# LubeLogger — deployment source of truth

Vehicle & small-engine maintenance tracker. **Host:** docker-node01 (.186).
Postgres 18 backend (tables in the `app` schema). In-app auth ENABLED (root user).

## Routing (file provider)
Published on the host at `:8099`; Traefik on node01 routes `lubelogger.goattw.net`
→ `http://192.168.99.186:8099` via `dynamic_conf.yml` (see `traefik-router.dynamic_conf.yml`).
Edge chain: TLS (letsencrypt) → CrowdSec (global) → Authelia (`authelia-auth@file`,
`two_factor` off-LAN / bypass on-LAN). LubeLogger's own auth gates the LAN/`:8099` path.

## Deploy (Ansible, idempotent)
Playbook `deploy-lubelogger.yml` (runs from `~/ansible` on ansible-control):
```
ansible-playbook playbooks/deploy-lubelogger.yml
```
Inline-compose house style: `copy:` the compose + `community.docker.docker_compose_v2`.
DB password is sourced from ansible-vault (`vault_lubelogger_db_password`) — never inline.
Second converge is `changed=0`.

## Backup (PBS)
`lubelogger-backup.{sh,service,timer}` on node01 — daily 03:30, `pg_dump` → PBS
(`rust-usb`, host/lubelogger), prune `--keep-daily 14`. PBS creds live in
`/etc/lubelogger-backup.env` (root:600, NOT in git). Restore verified via full
PBS round-trip into a throwaway postgres:18 (live↔restored row-count parity).
NOTE: the `lubelogger-data`/`lubelogger-keys` volumes (uploads, config, the ROOT USER
credential, ASP.NET keyring) are a SEPARATE layer — covered by docker-volume-backup
(`stop-during-backup` labels already set). pg_dump captures Postgres data only.

## Reminders → ntfy
`lubelogger-reminders-probe.{sh}` + units on ansible-control (.190) — daily 07:30.
Reads `/api/vehicle/info` (Basic auth, creds in `/etc/lubelogger-reminders.env`,
root:600, NOT in git), posts a digest to ntfy topic **garage** only when something is
due/overdue. Subscribe to the `garage` topic in your ntfy app to receive it.

## Diun
App carries `diun.watch_repo=true` + semver `include_tags` so a new release tag pings
the existing Diun→HA-webhook pipeline. DB (`postgres:18`) is watched by default (digest).

## Homepage
Tile + `lubelogger` widget under "AI & Productivity" in
`observability/homepage/services.yaml` (live) — widget password via
`HOMEPAGE_VAR_LUBELOGGER_PASSWORD` (observability/.env, not a git repo). See
`homepage-tile.yaml`.

## Secrets (none in this repo)
- DB password: ansible-vault (`~/ansible`), and Postgres volume (already initialized).
- PBS token: `/etc/lubelogger-backup.env` (reuses vaultwarden token — a dedicated
  `lubelogger-backup` PBS token would be cleaner; needs PBS root to create).
- Admin/basic-auth password: `/etc/lubelogger-reminders.env` + `observability/.env`.