Fix: Complete authentik Quadlet implementation with networking solution

Resolves authentik deployment issues by implementing proper Podman Quadlet
configuration and fixing networking for external access through Caddy.

Core Fixes:
• Add missing [Install] sections to container Quadlet files for systemd service generation
• Fix pod references from 'systemd-authentik' to 'authentik.pod' for proper Quadlet linking
• Remove problematic --userns=host to use proper rootless user namespaces
• Configure subuid/subgid ranges for authentik user (200000:65536)
• Update networking to bind 0.0.0.0:9000 only (remove unnecessary HTTPS port 9443)
• Add AUTHENTIK_LISTEN__HTTP=0.0.0.0:9000 environment configuration
• Fix Caddy reverse proxy to use HTTP backend instead of HTTPS

Infrastructure Updates:
• Enhance PostgreSQL role with Unix socket configuration and user management
• Improve Valkey role with proper systemd integration and socket permissions
• Add comprehensive service integration documentation
• Update deployment playbooks with backup and restore capabilities

Security Improvements:
• Secure network isolation with Caddy SSL termination
• Reduced attack surface by removing direct HTTPS container exposure
• Proper rootless container configuration with user namespace mapping

Result: authentik now fully operational with external HTTPS access via auth.jnss.me
All systemd services (authentik-pod, authentik-server, authentik-worker) running correctly.

roles/sigvild-gallery/tasks/backup.yml

@@ -0,0 +1,100 @@
+---
+# Sigvild Gallery Data Backup Tasks
+
+- name: Create local backup directory
+  local_action:
+    module: file
+    path: "{{ sigvild_gallery_backup_local_path }}/{{ ansible_date_time.iso8601_basic_short }}"
+    state: directory
+    mode: '0755'
+  become: false
+  run_once: true
+
+- name: Display backup information
+  debug:
+    msg:
+      - "Creating backup of Sigvild Gallery data..."
+      - "Data directory: {{ sigvild_gallery_data_dir }}"
+      - "Backup will be saved to: {{ sigvild_gallery_backup_local_path }}"
+      - "Timestamp: {{ ansible_date_time.iso8601_basic_short }}"
+
+- name: Check if data directory exists
+  stat:
+    path: "{{ sigvild_gallery_data_dir }}"
+  register: data_dir_stat
+
+- name: Fail if no data directory found
+  fail:
+    msg: "No data directory found at {{ sigvild_gallery_data_dir }}. Nothing to backup."
+  when: not data_dir_stat.stat.exists
+
+- name: Display data directory size
+  command: du -sh {{ sigvild_gallery_data_dir }}
+  register: data_size
+  changed_when: false
+
+- name: Show data size
+  debug:
+    msg: "Data directory size: {{ data_size.stdout }}"
+
+- name: Stop sigvild-gallery service for consistent backup
+  systemd:
+    name: sigvild-gallery
+    state: stopped
+  register: service_stopped
+
+- name: Create compressed backup of pb_data
+  archive:
+    path: "{{ sigvild_gallery_data_dir }}"
+    dest: "/tmp/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz"
+    format: gz
+    owner: "{{ sigvild_gallery_user }}"
+    group: "{{ sigvild_gallery_user }}"
+    mode: '0644'
+  register: backup_created
+
+- name: Verify backup contains critical files
+  command: tar -tzf /tmp/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz
+  register: backup_contents
+  changed_when: false
+  failed_when: 
+    - "'data.db' not in backup_contents.stdout"
+
+- name: Display backup verification
+  debug:
+    msg: "Backup verified - contains required database files"
+
+- name: Get backup file size
+  stat:
+    path: "/tmp/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz"
+  register: backup_file_stat
+
+- name: Display backup file info
+  debug:
+    msg: "Backup file created: {{ (backup_file_stat.stat.size / 1024 / 1024) | round(2) }}MB"
+  when: backup_file_stat.stat.exists
+
+- name: Download backup to local machine
+  fetch:
+    src: "/tmp/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz"
+    dest: "{{ sigvild_gallery_backup_local_path }}/"
+    flat: yes
+  register: backup_downloaded
+
+- name: Clean up remote backup file
+  file:
+    path: "/tmp/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz"
+    state: absent
+
+- name: Restart sigvild-gallery service
+  systemd:
+    name: sigvild-gallery
+    state: started
+  when: service_stopped.changed
+
+- name: Display backup completion
+  debug:
+    msg:
+      - "✅ Backup completed successfully!"
+      - "Local backup location: {{ sigvild_gallery_backup_local_path }}/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz"
+      - "Service has been restarted."

roles/sigvild-gallery/tasks/deploy_backend.yml

@@ -33,6 +33,10 @@
   notify: restart sigvild-gallery
   tags: [backend]
 
+- name: Restore data from backup if available
+  include_tasks: restore.yml
+  tags: [backend, restore]
+
 - name: Create data directory for PocketBase
   file:
     path: "{{ sigvild_gallery_data_dir }}"

roles/sigvild-gallery/tasks/restore.yml

@@ -0,0 +1,126 @@
+---
+# Sigvild Gallery Data Restoration Tasks
+
+- name: Check for existing data backup files
+  local_action:
+    module: find
+    paths: "{{ sigvild_gallery_backup_local_path }}"
+    patterns: "sigvild-gallery-backup-*.tar.gz"
+  register: backup_files
+  become: false
+
+- name: Display backup search results
+  debug:
+    msg:
+      - "Searching for backups in: {{ sigvild_gallery_backup_local_path }}"
+      - "Found {{ backup_files.files | length }} backup file(s)"
+
+- name: Display found backup files
+  debug:
+    msg: "Found backup: {{ item.path }} ({{ (item.size / 1024 / 1024) | round(2) }}MB, {{ item.mtime | to_datetime }})"
+  loop: "{{ backup_files.files | sort(attribute='mtime') }}"
+  when: backup_files.files | length > 0
+
+- name: Check if data directory already exists with data
+  stat:
+    path: "{{ sigvild_gallery_data_dir }}/data.db"
+  register: existing_data
+
+- name: Warn about existing data
+  debug:
+    msg: "⚠️ WARNING: Existing data found at {{ sigvild_gallery_data_dir }}/data.db - restoration will overwrite it!"
+  when: 
+    - existing_data.stat.exists
+    - backup_files.files | length > 0
+
+- name: Restore from latest backup
+  block:
+    - name: Get latest backup file
+      set_fact:
+        latest_backup: "{{ (backup_files.files | sort(attribute='mtime') | last).path }}"
+
+    - name: Display restoration info
+      debug:
+        msg:
+          - "Restoring from latest backup: {{ latest_backup | basename }}"
+          - "Target directory: {{ sigvild_gallery_data_dir }}"
+
+    - name: Stop sigvild-gallery service before restoration
+      systemd:
+        name: sigvild-gallery
+        state: stopped
+      register: service_stopped_for_restore
+      ignore_errors: true  # Service might not exist on fresh deployment
+
+    - name: Upload backup to remote server
+      copy:
+        src: "{{ latest_backup }}"
+        dest: "/tmp/restore-backup.tar.gz"
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Verify uploaded backup integrity
+      command: tar -tzf /tmp/restore-backup.tar.gz
+      register: restore_contents
+      changed_when: false
+      failed_when: "'data.db' not in restore_contents.stdout"
+
+    - name: Remove existing data directory if it exists
+      file:
+        path: "{{ sigvild_gallery_data_dir }}"
+        state: absent
+      when: existing_data.stat.exists
+
+    - name: Ensure parent directory exists
+      file:
+        path: "{{ sigvild_gallery_home }}"
+        state: directory
+        owner: "{{ sigvild_gallery_user }}"
+        group: "{{ sigvild_gallery_user }}"
+        mode: '0755'
+
+    - name: Extract backup to target location
+      unarchive:
+        src: "/tmp/restore-backup.tar.gz"
+        dest: "{{ sigvild_gallery_home }}"
+        remote_src: true
+        owner: "{{ sigvild_gallery_user }}"
+        group: "{{ sigvild_gallery_user }}"
+
+    - name: Verify restoration
+      stat:
+        path: "{{ sigvild_gallery_data_dir }}/data.db"
+      register: restored_data
+
+    - name: Fail if restoration unsuccessful
+      fail:
+        msg: "Restoration failed - data.db not found after extraction"
+      when: not restored_data.stat.exists
+
+    - name: Get restored data size
+      command: du -sh {{ sigvild_gallery_data_dir }}
+      register: restored_size
+      changed_when: false
+
+    - name: Clean up uploaded backup file
+      file:
+        path: "/tmp/restore-backup.tar.gz"
+        state: absent
+
+    - name: Display restoration success
+      debug:
+        msg:
+          - "✅ Data restoration completed successfully!"
+          - "Restored from: {{ latest_backup | basename }}"
+          - "Restored data size: {{ restored_size.stdout }}"
+          - "Location: {{ sigvild_gallery_data_dir }}"
+
+  when: backup_files.files | length > 0
+
+- name: No backup available message
+  debug:
+    msg:
+      - "ℹ️ No backup files found - starting with fresh installation"
+      - "Data directory will be created empty: {{ sigvild_gallery_data_dir }}"
+  when: backup_files.files | length == 0