Fix SSL wildcard certificate setup

- Remove individual certresolver labels from all services except Traefik
- Configure wildcard certificate (*.kelin-hass.duckdns.org) on Traefik only
- Remove AUTHELIA_NOTIFIER_SMTP_PASSWORD env var (filesystem notifier only)
- Fix infrastructure.yml networks section syntax
- Add wildcard SSL certificate setup action report

All services now use single wildcard Let's Encrypt certificate.
Resolves DNS challenge conflicts with DuckDNS provider.

docker-compose/infrastructure.yml

@@ -28,34 +28,10 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.dockge.rule=Host(`dockge.${DOMAIN}`)"
       - "traefik.http.routers.dockge.entrypoints=websecure"
-      - "traefik.http.routers.dockge.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.dockge.tls=true"
       - "traefik.http.routers.dockge.middlewares=authelia@docker"
       - "traefik.http.services.dockge.loadbalancer.server.port=5001"
 
-  # Portainer - Docker management UI (SECONDARY - use Dockge instead)
-  # Access at: https://portainer.${DOMAIN}
-  portainer:
-    image: portainer/portainer-ce:2.19.4
-    container_name: portainer
-    restart: unless-stopped
-    networks:
-      - homelab-network
-      - traefik-network
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - portainer-data:/data
-    security_opt:
-      - no-new-privileges:true
-    labels:
-      - "homelab.category=infrastructure"
-      - "homelab.description=Docker container management UI (SECONDARY)"
-      - "traefik.enable=true"
-      - "traefik.http.routers.portainer.rule=Host(`portainer.${DOMAIN}`)"
-      - "traefik.http.routers.portainer.entrypoints=websecure"
-      - "traefik.http.routers.portainer.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.portainer.middlewares=authelia@docker"
-      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
-
   # Pi-hole - Network-wide ad blocker and DNS server
   # Access at: https://pihole.${DOMAIN}
   pihole:
@@ -86,7 +62,7 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.pihole.rule=Host(`pihole.${DOMAIN}`)"
       - "traefik.http.routers.pihole.entrypoints=websecure"
-      - "traefik.http.routers.pihole.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.pihole.tls=true"
       - "traefik.http.routers.pihole.middlewares=authelia@docker"
       - "traefik.http.services.pihole.loadbalancer.server.port=80"
 
@@ -131,7 +107,7 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.dozzle.rule=Host(`dozzle.${DOMAIN}`)"
       - "traefik.http.routers.dozzle.entrypoints=websecure"
-      - "traefik.http.routers.dozzle.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.dozzle.tls=true"
       - "traefik.http.routers.dozzle.middlewares=authelia@docker"
       - "traefik.http.services.dozzle.loadbalancer.server.port=8080"
 
@@ -178,125 +154,14 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.glances.rule=Host(`glances.${DOMAIN}`)"
       - "traefik.http.routers.glances.entrypoints=websecure"
-      - "traefik.http.routers.glances.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.glances.tls=true"
       - "traefik.http.routers.glances.middlewares=authelia@docker"
       - "traefik.http.services.glances.loadbalancer.server.port=61208"
 
-  # Authentik - Alternative SSO/Identity Provider with Web UI
-  # Access at: https://authentik.${DOMAIN}
-  # NOTE: Authelia is the default SSO. Deploy Authentik only if you need a web UI for user management
-  authentik-server:
-    image: ghcr.io/goauthentik/server:2024.2.0
-    container_name: authentik-server
-    restart: unless-stopped
-    command: server
-    networks:
-      - homelab-network
-      - traefik-network
-    volumes:
-      - /opt/stacks/authentik/media:/media
-      - /opt/stacks/authentik/custom-templates:/templates
-    environment:
-      - AUTHENTIK_REDIS__HOST=authentik-redis
-      - AUTHENTIK_POSTGRESQL__HOST=authentik-db
-      - AUTHENTIK_POSTGRESQL__USER=${AUTHENTIK_DB_USER:-authentik}
-      - AUTHENTIK_POSTGRESQL__NAME=${AUTHENTIK_DB_NAME:-authentik}
-      - AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_DB_PASSWORD}
-      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
-      - AUTHENTIK_ERROR_REPORTING__ENABLED=false
-    labels:
-      - "homelab.category=infrastructure"
-      - "homelab.description=SSO/Identity provider with web UI (alternative to Authelia)"
-      - "traefik.enable=true"
-      - "traefik.http.routers.authentik.rule=Host(`authentik.${DOMAIN}`)"
-      - "traefik.http.routers.authentik.entrypoints=websecure"
-      - "traefik.http.routers.authentik.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.authentik.middlewares=authelia@docker"
-      - "traefik.http.services.authentik.loadbalancer.server.port=9000"
-    depends_on:
-      - authentik-db
-      - authentik-redis
-
-  # Authentik Worker - Background task processor
-  authentik-worker:
-    image: ghcr.io/goauthentik/server:2024.2.0
-    container_name: authentik-worker
-    restart: unless-stopped
-    command: worker
-    networks:
-      - homelab-network
-    volumes:
-      - /opt/stacks/authentik/media:/media
-      - /opt/stacks/authentik/certs:/certs
-      - /opt/stacks/authentik/custom-templates:/templates
-    environment:
-      - AUTHENTIK_REDIS__HOST=authentik-redis
-      - AUTHENTIK_POSTGRESQL__HOST=authentik-db
-      - AUTHENTIK_POSTGRESQL__USER=${AUTHENTIK_DB_USER:-authentik}
-      - AUTHENTIK_POSTGRESQL__NAME=${AUTHENTIK_DB_NAME:-authentik}
-      - AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_DB_PASSWORD}
-      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
-      - AUTHENTIK_ERROR_REPORTING__ENABLED=false
-    labels:
-      - "homelab.category=infrastructure"
-      - "homelab.description=Authentik background worker"
-    depends_on:
-      - authentik-db
-      - authentik-redis
-
-  # Authentik Database - PostgreSQL
-  authentik-db:
-    image: postgres:16-alpine
-    container_name: authentik-db
-    restart: unless-stopped
-    networks:
-      - homelab-network
-    volumes:
-      - authentik-db-data:/var/lib/postgresql/data
-    environment:
-      - POSTGRES_USER=${AUTHENTIK_DB_USER:-authentik}
-      - POSTGRES_PASSWORD=${AUTHENTIK_DB_PASSWORD}
-      - POSTGRES_DB=${AUTHENTIK_DB_NAME:-authentik}
-    labels:
-      - "homelab.category=infrastructure"
-      - "homelab.description=Authentik database"
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${AUTHENTIK_DB_USER:-authentik}"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  # Authentik Redis - Cache and message queue
-  authentik-redis:
-    image: redis:7-alpine
-    container_name: authentik-redis
-    restart: unless-stopped
-    networks:
-      - homelab-network
-    volumes:
-      - authentik-redis-data:/data
-    command: --save 60 1 --loglevel warning
-    labels:
-      - "homelab.category=infrastructure"
-      - "homelab.description=Authentik cache and messaging"
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
-      interval: 10s
-      timeout: 3s
-      retries: 5
-
-volumes:
-  portainer-data:
-    driver: local
-  authentik-db-data:
-    driver: local
-  authentik-redis-data:
-    driver: local
-
 networks:
-  homelab-network:
-    external: true
   traefik-network:
     external: true
+  homelab-network:
+    driver: bridge
   dockerproxy-network:
     driver: bridge