Ship homelab quick wins: Recyclarr, infra pins, jd.ginnoir.com, and LAN lockdown.

Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.

stacks/notify/docker-compose.yml

@@ -62,6 +62,11 @@ services:
       - CRON_MIN=3,33
       - TRUSTED_PROXY=172.16.0.1/12 192.168.0.1/16
       - FRESHRSS_INSTALL=--default-user ginnoir --api-enabled --base-url https://freshrss.ginnoir.com
+      - OIDC_ENABLED=1
+      - OIDC_PROVIDER_METADATA_URL=https://auth.ginnoir.com/application/o/freshrss/.well-known/openid-configuration
+      - OIDC_REMOTE_USER_CLAIM=preferred_username
+      - OIDC_SCOPES=openid profile email
+      - OIDC_X_FORWARDED_HEADERS=X-Forwarded-Host X-Forwarded-Proto
 
   vigilant:
     container_name: vigilant

stacks/notify/stack.env

@@ -3,3 +3,6 @@ TZ=America/Chicago
 # FreshRSS first-run user bootstrap (the container reads FRESHRSS_USER as the
 # full CLI argument string for its install script).
 FRESHRSS_USER=--api-password d0fet0th3x --email 3nigma.matt@gmail.com --password d0fet0th3x --user ginnoir
+OIDC_CLIENT_ID=5DYeBheXidDAErkLTTMFBB4xdC734MoHQ2xNyVWp
+OIDC_CLIENT_SECRET=4s9uiOgTla9euoVlvEgYNpqSGLOaxm0WG4tchUhzHYCjNyOeYQ2s426OaBAwV0YtXDXplCUhkCKNm6q0GCfpSZADhJo2L6nkRuCqFtuA3454Wpjf8ArRVYKwJqdGQePH
+OIDC_CLIENT_CRYPTO_KEY=7f3a9c2e1b8d4f6a0e5c8b2d9f1a4e7