- Disable Redis RDB snapshots (--save "") — Redis is cache-only for
Nextcloud; snapshot writes failed due to directory permissions and
blocked all Redis writes, causing background jobs to crash-loop at
400%+ CPU
- Add passlib as a required local dependency (needed for password_hash
filter in Ansible templates)
- Make dl role SFTP setup conditional on dl_sftp_authorized_keys being
set in the vault
- Fix check-vault.sh stdin conflict (pipe + heredoc) by passing vault
content via environment variable
- Remove dl_sftp_authorized_keys from required_scalars (it is optional)
- New dl role — nginx serves files publicly over HTTPS with directory
listing; atmoz/sftp on port 2223 for key-only uploads; both containers
share /opt/dl/files volume
- check-vault.sh gains a third tier: optional secrets are validated when
present — vaultwarden_sso_client_secret must be non-empty,
dl_sftp_authorized_keys must begin with a recognised SSH public key prefix
- dl.ladkau.de added to DNS table, check-services.sh, and status dashboard
- Configuration runbook section 7: deploy key generation, Gitea Actions
scp workflow example, and SFTP client connection settings
- Provisioning runbook documents the three-tier vault validation behaviour
ml