Ship homelab quick wins: Recyclarr, infra pins, jd.ginnoir.com, and LAN lockdown.

Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.

stacks/resume/docker-compose.yml

@@ -11,6 +11,8 @@ services:
     container_name: postgres_resume
     image: postgres:16-alpine
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [resume]
     volumes:
       - /config/resume/postgres:/var/lib/postgresql/data
@@ -27,8 +29,10 @@ services:
 
   resume-minio:
     container_name: minio_resume
-    image: minio/minio:latest
+    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [resume, edge]
     command: server /data --console-address :9001
     ports:
@@ -93,6 +97,10 @@ services:
       - STORAGE_BUCKET=default
       - STORAGE_USE_SSL=false
       - STORAGE_SKIP_BUCKET_CHECK=false
+      - OAUTH_PROVIDER_NAME=Authentik
+      - OAUTH_DISCOVERY_URL=https://auth.ginnoir.com/application/o/resume/.well-known/openid-configuration
+      - FLAG_DISABLE_EMAIL_AUTH=true
+      - FLAG_DISABLE_SIGNUPS=true
 
 networks:
   resume:

stacks/resume/stack.env

@@ -24,3 +24,5 @@ STORAGE_SECRET_KEY=minioadmin
 # Pinned to the running value so recreating the container keeps sessions valid.
 # Rotate with: openssl rand -hex 64
 AUTH_SECRET=1b7e96f61f080d04d4bf673d9ea1d9349eb7693cddee5772b6c3f153c88032db5b97efd8570087bc6f340d2cd874aabc1e5c681bc22889921240d6a23738bc7f
+OAUTH_CLIENT_ID=YpMFNp9q5mGbN8ADM5rUol0ERHmSiTDClJKIVOxK
+OAUTH_CLIENT_SECRET=mzwjSt0Xtibo156km61T7VYerT48K6ZTa79cEek4mgdky6t1Sjaddlshw2QcJL8727N6qWzddi2ihxNGSpUVMXUBbjNgx4jtkHAy5xtmvqdk9ouIFclyhCgXh9fzjMCA