Add Dovecot IMAP + Fetchmail, fix Gitea SSO, simplify credential management

- Add local Dovecot IMAP server exposed via Traefik IMAPS on port 993;
  Roundcube now connects to it internally instead of requiring manual server entry
- Add Fetchmail integration for pulling from external POP3 accounts with
  configurable per-account poll interval
- Fix Gitea SSO registration: DISABLE_REGISTRATION=false + ALLOW_ONLY_EXTERNAL_REGISTRATION
  allows Keycloak-authenticated users to get accounts while blocking public sign-up;
  disable legacy OpenID 2.0 sign-in
- Fix Keycloak post-logout redirect for Nextcloud (valid post logout redirect URI)
- Replace all pre-hashed credentials (Traefik dashboard, registry, Dovecot) with
  plaintext passwords in vault; Ansible generates deterministic bcrypt/SHA-512 hashes
  at deploy time — no more manual htpasswd commands
- Rewrite check-vault.sh with Python/PyYAML to properly validate both scalar and
  list-type secrets
- Update provisioning and configuration runbooks throughout

ansible/group_vars/all/vars.yml

@@ -24,18 +24,16 @@ traefik_network: traefik_public
 # Traefik
 traefik_version: v3.6
 traefik_data_dir: /opt/traefik
-# htpasswd-formatted user list for the dashboard.
-# Generate with: echo $(htpasswd -nB admin) | sed -e 's/\$/\$\$/g'
-# Store the actual value in ansible/group_vars/all/vault.yml (Ansible Vault).
-traefik_dashboard_users: ""
+# Dashboard basic-auth users — plaintext passwords, Ansible generates bcrypt hashes at deploy time
+# traefik_dashboard_users:
+#   - username: admin
+#     password: "your-password"
+traefik_dashboard_users: []
 
 # Gitea
 gitea_version: "1"          # major-only tag — always pulls latest 1.x patch
 gitea_db_version: "16"      # PostgreSQL major version
 gitea_data_dir: /opt/gitea
-# Set to false for the very first deploy so the admin account can be created,
-# then flip to true and redeploy to close public registration.
-gitea_disable_registration: true
 # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
 # gitea_db_password: ""
 # gitea_secret_key: ""      # generate: openssl rand -hex 32
@@ -59,28 +57,42 @@ nextcloud_admin_user: admin
 # nextcloud_db_password: ""
 # nextcloud_admin_password: ""
 
-# Mail (Roundcube webmail client)
+# Mail (Roundcube + Dovecot IMAP + Fetchmail)
 roundcube_version: "1.6.x-apache"
 roundcube_db_version: "16"
 mail_data_dir: /opt/mail
-# IMAP/SMTP — set to the mail server Roundcube should connect to.
-# Leave imap_host empty to let users enter their own server at login.
-# Use "ssl://hostname" for implicit TLS (port 993), or plain hostname for STARTTLS (port 143).
-roundcube_imap_host: ""
-roundcube_imap_port: "993"
+# Dovecot IMAP server — Roundcube always connects to the local Dovecot container
+dovecot_version: "2.3"
+# SMTP — outgoing mail server for Roundcube (leave empty if not configured)
 roundcube_smtp_host: ""
 roundcube_smtp_port: "587"
+# Fetchmail — polls external POP3 accounts and delivers to local Dovecot via LMTP
+# poll_minutes is per-account (default: 10 minutes)
 # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
 # roundcube_db_password: ""
 # roundcube_des_key: ""   # generate: openssl rand -hex 12  (must be exactly 24 chars)
+#
+# Dovecot users — list of {username, password} pairs (plaintext, vault is encrypted)
+# dovecot_users:
+#   - username: alice
+#     password: "plaintext-password"
+#
+# Fetchmail accounts — list of external POP3 sources to poll
+# fetchmail_accounts:
+#   - server: pop.gmail.com
+#     username: user@gmail.com
+#     password: app-password
+#     local_user: alice
+#     protocol: pop3      # default: pop3
+#     ssl: true           # default: true
+#     keep: true          # default: true — set false to delete from source after fetch
 
 # Container registry (Docker Registry v2)
 registry_data_dir: /opt/registry
-# registry_htpasswd — full htpasswd file content, store in vault.yml
-# Generate with: docker run --entrypoint htpasswd httpd:2 -Bbn <user> <password>
-# Multiple users: run the command once per user and concatenate the lines.
-# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
-# registry_htpasswd: ""
+# Registry users — plaintext passwords, Ansible generates bcrypt hashes at deploy time
+# registry_users:
+#   - username: alice
+#     password: "your-password"
 
 # k8s (placeholder)
 k8s_data_dir: /opt/k8s

ansible/roles/gitea/templates/docker-compose.yml.j2

@@ -20,8 +20,14 @@ services:
       # Security
       - GITEA__security__SECRET_KEY={{ gitea_secret_key }}
       - GITEA__security__INTERNAL_TOKEN={{ gitea_internal_token }}
-      # Disable public registration — set to false only for initial admin setup
-      - GITEA__service__DISABLE_REGISTRATION={{ gitea_disable_registration | lower }}
+      # Allow account creation only via external auth (OAuth2/SSO).
+      # DISABLE_REGISTRATION=false is explicit because the setup wizard writes true to app.ini;
+      # ALLOW_ONLY_EXTERNAL_REGISTRATION then hides the sign-up form so only SSO accounts work.
+      - GITEA__service__DISABLE_REGISTRATION=false
+      - GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION=true
+      # Disable legacy OpenID 2.0 sign-in (distinct from the Keycloak OAuth2 integration)
+      - GITEA__openid__ENABLE_OPENID_SIGNIN=false
+      - GITEA__openid__ENABLE_OPENID_SIGNUP=false
     volumes:
       - {{ gitea_data_dir }}/data:/data
     ports:

ansible/roles/mail/tasks/main.yml

@@ -1,6 +1,5 @@
 ---
-# Roundcube webmail client — connects to any external IMAP/SMTP server
-- name: Create Roundcube data directories
+- name: Create mail data directories
   ansible.builtin.file:
     path: "{{ item }}"
     state: directory
@@ -20,6 +19,45 @@
     mode: "0700"
   tags: mail
 
+- name: Create Dovecot maildir (vmail UID 5000)
+  ansible.builtin.file:
+    path: "{{ mail_data_dir }}/maildir"
+    state: directory
+    owner: "5000"
+    group: "5000"
+    mode: "0755"
+  tags: mail
+
+- name: Deploy Dovecot config
+  ansible.builtin.template:
+    src: dovecot.conf.j2
+    dest: "{{ mail_data_dir }}/dovecot.conf"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart mail
+  tags: mail
+
+- name: Deploy Dovecot passwd file
+  ansible.builtin.template:
+    src: passwd.j2
+    dest: "{{ mail_data_dir }}/passwd"
+    owner: root
+    group: root
+    mode: "0640"
+  notify: Restart mail
+  tags: mail
+
+- name: Deploy fetchmail config
+  ansible.builtin.template:
+    src: fetchmailrc.j2
+    dest: "{{ mail_data_dir }}/fetchmailrc"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Restart mail
+  tags: mail
+
 - name: Deploy Docker Compose file
   ansible.builtin.template:
     src: docker-compose.yml.j2
@@ -30,7 +68,7 @@
   notify: Restart mail
   tags: mail
 
-- name: Start Roundcube
+- name: Start mail stack
   community.docker.docker_compose_v2:
     project_src: "{{ mail_data_dir }}"
     state: present

ansible/roles/mail/templates/docker-compose.yml.j2

@@ -18,6 +18,41 @@ services:
       timeout: 5s
       retries: 5
 
+  dovecot:
+    image: dovecot/dovecot:{{ dovecot_version }}
+    container_name: dovecot
+    restart: unless-stopped
+    volumes:
+      - {{ mail_data_dir }}/dovecot.conf:/etc/dovecot/dovecot.conf:ro
+      - {{ mail_data_dir }}/passwd:/etc/dovecot/passwd:ro
+      - {{ mail_data_dir }}/maildir:/var/mail
+    networks:
+      - traefik_public
+      - mail_internal
+    labels:
+      - "traefik.enable=true"
+      # TCP router — Traefik terminates TLS on port 993 and forwards plain IMAP to port 143
+      - "traefik.tcp.routers.imaps.rule=HostSNI(`{{ domain_mail }}`)"
+      - "traefik.tcp.routers.imaps.entrypoints=imaps"
+      - "traefik.tcp.routers.imaps.tls.certresolver=letsencrypt"
+      - "traefik.tcp.services.imaps.loadbalancer.server.port=143"
+
+{% if fetchmail_accounts | default([]) | length > 0 %}
+  fetchmail:
+    image: alpine:3
+    container_name: fetchmail
+    restart: unless-stopped
+    # apk add runs on each start — acceptable for a home server
+    command: ["sh", "-c", "apk add --no-cache fetchmail && exec fetchmail --nodetach -f /etc/fetchmail/fetchmailrc"]
+    volumes:
+      - {{ mail_data_dir }}/fetchmailrc:/etc/fetchmail/fetchmailrc:ro
+    networks:
+      - traefik_public
+      - mail_internal
+    depends_on:
+      - dovecot
+
+{% endif %}
   roundcube:
     image: roundcube/roundcubemail:{{ roundcube_version }}
     container_name: roundcube
@@ -30,14 +65,13 @@ services:
       ROUNDCUBEMAIL_DB_USER: roundcube
       ROUNDCUBEMAIL_DB_PASSWORD: "{{ roundcube_db_password }}"
       ROUNDCUBEMAIL_DB_NAME: roundcube
-      # IMAP — leave empty to let users enter their own server at login,
-      # or set to a specific host to lock it down (e.g. ssl://imap.example.com)
-      ROUNDCUBEMAIL_DEFAULT_HOST: "{{ roundcube_imap_host }}"
-      ROUNDCUBEMAIL_DEFAULT_PORT: "{{ roundcube_imap_port }}"
-      # SMTP
+      # IMAP — local Dovecot container
+      ROUNDCUBEMAIL_DEFAULT_HOST: "dovecot"
+      ROUNDCUBEMAIL_DEFAULT_PORT: "143"
+      # SMTP — outgoing mail server (leave empty if not configured)
       ROUNDCUBEMAIL_SMTP_SERVER: "{{ roundcube_smtp_host }}"
       ROUNDCUBEMAIL_SMTP_PORT: "{{ roundcube_smtp_port }}"
-      # Security — 24-character random string used to encrypt session data
+      # Security
       ROUNDCUBEMAIL_DES_KEY: "{{ roundcube_des_key }}"
       ROUNDCUBEMAIL_UPLOAD_MAX_FILESIZE: 25M
     networks:
@@ -53,6 +87,8 @@ services:
     depends_on:
       mail-db:
         condition: service_healthy
+      dovecot:
+        condition: service_started
 
 networks:
   traefik_public:

ansible/roles/mail/templates/dovecot.conf.j2

@@ -0,0 +1,43 @@
+# Managed by Ansible — do not edit manually
+protocols = imap lmtp
+
+# Plaintext auth is fine — connections come from within Docker or via
+# Traefik TLS termination, never plain from the internet
+disable_plaintext_auth = no
+auth_mechanisms = plain login
+
+passdb {
+  driver = passwd-file
+  args = /etc/dovecot/passwd
+}
+
+userdb {
+  driver = passwd-file
+  args = /etc/dovecot/passwd
+  default_fields = uid=5000 gid=5000 home=/var/mail/%u
+}
+
+mail_location = maildir:/var/mail/%u/Maildir
+mail_uid = 5000
+mail_gid = 5000
+
+service imap-login {
+  inet_listener imap {
+    port = 143
+  }
+  # IMAPS disabled — Traefik terminates TLS on port 993 and forwards plain IMAP
+  inet_listener imaps {
+    port = 0
+  }
+}
+
+# LMTP listener for fetchmail delivery — reachable on mail_internal network only
+service lmtp {
+  inet_listener lmtp {
+    address = *
+    port = 24
+  }
+}
+
+# SSL disabled — Traefik handles TLS
+ssl = no

ansible/roles/mail/templates/fetchmailrc.j2

@@ -0,0 +1,20 @@
+# Managed by Ansible — do not edit manually
+set postmaster "postmaster"
+set bouncemail
+set logfile /dev/stdout
+# Wake up every 60 seconds; each server's 'interval' is a multiplier of this
+set daemon 60
+
+{% for account in fetchmail_accounts | default([]) %}
+poll {{ account.server }} proto {{ account.protocol | default('pop3') }}{% if account.ssl | default(true) %} ssl{% endif %}
+
+  user "{{ account.username }}" password "{{ account.password }}"
+  is {{ account.local_user }} here
+  smtphost dovecot
+  smtpport 24
+  lmtp
+  fetchall
+  {{ 'keep' if account.keep | default(true) else 'no keep' }}
+  interval {{ account.poll_minutes | default(10) }}
+
+{% endfor %}

ansible/roles/mail/templates/passwd.j2

@@ -0,0 +1,4 @@
+# Managed by Ansible — do not edit manually
+{% for user in dovecot_users | default([]) %}
+{{ user.username }}:{SHA512-CRYPT}{{ user.password | password_hash('sha512', (user.username | hash('md5'))[:16]) }}
+{% endfor %}

ansible/roles/registry/tasks/main.yml

@@ -12,10 +12,9 @@
     - "{{ registry_data_dir }}/auth"
   tags: registry
 
-# htpasswd content is stored in vault and deployed as a file
 - name: Deploy htpasswd file
-  ansible.builtin.copy:
-    content: "{{ registry_htpasswd }}\n"
+  ansible.builtin.template:
+    src: htpasswd.j2
     dest: "{{ registry_data_dir }}/auth/htpasswd"
     owner: root
     group: root

ansible/roles/registry/templates/htpasswd.j2

@@ -0,0 +1,4 @@
+# Managed by Ansible — do not edit manually
+{% for user in registry_users | default([]) %}
+{{ user.username }}:{{ user.password | password_hash('bcrypt', (user.username | hash('md5'))[:22]) }}
+{% endfor %}

ansible/roles/sso/templates/docker-compose.yml.j2

@@ -47,7 +47,7 @@ services:
       - "traefik.http.routers.sso.entrypoints=websecure"
       - "traefik.http.routers.sso.tls.certresolver=letsencrypt"
       - "traefik.http.services.sso.loadbalancer.server.port=8080"
-      - "traefik.http.routers.sso.middlewares=rate-limit@docker"
+      - "traefik.http.routers.sso.middlewares=rate-limit-lax@docker"
     healthcheck:
       test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/localhost/9000"]
       interval: 30s

ansible/roles/traefik/templates/docker-compose.yml.j2

@@ -7,6 +7,7 @@ services:
     ports:
       - "80:80"
       - "443:443"
+      - "993:993"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - {{ traefik_data_dir }}/traefik.yml:/traefik.yml:ro
@@ -22,7 +23,11 @@ services:
       - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
       - "traefik.http.routers.dashboard.service=api@internal"
       - "traefik.http.routers.dashboard.middlewares=dashboard-auth"
-      - "traefik.http.middlewares.dashboard-auth.basicauth.users={{ traefik_dashboard_users }}"
+{% set ns = namespace(entries=[]) %}
+{% for user in traefik_dashboard_users | default([]) %}
+{% set ns.entries = ns.entries + [user.username + ':' + (user.password | password_hash('bcrypt', (user.username | hash('md5'))[:22]) | replace('$', '$$'))] %}
+{% endfor %}
+      - "traefik.http.middlewares.dashboard-auth.basicauth.users={{ ns.entries | join(',') }}"
       # Rate-limit middlewares — referenced by services as rate-limit@docker / rate-limit-lax@docker
       # Standard: 60 req/min per IP, burst 20 — protects all services from bot floods
       - "traefik.http.middlewares.rate-limit.rateLimit.average=60"

ansible/roles/traefik/templates/traefik.yml.j2

@@ -24,6 +24,8 @@ entryPoints:
           permanent: true
   websecure:
     address: ":443"
+  imaps:
+    address: ":993"
 
 providers:
   docker: