Ship homelab quick wins: Recyclarr, infra pins, jd.ginnoir.com, and LAN lockdown.

Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.

stacks/authentik/scripts/apply-forward-auth-admin.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Apply TB-006 forward_auth proxy providers (admin batch 1 + media batch 2).
+"""Apply TB-006 forward_auth proxy providers (batches 1–3).
 
 Native OAuth/OIDC apps (bookstack, gitea, portainer, minio, homarr) use
 setup-batch1-oidc.py instead. Run this via: ak shell -c exec(open(...).read())

stacks/authentik/scripts/setup-batch1-oidc.py

@@ -17,6 +17,12 @@ OIDC_APPS = [
     ("gitea", "gitea", ["https://gitea.ginnoir.com/user/oauth2/Authentik/callback"]),
     ("portainer", "portainer", ["https://portainer.ginnoir.com/"]),
     ("minio", "minio-console", ["https://minio.ginnoir.com/oauth_callback"]),
+    ("owncloud", "owncloud-web", [
+        "https://files.ginnoir.com/index.php/apps/openidconnect/redirect",
+        "https://files.ginnoir.com/apps/openidconnect/redirect",
+    ]),
+    ("resume", "reactive-resume", ["https://resume.ginnoir.com/api/auth/oauth2/callback/custom"]),
+    ("freshrss", "freshrss", ["https://freshrss.ginnoir.com/i/oidc/"]),
 ]
 
 native_slugs = []
@@ -63,6 +69,9 @@ PROXY_NAMES = {
     "gitea": "homelab-gitea",
     "portainer": "homelab-portainer",
     "minio": "homelab-minio",
+    "owncloud": "homelab-files",
+    "resume": "homelab-resume",
+    "freshrss": "homelab-freshrss",
 }
 outpost = Outpost.objects.get(name="authentik Embedded Outpost")
 for slug in native_slugs:

stacks/authentik/scripts/setup-forward-auth-trust-proxy.py

@@ -1,4 +1,4 @@
-"""Update proxy providers for forward_auth apps (admin batch 1 + media batch 2)."""
+"""Update proxy providers for forward_auth apps (batches 1–3)."""
 from authentik.core.models import Application
 from authentik.flows.models import Flow
 from authentik.outposts.models import Outpost, OutpostType