Fix critical discrepancies found during validation audit

- Fix cert resolver name (cloudflare -> letsencrypt)
- Fix volume paths (/mnt/nas -> /data)
- Add missing custom port mappings
- Add privileged/capability flags
- Add 8 new roles: portainer, n8n, nodered, influxdb, guacamole, watchtower, rtlamr2mqtt, telegraf
- Fix Traefik template (ports, ACME path, wildcard cert)
- Add extra volume mounts for media services

roles/guacamole/defaults/main.yml

@@ -0,0 +1,7 @@
+---
+guacamole_compose_dir: "{{ docker_compose_base }}/guacamole"
+guacamole_image: "guacamole/guacamole"
+guacd_image: "guacamole/guacd"
+guacamole_db_image: "mysql:8.0"
+guacamole_db_password: "{{ vault_guacamole_db_password | default('changeme') }}"
+guacamole_host: "solo.{{ domain }}"

roles/guacamole/tasks/main.yml

@@ -0,0 +1,14 @@
+---
+- name: Create guacamole compose directory
+  file:
+    path: "{{ guacamole_compose_dir }}"
+    state: directory
+- name: Deploy guacamole compose file
+  template:
+    src: docker-compose.yml.j2
+    dest: "{{ guacamole_compose_dir }}/docker-compose.yml"
+  notify: restart guacamole
+- name: Start guacamole
+  community.docker.docker_compose_v2:
+    project_src: "{{ guacamole_compose_dir }}"
+    state: present

roles/guacamole/templates/docker-compose.yml.j2

@@ -0,0 +1,54 @@
+services:
+  guacd:
+    image: {{ guacd_image }}
+    container_name: guacd
+    restart: unless-stopped
+    volumes:
+      - /data/guacamole/record:/record
+      - /data/guacamole:/drive
+    networks:
+      - guacamole_internal
+      - {{ docker_network_name }}
+
+  guacamole-db:
+    image: {{ guacamole_db_image }}
+    container_name: guacamole-db
+    restart: unless-stopped
+    environment:
+      MYSQL_ROOT_PASSWORD: {{ guacamole_db_password }}
+      MYSQL_DATABASE: guacamole_db
+      MYSQL_USER: guacamole
+      MYSQL_PASSWORD: {{ guacamole_db_password }}
+    volumes:
+      - /data/guacamole/mysql:/var/lib/mysql
+    networks:
+      - guacamole_internal
+
+  guacamole:
+    image: {{ guacamole_image }}
+    container_name: guacamole
+    restart: unless-stopped
+    environment:
+      GUACD_HOSTNAME: guacd
+      MYSQL_HOSTNAME: guacamole-db
+      MYSQL_DATABASE: guacamole_db
+      MYSQL_USER: guacamole
+      MYSQL_PASSWORD: {{ guacamole_db_password }}
+    depends_on:
+      - guacd
+      - guacamole-db
+    labels:
+      traefik.enable: "true"
+      traefik.http.routers.guacamole.rule: "Host(`{{ guacamole_host }}`)"
+      traefik.http.routers.guacamole.entrypoints: websecure
+      traefik.http.routers.guacamole.tls.certresolver: letsencrypt
+      traefik.http.services.guacamole.loadbalancer.server.port: "8080"
+    networks:
+      - guacamole_internal
+      - {{ docker_network_name }}
+
+networks:
+  guacamole_internal:
+    driver: bridge
+  {{ docker_network_name }}:
+    external: true