    state: stopped
+  register: service_stopped
+
+- name: Create compressed backup of pb_data
+  archive:
+    path: "{{ sigvild_gallery_data_dir }}"
+    dest: "/tmp/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz"
+    format: gz
+    owner: "{{ sigvild_gallery_user }}"
+    group: "{{ sigvild_gallery_user }}"
+    mode: '0644'
+  register: backup_created
+
+- name: Verify backup contains critical files
+  command: tar -tzf /tmp/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz
+  register: backup_contents
+  changed_when: false
+  failed_when: 
+    - "'data.db' not in backup_contents.stdout"
+
+- name: Display backup verification
+  debug:
+    msg: "Backup verified - contains required database files"
+
+- name: Get backup file size
+  stat:
+    path: "/tmp/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz"
+  register: backup_file_stat
+
+- name: Display backup file info
+  debug:
+    msg: "Backup file created: {{ (backup_file_stat.stat.size / 1024 / 1024) | round(2) }}MB"
+  when: backup_file_stat.stat.exists
+
+- name: Download backup to local machine
+  fetch:
+    src: "/tmp/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz"
+    dest: "{{ sigvild_gallery_backup_local_path }}/"
+    flat: yes
+  register: backup_downloaded
+
+- name: Clean up remote backup file
+  file:
+    path: "/tmp/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz"
+    state: absent
+
+- name: Restart sigvild-gallery service
+  systemd:
+    name: sigvild-gallery
+    state: started
+  when: service_stopped.changed
+
+- name: Display backup completion
+  debug:
+    msg:
+      - "✅ Backup completed successfully!"
+      - "Local backup location: {{ sigvild_gallery_backup_local_path }}/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz"
+      - "Service has been restarted."

roles/sigvild-gallery/tasks/deploy_backend.yml

@@ -33,6 +33,10 @@
   notify: restart sigvild-gallery
   tags: [backend]
 
+- name: Restore data from backup if available
+  include_tasks: restore.yml
+  tags: [backend, restore]
+
 - name: Create data directory for PocketBase
   file:
     path: "{{ sigvild_gallery_data_dir }}"

roles/sigvild-gallery/tasks/restore.yml

@@ -0,0 +1,126 @@
+---
+# Sigvild Gallery Data Restoration Tasks
+
+- name: Check for existing data backup files
+  local_action:
+    module: find
+    paths: "{{ sigvild_gallery_backup_local_path }}"
+    patterns: "sigvild-gallery-backup-*.tar.gz"
+  register: backup_files
+  become: false
+
+- name: Display backup search results
+  debug:
+    msg:
+      - "Searching for backups in: {{ sigvild_gallery_backup_local_path }}"
+      - "Found {{ backup_files.files | length }} backup file(s)"
+
+- name: Display found backup files
+  debug:
+    msg: "Found backup: {{ item.path }} ({{ (item.size / 1024 / 1024) | round(2) }}MB, {{ item.mtime | to_datetime }})"
+  loop: "{{ backup_files.files | sort(attribute='mtime') }}"
+  when: backup_files.files | length > 0
+
+- name: Check if data directory already exists with data
+  stat:
+    path: "{{ sigvild_gallery_data_dir }}/data.db"
+  register: existing_data
+
+- name: Warn about existing data
+  debug:
+    msg: "⚠️ WARNING: Existing data found at {{ sigvild_gallery_data_dir }}/data.db - restoration will overwrite it!"
+  when: 
+    - existing_data.stat.exists
+    - backup_files.files | length > 0
+
+- name: Restore from latest backup
+  block:
+    - name: Get latest backup file
+      set_fact:
+        latest_backup: "{{ (backup_files.files | sort(attribute='mtime') | last).path }}"
+
+    - name: Display restoration info
+      debug:
+        msg:
+          - "Restoring from latest backup: {{ latest_backup | basename }}"
+          - "Target directory: {{ sigvild_gallery_data_dir }}"
+
+    - name: Stop sigvild-gallery service before restoration
+      systemd:
+        name: sigvild-gallery
+        state: stopped
+      register: service_stopped_for_restore
+      ignore_errors: true  # Service might not exist on fresh deployment
+
+    - name: Upload backup to remote server
+      copy:
+        src: "{{ latest_backup }}"
+        dest: "/tmp/restore-backup.tar.gz"
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Verify uploaded backup integrity
+      command: tar -tzf /tmp/restore-backup.tar.gz
+      register: restore_contents
+      changed_when: false
+      failed_when: "'data.db' not in restore_contents.stdout"
+
+    - name: Remove existing data directory if it exists
+      file:
+        path: "{{ sigvild_gallery_data_dir }}"
+        state: absent
+      when: existing_data.stat.exists
+
+    - name: Ensure parent directory exists
+      file:
+        path: "{{ sigvild_gallery_home }}"
+        state: directory
+        owner: "{{ sigvild_gallery_user }}"
+        group: "{{ sigvild_gallery_user }}"
+        mode: '0755'
+
+    - name: Extract backup to target location
+      unarchive:
+        src: "/tmp/restore-backup.tar.gz"
+        dest: "{{ sigvild_gallery_home }}"
+        remote_src: true
+        owner: "{{ sigvild_gallery_user }}"
+        group: "{{ sigvild_gallery_user }}"
+
+    - name: Verify restoration
+      stat:
+        path: "{{ sigvild_gallery_data_dir }}/data.db"
+      register: restored_data
+
+    - name: Fail if restoration unsuccessful
+      fail:
+        msg: "Restoration failed - data.db not found after extraction"
+      when: not restored_data.stat.exists
+
+    - name: Get restored data size
+      command: du -sh {{ sigvild_gallery_data_dir }}
+      register: restored_size
+      changed_when: false
+
+    - name: Clean up uploaded backup file
+      file:
+        path: "/tmp/restore-backup.tar.gz"
+        state: absent
+
+    - name: Display restoration success
+      debug:
+        msg:
+          - "✅ Data restoration completed successfully!"
+          - "Restored from: {{ latest_backup | basename }}"
+          - "Restored data size: {{ restored_size.stdout }}"
+          - "Location: {{ sigvild_gallery_data_dir }}"
+
+  when: backup_files.files | length > 0
+
+- name: No backup available message
+  debug:
+    msg:
+      - "ℹ️ No backup files found - starting with fresh installation"
+      - "Data directory will be created empty: {{ sigvild_gallery_data_dir }}"
+  when: backup_files.files | length == 0