Ship homelab quick wins: Recyclarr, infra pins, jd.ginnoir.com, and LAN lockdown.

Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.
2026-06-11 02:28:06 -05:00
parent 1ce63153ab
commit 51acb44322
34 changed files with 392 additions and 105 deletions
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Restored resume DB may contain JWKS encrypted with an old AUTH_SECRET.
+# Better Auth then fails session verification after OAuth (login page loop).
+# Safe fix: drop JWKS + sessions; app regenerates keys on next start.
+
+echo "=== resume: reset Better Auth JWKS (fixes session decrypt errors) ==="
+docker stop resume >/dev/null
+docker exec postgres_resume psql -U postgres -d postgres -c "TRUNCATE jwks, session, oauth_access_token, oauth_refresh_token CASCADE;"
+docker start resume >/dev/null
+sleep 15
+docker logs resume --tail 15 2>&1
+echo "done — retry resume.ginnoir.com → Authentik"