The Bitnami chart and images stop at 3.5.0. Run Discourse 2026.10.0 from
an image built with the official launcher, on PostgreSQL 18, reusing the
existing uploads volume, Redis and secrets.
Update the Dex sign-in step for the new image paths, drop the removed
LDAP setting, and keep chat off now that it is bundled in core. The image
adds a real-IP rule so visitors are not all rate limited as the ingress.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Gmail and other large providers refuse mail sent directly from our
residential IP. Send outbound mail through an SES SMTP relay configured
from the vault (mail_relay_host, mail_relay_user, mail_relay_password).
Unset values fall back to direct delivery.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The LDAP domain filter matched every entry with a mail attribute, so
membership accounts with external addresses (e.g. @gmail.com) made
those domains local and outbound mail to them bounced with 550 5.1.1.
Restrict the filter to the Postfix Users group, like the user filter.
Pin docker-mailserver to 15.1.0: v17 renamed the LDAP_QUERY_FILTER_*
variables and chowns /var/mail to 5000:5000 at startup, which breaks
this LDAP uid-per-mailbox setup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop discourse-ldap-auth (its authenticator ignores ldap_enabled) and
add an idempotent settings script, run after deploy, that disables
LDAP login and installs a theme component sending Sign Up to
www.eom.dev/members.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The chart defaulted to the "nano" preset (192Mi memory limit), which
Prometheus outgrew, leaving it OOM-killed in a crash loop for ~25 days.
Request 250m/1Gi and limit 1 CPU/2Gi instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Grafana now has its own role (DevOps/ansible-role-grafana). Remove its
tasks and LDAP template from this role and drop it from full.yaml.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This change was made to recover from an update made while attempting to address DevOps/ansible-role-eom#37, which was not solved here.
Reviewed-on: #38
claudeandClaude Opus 5.5
