diff --git a/ansible/inventory/group_vars/all.yaml b/ansible/inventory/group_vars/all.yaml
index 36fb6b9..9845efd 100644
--- a/ansible/inventory/group_vars/all.yaml
+++ b/ansible/inventory/group_vars/all.yaml
@@ -259,6 +259,16 @@ services:
     dependency:
       web: "app-public"
       db: "postgresql"
+  bookstack:
+    domain:
+      public: "bookstack"
+      internal: "bookstack.app"
+    ports:
+      http: "8004"
+    subuid: "100032"
+    dependency:
+      web: "app-public"
+      db: "mariadb"
   sure:
     domain:
       public: "sure"
@@ -366,3 +376,4 @@ version:
     papra: "26.6.1-rootless"
     romm: "5.1.0"
     tandoor: "2.6.13"
+    bookstack: "26.5.3"
diff --git a/ansible/inventory/host_vars/fw.yaml b/ansible/inventory/host_vars/fw.yaml
index 4d05d57..b71ce53 100644
--- a/ansible/inventory/host_vars/fw.yaml
+++ b/ansible/inventory/host_vars/fw.yaml
@@ -42,6 +42,9 @@ network:
       server: "fd00:10::/64"
       wg: "fd00:99::/64"
       lla: "fe80::/10"
+  podman:
+    ipv4:
+      lla: "169.254.1.2"
   reverse_zone:
     ipv4:
       client: "1.168.192.in-addr.arpa"
@@ -117,6 +120,7 @@ network:
     alias:
       - "ca"
       - "postgresql"
+      - "mariadb"
       - "ldap"
       - "maddy"
       - "prometheus"
diff --git a/ansible/playbooks/app/site.yaml b/ansible/playbooks/app/site.yaml
index 41c54c7..98f0845 100644
--- a/ansible/playbooks/app/site.yaml
+++ b/ansible/playbooks/app/site.yaml
@@ -282,6 +282,14 @@
           tags: ["site", "tandoor"]
       tags: ["site", "tandoor"]
 
+    - name: Set bookstack
+      ansible.builtin.include_role:
+        name: "app"
+        tasks_from: "services/set_bookstack"
+        apply:
+          tags: ["site", "bookstack"]
+      tags: ["site", "bookstack"]
+
     - name: Set romm
       ansible.builtin.include_role:
         name: "app"
diff --git a/ansible/roles/app/handlers/main.yaml b/ansible/roles/app/handlers/main.yaml
index 576eeb8..e458e01 100644
--- a/ansible/roles/app/handlers/main.yaml
+++ b/ansible/roles/app/handlers/main.yaml
@@ -197,3 +197,14 @@
   changed_when: false
   listen: "notification_restart_tandoor"
   ignore_errors: true # noqa: ignore-errors
+
+- name: Restart bookstack
+  ansible.builtin.systemd:
+    name: "bookstack.service"
+    state: "restarted"
+    enabled: true
+    scope: "user"
+    daemon_reload: true
+  changed_when: false
+  listen: "notification_restart_bookstack"
+  ignore_errors: true # noqa: ignore-errors
diff --git a/ansible/roles/app/tasks/services/set_booklogr.yaml b/ansible/roles/app/tasks/services/set_booklogr.yaml
index bf5f23f..913e558 100644
--- a/ansible/roles/app/tasks/services/set_booklogr.yaml
+++ b/ansible/roles/app/tasks/services/set_booklogr.yaml
@@ -12,7 +12,6 @@
     - "data/containers/booklogr/export_data"
     - "containers/booklogr"
     - "containers/booklogr/ssl"
-  become: true
 
 
 - name: Deploy root certificate
@@ -23,7 +22,6 @@
     owner: "{{ ansible_user }}"
     group: "{{ node['group'] }}"
     mode: "0440"
-  become: true
   notify: "notification_restart_booklogr"
   no_log: true
 
diff --git a/ansible/roles/app/tasks/services/set_bookstack.yaml b/ansible/roles/app/tasks/services/set_bookstack.yaml
new file mode 100644
index 0000000..0e30154
--- /dev/null
+++ b/ansible/roles/app/tasks/services/set_bookstack.yaml
@@ -0,0 +1,88 @@
+---
+- name: Create bookstack directory
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/{{ item }}"
+    state: "directory"
+    owner: "{{ services['bookstack']['subuid'] }}"
+    group: "{{ node['group'] }}"
+    mode: "0770"
+  loop:
+    - "data/containers/bookstack"
+    - "data/containers/bookstack/public"
+    - "data/containers/bookstack/storage"
+    - "containers/bookstack"
+    - "containers/bookstack/ssl"
+  become: true
+
+
+- name: Deploy root certificate
+  ansible.builtin.copy:
+    content: |
+      {{ hostvars['console']['ca']['root']['crt'] }}
+    dest: "{{ node['home_path'] }}/containers/bookstack/ssl/{{ root_cert_filename }}"
+    owner: "{{ services['bookstack']['subuid'] }}"
+    group: "{{ node['group'] }}"
+    mode: "0440"
+  become: true
+  notify: "notification_restart_bookstack"
+  no_log: true
+
+- name: Register secret value to podman secret
+  containers.podman.podman_secret:
+    name: "{{ item.name }}"
+    data: "{{ item.value }}"
+    state: "present"
+    force: true
+  loop:
+    - name: "BOOKSTACK_SECRET_KEY"
+      value: "{{ hostvars['console']['bookstack']['secret_key'] }}"
+    - name: "BOOKSTACK_DB_PASSWORD"
+      value: "{{ hostvars['console']['mariadb']['password']['bookstack'] }}"
+    - name: "BOOKSTACK_OIDC_CLIENT_SECRET"
+      value: "{{ hostvars['console']['bookstack']['oidc']['secret'] }}"
+  notify: "notification_restart_bookstack"
+  no_log: true
+
+- name: Pull image
+  containers.podman.podman_image:
+    name: "docker.io/solidnerd/bookstack"
+    tag: "{{ version['containers']['bookstack'] }}"
+    state: "present"
+    pull: true
+
+- name: Deploy bookstack.container file
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/bookstack/bookstack.container.j2"
+    dest: "{{ node['home_path'] }}/.config/containers/systemd/bookstack.container"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0644"
+  notify: "notification_restart_bookstack"
+
+- name: Enable bookstack.service
+  ansible.builtin.systemd:
+    name: "bookstack.service"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+    scope: "user"
+
+- name: Check container archive images
+  ansible.builtin.stat:
+    path: "{{ node['home_path'] }}/archives/containers/docker.io_solidnerd_bookstack_{{ version['containers']['bookstack'] }}.tar"
+  register: container_archive_images
+
+- name: Save container archive images
+  containers.podman.podman_save:
+    image:
+      - "docker.io/solidnerd/bookstack:{{ version['containers']['bookstack'] }}"
+    dest: "{{ node['home_path'] }}/archives/containers/docker.io_solidnerd_bookstack_{{ version['containers']['bookstack'] }}.tar"
+    format: "oci-archive"
+    force: false
+  when: not container_archive_images.stat.exists
+
+- name: Fetch container archive images
+  ansible.builtin.fetch:
+    src: "{{ node['home_path'] }}/archives/containers/docker.io_solidnerd_bookstack_{{ version['containers']['bookstack'] }}.tar"
+    dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/"
+    flat: true
diff --git a/ansible/roles/infra/tasks/services/set_mariadb.yaml b/ansible/roles/infra/tasks/services/set_mariadb.yaml
index f8a406a..273a3ee 100644
--- a/ansible/roles/infra/tasks/services/set_mariadb.yaml
+++ b/ansible/roles/infra/tasks/services/set_mariadb.yaml
@@ -179,19 +179,19 @@
 
 - name: Check container archive images
   ansible.builtin.stat:
-    path: "{{ node['home_path'] }}/archives/containers/docker.io_library_mariadb_{{ version['containers']['mariadb'] }}"
+    path: "{{ node['home_path'] }}/archives/containers/docker.io_library_mariadb_{{ version['containers']['mariadb'] }}.tar"
   register: container_archive_images
 
 - name: Save container archive images
   containers.podman.podman_save:
     image:
       - "docker.io/library/mariadb:{{ version['containers']['mariadb'] }}"
-    dest: "{{ node['home_path'] }}/archives/containers/docker.io_library_mariadb_{{ version['containers']['mariadb'] }}"
+    dest: "{{ node['home_path'] }}/archives/containers/docker.io_library_mariadb_{{ version['containers']['mariadb'] }}.tar"
     format: "oci-archive"
   when: not container_archive_images.stat.exists
 
 - name: Fetch container archive images
   ansible.builtin.fetch:
-    src: "{{ node['home_path'] }}/archives/containers/docker.io_library_mariadb_{{ version['containers']['mariadb'] }}"
+    src: "{{ node['home_path'] }}/archives/containers/docker.io_library_mariadb_{{ version['containers']['mariadb'] }}.tar"
     dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/"
     flat: true
diff --git a/config/secrets/secrets.yaml b/config/secrets/secrets.yaml
index 1a06f82..4dfe758 100644
--- a/config/secrets/secrets.yaml
+++ b/config/secrets/secrets.yaml
@@ -148,7 +148,8 @@ postgresql:
 mariadb:
     key: ENC[AES256_GCM,data:JsEzdgp0RdLRuZ6vfOugPGjz5+tBlpZpWhFOSkKSbEeUCU9D/IkAFUcZGwCBR4XBl2cOx8uszCryi6Cxm2L1fT+x6N9auMiM07W0A34kT5PMT3w+n+wQx48Ss0fZRH1kfH2tg8G4J5ASvl0dylGnuv1aIGFsmD+6Ygj+F2AFef6Y/+Sje24QKeyISU9+2tsfTNoRAH9ECxdIk2cI14ayQbISaTlBhlzciL/bzvRqqtz6KoB2HYj2YX5EK/zVRpBwkssbMsGR/LMepUWyg2hic78gc+UGK9FAkfCd1ctFQyUgsck=,iv:dSvRa+wdKPXhz+SI+69eT/YDAIoWMTcouZJQHgRIdRU=,tag:pEz/doDqhB+hnDMRMS5CqQ==,type:str]
     crt: ENC[AES256_GCM,data:D9/6WbvHwaetFQY/MQMq7F3Oprz8aiY2B6urDCXhwqDD1ipqDaVT/g3Q87LsauCJiwaflCcTms7I0ulQIHUyiqHUrDmE+yxzeEIAwFHVaxr34FURnGHLKFPlKvvBcLC28WjWIYbdaNbfjtZTORZwiLVqZgNoM91rFJDDbTlo+a4OBip40nk8/UPv5NGIApGzJlcc3UZevGsbEeu5g12KfbfaW7mMnor5my7zsvUQclNdWFyOlCUmWDHjHvjwWSPom9AlTnDVoGnePdigfeEEbz19kxGGjL+li48buskbnXPTR8/4G9OHT+yiQtszNq9mZTxyTXRagzpIzYQjBK4/Ww+lLOHgaKG4awrSR2Y8NLZfPsbaJVWg+XvkI9E9s1LfXs/hBsRD6f26joFzXVQpZgzuWqrwSBtnP3LY10KygxVN+kbLHCxIxohM6SH/rM5eMRGftZlPQMZTIxzirjF7YZcdtvRFtd8BYmksYaEuQ6PnFroh7xv9M/5GDaEpkkQngiRkxrXfHaExjOBZvgtUV2R+7Tzd5odu8Rj7nfZOySlPy0qifVODSFbIKYN0HVqYur0PxLZD10xzx1PfwBWvnR1U0QzTVbbxGD2vDPf9SJEuREcWsOwNzM9snuuR7S3uzDX28MwvyAeALYz7PWhC6jEhgUyEShuzAn7BNsJySgPrRcgrP5s5fQU3Fkjfg/s8DYXFxFCRELT0pNf7TjFsW/tevxonlhzAbGXMnNiB3vwHyh/dPLQA8Lq0MDsLPWuiDy+cuoq9k22hIOJOrmnoEIEqErp2W5VAliFYBj6QKav/f+2XxK4iNA/vcZcFdp5w4tC8h3GNVXHVmJrgPT0wkajOE1UBgHwTxns0EJtUTGNDY4B8kdKHONDqFscq+1WCHah69Dq1UD1rOQDeSlfyso+N5w0f2GsxPmGnROXWLxm+VMQfe4PQPdSrrRcW,iv:LuX8l49se20frOc6qIBopqn99DRFzi2o9BfHqfL+CBg=,tag:sq8Wei7DZJPgPMSK1IlJSw==,type:str]
-    password: ""
+    password:
+        bookstack: ENC[AES256_GCM,data:kFQ47qbE+D89Pjr4B6WMAcCHQ8deCyzaPmNspI5TvqwvN5RIaKOWU1uT4jU=,iv:3OiYzBod2xxKMt/5Q9uazalld1NkUNun+DJipC3Ts+w=,tag:orCNWYMAZ/5yi7c6apXVJg==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
@@ -360,6 +361,15 @@ tandoor:
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
+#ENC[AES256_GCM,data:yiiJIGjYsvXc/Gswhbn4wI4v,iv:YrG8oCVLYDi+ERDYMjcWqSblelPFgCpYCmxL+BUC8sE=,tag:Z9r6kk6CgodIzRDXaY33Mg==,type:comment]
+bookstack:
+    secret_key: ENC[AES256_GCM,data:O8OkaNnD/J241SGKKJU9k8cocTXyQ/I2Q0IXtaBh4SR0pjQeZbpeU6q79T70U92or3Wj,iv:5sU2wonIFkymuMLSsU8x1ma2yv0Wf/Z3S5RDuIcGdn0=,tag:n0EhWB97MK8ZxBBeOlm+Jw==,type:str]
+    oidc:
+        secret: ENC[AES256_GCM,data:9GoEgOV+0PyT4A8hrEBzSg+fveSyFDYPCmrkQA48nIRP73kq2nZoznnxhSg=,iv:ues0Gu7aJio9lk+IiYP9wKJ0r73sc5snxbqPIZ1qyzM=,tag:QZP3NHJpgniC6sAEz6Fa7A==,type:str]
+        hash: ENC[AES256_GCM,data:5DBNQc7ooU5aRyK4O0j6f3OLpR12LniAvWEUd4IMltMhLvsEi64QkSst2Fur588v0Jv0P78M49LbqYiXYHl0oLfrCGEQafoqAY4IEpbbNm5aTb0ekQ1GDoshfp7wIO4NtkeOHeiozohi0UQK01PN2zM4GVihgFXZupsooeIoOo9i3i8=,iv:vVcC2gkky/DQ2rY62eZJYj9yhk6IXWr0TRDipOpFDYI=,tag:ZBGgF2iL5Qe+98LlHz98/Q==,type:str]
+#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
+#
+#
 #ENC[AES256_GCM,data:T4Wtn49AAxPd2QUFTR+q,iv:bH5goGWBDqumAat9dUv2OwfCUJUpuVqncTMqMBZUXhI=,tag:G+W6hHA+yftQ+4RJpXrxHg==,type:comment]
 switch:
     admin:
@@ -376,7 +386,7 @@ sops:
             k+uyWPPi+enFkVaceSwMFrA66uaWWrwAj11sXEB7yzvGFPrnAGezjQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age120wuwcmsm845ztsvsz46pswj5je53uc2n35vadklrfqudu6cxuusxetk7y
-    lastmodified: "2026-08-23T12:15:15Z"
-    mac: ENC[AES256_GCM,data:EKc4Ifpl/NIaPJ/QqGc3Bw+KDMtiZpi7dK1Um/axitORcdOCR0gfTAbtuaFp88Ss9hpHu1+hJYL3yYihELZz+7MDyiydSAC7QdGPeARwWa4XlCap//K7+W5Wpu+SRC8H/IE6jejuCF2LwsrnXYMssAlujLSXI65JIaOIrgn9nT8=,iv:iuQcoJdacW9OTRP05C25/BKaiqRUjEQl8ZhPKQavzIs=,tag:GDDJFqWOso34QN5oIwWung==,type:str]
+    lastmodified: "2026-08-25T11:14:10Z"
+    mac: ENC[AES256_GCM,data:623+guQizCIqncu+67AyQW+biKIThMlUi3+lypapWc6RjoUXs6iyvWHstjzUSbG4s9VsKsDBKsEy6VGFkP2JjypWzE6Ci/mRjlBe6jBpmlfiZ2tcDR3XCFBgpd+amKfX41zrsqhOt/ZVm7YHDfSsyLePG8n2/fTeGR2tE18ZVbM=,iv:vm0uShgwBOWL1tFVBukFRYEzZ4Ic6dc8OmFymhcrqPE=,tag:8IYrK4ueWySpFoahw09s5A==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2
diff --git a/config/services/containers/app/bookstack/bookstack.container.j2 b/config/services/containers/app/bookstack/bookstack.container.j2
new file mode 100644
index 0000000..83d9f12
--- /dev/null
+++ b/config/services/containers/app/bookstack/bookstack.container.j2
@@ -0,0 +1,60 @@
+[Quadlet]
+DefaultDependencies=false
+
+[Unit]
+Description=Bookstack
+
+[Container]
+Image=docker.io/solidnerd/bookstack:{{ version['containers']['bookstack'] }}
+
+ContainerName=bookstack
+HostName=bookstack
+
+PublishPort={{ services['bookstack']['ports']['http'] }}:8080/tcp
+
+# Volumes
+Volume=%h/data/containers/bookstack/public:/var/www/bookstack/public/uploads:rw
+Volume=%h/data/containers/bookstack/storage:/var/www/bookstack/storage/uploads:rw
+Volume=%h/containers/bookstack/ssl:/etc/ssl/bookstack:ro
+
+# General
+Environment="TZ={{ timezone }}"
+Environment="APP_ENV=production"
+Environment="APP_DEBUG=false"
+Environment="APP_URL=https://{{ services['bookstack']['domain']['public'] }}.{{ domain['public'] }}"
+# 169.254.1.2 is podman pasta APIPA ip address to communicate the other container in the same host
+Environment="APP_PROXIES={{ hostvars['fw']['network']['podman']['ipv4']['lla'] }},{{ hostvars['fw']['network']['auth']['ipv4']['server'] }},{{ hostvars['fw']['network']['auth']['ipv6']['server'] }}"
+
+# Secrets
+Secret=BOOKSTACK_SECRET_KEY,type=env,target=APP_KEY
+
+# Database (MariaDB)
+Environment="DB_HOST={{ services['mariadb']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['mariadb']['ports']['tcp'] }}"
+Environment="DB_DATABASE=bookstack_db"
+Environment="DB_USERNAME=bookstack"
+Environment="MYSQL_ATTR_SSL_CA=/etc/ssl/bookstack/{{ root_cert_filename }}"
+Secret=BOOKSTACK_DB_PASSWORD,type=env,target=DB_PASSWORD
+
+# OIDC
+Environment="AUTH_METHOD=oidc"
+Environment="AUTH_AUTO_INITIATE=false"
+Environment="OIDC_NAME=Authelia"
+Environment="OIDC_ISSUER=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}"
+Environment="OIDC_ISSUER_DISCOVER=true"
+Environment="OIDC_CLIENT_ID=bookstack"
+Environment="OIDC_ADDITIONAL_SCOPES=groups"
+Environment="OIDC_DISPLAY_NAME_CLAIMS=name"
+Environment="OIDC_GROUPS_CLAIM=groups"
+Environment="OIDC_USER_TO_GROUPS=true"
+Environment="OIDC_REMOVE_FROM_GROUPS=true"
+Environment="OIDC_END_SESSION_ENDPOINT=false"
+Secret=BOOKSTACK_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
+
+[Service]
+ExecStartPre=/usr/bin/nc -zv {{ services['mariadb']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['mariadb']['ports']['tcp'] }}
+Restart=always
+RestartSec=10s
+TimeoutStopSec=120
+
+[Install]
+WantedBy=default.target
diff --git a/config/services/containers/app/gitea/gitea.container.j2 b/config/services/containers/app/gitea/gitea.container.j2
index eafc847..c789dc0 100644
--- a/config/services/containers/app/gitea/gitea.container.j2
+++ b/config/services/containers/app/gitea/gitea.container.j2
@@ -21,6 +21,8 @@ Volume=%h/containers/gitea/ssl:/etc/ssl/gitea:ro
 # General
 Environment="TZ={{ timezone }}"
 Environment="GITEA__server__DISABLE_SSH=true"
+Environment="GITEA__server__REVERSE_PROXY_LIMIT=2"
+Environment="GITEA__server__REVERSE_PROXY_TRUSTED_PROXIES={{ hostvars['fw']['network']['podman']['ipv4']['lla'] }},{{ hostvars['fw']['network']['auth']['ipv4']['server'] }},{{ hostvars['fw']['network']['auth']['ipv6']['server'] }}"
 # Database
 Environment="GITEA__database__DB_TYPE=postgres"
 Environment="GITEA__database__HOST={{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['postgresql']['ports']['tcp'] }}"
diff --git a/config/services/containers/app/immich/immich.container.j2 b/config/services/containers/app/immich/immich.container.j2
index 7ee05c8..763cf7a 100644
--- a/config/services/containers/app/immich/immich.container.j2
+++ b/config/services/containers/app/immich/immich.container.j2
@@ -27,6 +27,7 @@ Volume=%h/containers/immich/ssl:/etc/ssl/immich:ro
 Environment="TZ={{ timezone }}"
 # The new environment from version 2.7.0 to enable CSP
 Environment="IMMICH_HELMET_FILE=true"
+Environment="IMMICH_TRUSTED_PROXIES={{ hostvars['fw']['network']['podman']['ipv4']['lla'] }},{{ hostvars['fw']['network']['auth']['ipv4']['server'] }},{{ hostvars['fw']['network']['auth']['ipv6']['server'] }}"
 
 # Redis
 Environment="REDIS_HOSTNAME=host.containers.internal"
diff --git a/config/services/containers/app/mastodon/mastodon-streaming.container.j2 b/config/services/containers/app/mastodon/mastodon-streaming.container.j2
index 0046b19..797b6e6 100644
--- a/config/services/containers/app/mastodon/mastodon-streaming.container.j2
+++ b/config/services/containers/app/mastodon/mastodon-streaming.container.j2
@@ -20,6 +20,7 @@ Volume=%h/containers/mastodon/ssl:/etc/ssl/mastodon:ro
 Environment="TZ={{ timezone }}"
 Environment="LOCAL_DOMAIN={{ services['mastodon']['domain']['public'] }}.{{ domain['public'] }}"
 Environment="LOG_LEVEL=info"
+Environment="TRUSTED_PROXY_IP={{ hostvars['fw']['network']['podman']['ipv4']['lla'] }},{{ hostvars['fw']['network']['auth']['ipv4']['server'] }},{{ hostvars['fw']['network']['auth']['ipv6']['server'] }}"
 
 # PostgreSQL
 Environment="DB_HOST={{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}"
diff --git a/config/services/containers/app/mastodon/mastodon-web.container.j2 b/config/services/containers/app/mastodon/mastodon-web.container.j2
index 863c651..c801894 100644
--- a/config/services/containers/app/mastodon/mastodon-web.container.j2
+++ b/config/services/containers/app/mastodon/mastodon-web.container.j2
@@ -25,6 +25,7 @@ Environment="LIMITED_FEDERATION_MODE=true"
 Environment="DISALLOW_UNAUTHENTICATED_API_ACCESS=true"
 Environment="ES_ENABLED=false"
 Environment="RAILS_LOG_LEVEL=info"
+Environment="TRUSTED_PROXY_IP={{ hostvars['fw']['network']['podman']['ipv4']['lla'] }},{{ hostvars['fw']['network']['auth']['ipv4']['server'] }},{{ hostvars['fw']['network']['auth']['ipv6']['server'] }}"
 
 # PostgreSQL
 Environment="DB_HOST={{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}"
diff --git a/config/services/containers/app/nextcloud/nextcloud.container.j2 b/config/services/containers/app/nextcloud/nextcloud.container.j2
index 79edc29..5fe17bb 100644
--- a/config/services/containers/app/nextcloud/nextcloud.container.j2
+++ b/config/services/containers/app/nextcloud/nextcloud.container.j2
@@ -21,6 +21,8 @@ Volume=%h/data/containers/nextcloud/html:/var/www/html:rw
 
 # General
 Environment="TZ={{ timezone }}"
+Environment="APACHE_DISABLE_REWRITE_IP=1"
+Environment="TRUSTED_PROXIES={{ hostvars['fw']['network']['podman']['ipv4']['lla'] }} {{ hostvars['fw']['network']['auth']['ipv4']['server'] }} {{ hostvars['fw']['network']['auth']['ipv6']['server'] }}"
 # PostgreSQL
 Environment="PGSSLMODE=verify-full"
 Environment="PGSSLROOTCERT=/etc/ssl/nextcloud/{{ root_cert_filename }}"
diff --git a/config/services/containers/auth/authelia/config/authelia.yaml.j2 b/config/services/containers/auth/authelia/config/authelia.yaml.j2
index 466f2b3..ea50b0f 100644
--- a/config/services/containers/auth/authelia/config/authelia.yaml.j2
+++ b/config/services/containers/auth/authelia/config/authelia.yaml.j2
@@ -389,7 +389,7 @@ identity_providers:
       - client_id: 'tandoor'
         client_name: 'tandoor'
         consent_mode: 'implicit'
-        client_secret: '$pbkdf2-sha512$310000$IOvwfqSgUvMZ5nxZ.dEDTw$FX3x1XaH3.S9gNFHiv0DdcCSCEomFMdoxd.yA3PEmVksRyd7D8LuSdooN.DA3B.jyVDVLFSJ9isIChEbJSmEvw'
+        client_secret: '{{ hostvars['console']['tandoor']['oidc']['hash'] }}'
         public: false
         authorization_policy: 'one_factor'
         require_pkce: false
@@ -407,3 +407,26 @@ identity_providers:
         access_token_signed_response_alg: 'none'
         userinfo_signed_response_alg: 'none'
         token_endpoint_auth_method: 'client_secret_basic'
+      # https://www.authelia.com/integration/openid-connect/clients/bookstack/
+      - client_id: 'bookstack'
+        client_name: 'bookstack'
+        consent_mode: 'implicit'
+        client_secret: '{{ hostvars['console']['bookstack']['oidc']['hash'] }}'
+        public: false
+        authorization_policy: 'one_factor'
+        require_pkce: true
+        pkce_challenge_method: 'S256'
+        redirect_uris:
+          - 'https://{{ services['bookstack']['domain']['public'] }}.{{ domain['public'] }}/oidc/callback'
+        scopes:
+          - 'openid'
+          - 'profile'
+          - 'email'
+          - 'groups'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+        access_token_signed_response_alg: 'none'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_basic'
diff --git a/config/services/containers/infra/mariadb/config/mariadb.cnf.j2 b/config/services/containers/infra/mariadb/config/mariadb.cnf.j2
index f9d823c..f5f5b17 100644
--- a/config/services/containers/infra/mariadb/config/mariadb.cnf.j2
+++ b/config/services/containers/infra/mariadb/config/mariadb.cnf.j2
@@ -4,7 +4,7 @@
 [mariadb]
 
 # Listen address
-bind-address = 0.0.0.0
+bind-address = 0.0.0.0,::
 
 # Max connections
 max_connections = 250
diff --git a/ansible/roles/app/tasks/services/set_memos.yaml b/docs/archives/services/app/memos/set_memos.yaml
similarity index 100%
rename from ansible/roles/app/tasks/services/set_memos.yaml
rename to docs/archives/services/app/memos/set_memos.yaml