0.6.0 (2025-12-31)

[0.6.0] - 2025-12-31

• SSH keys are now configured in inventory via users..authorized_keys (single source of truth). The old CLI option to inject administrator keys and the inventory files-based authorized_keys copy were removed.

• Administrator login is enforced to be key-based: playbooks fail early if users.administrator.authorized_keys is empty.

• Backup user SSH access was hardened: backup keys are wrapped with a forced command wrapper and written via the shared user role; config is now users.backup.authorized_keys.

• Token handling was unified: Mailu and Matomo now read tokens from users.*.tokens (mailu_token legacy removed), and a token-store hydration mechanism loads persisted tokens automatically.

• Matomo integration is safer: it now fails fast on empty tokens and consistently uses the hydrated users.administrator.tokens value for API calls.

• Backup/cleanup services are more reliable: run-once flags execute earlier, user-backup is an explicit dependency, and cleanback now uses a configurable backups root and keeps the newest backups by default (force-keep=3).

• Better cross-distro stability: sys-pip-install now resolves the correct pip executable dynamically and uses ansible.builtin.pip, reducing interpreter/PATH mismatches; plus CoreDNS is a compose dependency and yay auto-rebuilds if the binary is broken after libalpm ABI changes.