web: general domain cleanup (canonical/aliases normalization)

- Normalize domain blocks across apps:
  - Add explicit 'aliases: []' everywhere (no implicit aliases)
  - Standardize canonical subdomains for consistency:
    * Bluesky: web/api under *.bluesky.<PRIMARY_DOMAIN>
    * EspoCRM: espo.crm.<PRIMARY_DOMAIN>
    * Gitea:   tea.git.<PRIMARY_DOMAIN>
    * GitLab:  lab.git.<PRIMARY_DOMAIN>
    * Joomla:  joomla.cms.<PRIMARY_DOMAIN>
    * Magento: magento.shop.<PRIMARY_DOMAIN>
    * OpenProject: open.project.<PRIMARY_DOMAIN>
    * Pretix:  ticket.shop.<PRIMARY_DOMAIN>
    * Taiga:   kanban.project.<PRIMARY_DOMAIN>
  - Remove legacy/duplicate aliases and use empty list instead
  - Fix 'alias' -> 'aliases' where applicable

Context: preparing for AUTO_BUILD_ALIASES=False and deterministic redirect mapping.

Ref: conversation https://chatgpt.com/share/68cd512c-c878-800f-bdf2-81737adf7e0e

roles/web-app-akaunting/config/main.yml

@@ -13,6 +13,7 @@ server:
   domains:
     canonical:
       - "accounting.{{ PRIMARY_DOMAIN }}"
+    aliases: []
   csp:
     flags:
       script-src-elem:

roles/web-app-baserow/config/main.yml

@@ -23,6 +23,7 @@ server:
   domains:
     canonical:
       - baserow.{{ PRIMARY_DOMAIN }}
+    aliases: []
   csp:
     whitelist:
       worker-src:

roles/web-app-bigbluebutton/config/main.yml

@@ -19,6 +19,7 @@ server:
   domains:
     canonical:
       - "meet.{{ PRIMARY_DOMAIN }}"
+    aliases: []
 credentials: {}
 
 docker:

roles/web-app-bluesky/config/main.yml

@@ -9,9 +9,10 @@ server:
   status_codes:
     web: 405
   domains:
+    aliases: []
     canonical:
-      web:  "bskyweb.{{ PRIMARY_DOMAIN }}"
+      web:  "web.bluesky.{{ PRIMARY_DOMAIN }}"
-      api:  "bluesky.{{ PRIMARY_DOMAIN }}"
+      api:  "api.bluesky.{{ PRIMARY_DOMAIN }}"
 #      view: "view.bluesky.{{ PRIMARY_DOMAIN }}"
   csp:
     whitelist:

roles/web-app-bridgy-fed/config/main.yml

@@ -10,6 +10,7 @@ server:
   domains:
     canonical:
       - "bridgyfed.{{ PRIMARY_DOMAIN }}"
+    aliases: []
   csp:
     whitelist: {}
     flags: {}

roles/web-app-confluence/config/main.yml

@@ -30,9 +30,7 @@ server:
   domains:
     canonical:
       - "c.wiki.{{ PRIMARY_DOMAIN }}"
-    aliases:
+    aliases: []
-      - "confluence.{{ PRIMARY_DOMAIN }}"
-      - "confluence.wiki.{{ PRIMARY_DOMAIN }}"
 rbac:
   roles: {}
 truststore_enabled: false

roles/web-app-discourse/config/main.yml

@@ -20,6 +20,7 @@ server:
   domains:
     canonical:
       - "forum.{{ PRIMARY_DOMAIN }}"
+    aliases: []
 docker:
   services:
     database:

roles/web-app-elk/config/main.yml

@@ -4,3 +4,4 @@ server:
   domains:
     canonical:
       - elk.{{ PRIMARY_DOMAIN }}
+    aliases: []

roles/web-app-espocrm/config/main.yml

@@ -23,10 +23,9 @@ server:
       frame-src:
         - https://s.espocrm.com/
   domains:
-    aliases:
+    aliases: []
-      - "crm.{{ PRIMARY_DOMAIN }}"
     canonical:
-      - espocrm.{{ PRIMARY_DOMAIN }}
+      - espo.crm.{{ PRIMARY_DOMAIN }}
 email:
   from_name: "Customer Relationship Management ({{ PRIMARY_DOMAIN }})"
 docker:

roles/web-app-friendica/config/main.yml

@@ -13,6 +13,7 @@ server:
   domains:
     canonical:
       - "social.{{ PRIMARY_DOMAIN }}"
+    aliases: []
   csp:
     flags:
       script-src-elem:

roles/web-app-funkwhale/config/main.yml

@@ -24,9 +24,7 @@ server:
   domains:
     canonical:
       - "audio.{{ PRIMARY_DOMAIN }}"
-    aliases:
+    aliases: []
-      - "music.{{ PRIMARY_DOMAIN }}"
-      - "sound.{{ PRIMARY_DOMAIN }}"
   csp:  
     flags:
       style-src:

roles/web-app-gitea/config/main.yml

@@ -35,10 +35,9 @@ server:
       manifest-src:
         - "data:"
   domains:
-    aliases:
+    aliases: []
-      - "git.{{ PRIMARY_DOMAIN }}"
     canonical:
-      - gitea.{{ PRIMARY_DOMAIN }}
+      - tea.git.{{ PRIMARY_DOMAIN }}
 docker:
   services:
     database:

roles/web-app-gitlab/config/main.yml

@@ -22,4 +22,4 @@ docker:
 server:
   domains:
     canonical:
-      - gitlab.{{ PRIMARY_DOMAIN }}
+      - lab.git.{{ PRIMARY_DOMAIN }}

roles/web-app-jenkins/config/main.yml

@@ -4,3 +4,4 @@ server:
   domains:
     canonical:
       - jenkins.{{ PRIMARY_DOMAIN }}
+    aliases: []

roles/web-app-jira/config/main.yml

@@ -31,6 +31,7 @@ server:
   domains:
     canonical:
       - "jira.{{ PRIMARY_DOMAIN }}"
+    aliases: []
   status_codes:
     default: 405
 rbac:

roles/web-app-joomla/config/main.yml

@@ -10,7 +10,8 @@ features:
 server:
   domains:
     canonical:
-      - "cms.{{ PRIMARY_DOMAIN }}"
+      - "joomla.cms.{{ PRIMARY_DOMAIN }}"
+    aliases: []
   csp:
     flags:
       style-src:

roles/web-app-keycloak/config/main.yml

@@ -29,6 +29,7 @@ server:
   domains:
     canonical:
       - "auth.{{ PRIMARY_DOMAIN }}"
+    aliases: []
 scopes:
   nextcloud:  nextcloud
 

roles/web-app-lam/config/main.yml

@@ -26,8 +26,7 @@ server:
       script-src:
         unsafe-inline:            true
   domains:
-    aliases:
+    aliases: []
-      - "ldap.{{ PRIMARY_DOMAIN }}"
     canonical:
       - lam.{{ PRIMARY_DOMAIN }}
 

roles/web-app-listmonk/config/main.yml

@@ -10,6 +10,7 @@ server:
   domains:
     canonical:
       - "newsletter.{{ PRIMARY_DOMAIN }}"
+    aliases: []
   status_codes:
     default: 404
 docker:

roles/web-app-magento/config/main.yml

@@ -12,9 +12,8 @@ server:
     whitelist: {}
   domains:
     canonical:
-      - "shop.{{ PRIMARY_DOMAIN }}"
+      - "magento.shop.{{ PRIMARY_DOMAIN }}"
-    aliases:
+    aliases: []
-      - "magento.{{ PRIMARY_DOMAIN }}"
 docker:
   services:
     php:

roles/web-app-mailu/config/main.yml

@@ -13,8 +13,7 @@ server:
   domains:
     canonical:
       - "{{ SYSTEM_EMAIL.HOST }}"
-    alias:
+    aliases: []
-      - "mailu.{{ PRIMARY_DOMAIN }}"
   csp:
     flags:
       style-src:

roles/web-app-mastodon/config/main.yml

@@ -10,6 +10,7 @@ server:
   domains:
     canonical:
       - "microblog.{{ PRIMARY_DOMAIN }}"
+    aliases: []
   csp:
     whitelist:
       frame-src:

roles/web-app-matomo/config/main.yml

@@ -26,10 +26,9 @@ server:
         unsafe-inline: true
         unsafe-eval:   true
   domains:
-    aliases:
-      - "analytics.{{ PRIMARY_DOMAIN }}"
     canonical:
       - "matomo.{{ PRIMARY_DOMAIN }}"
+    aliases: []
 excluded_ips: "{{ networks.internet.values() | list }}"
 
 docker:

roles/web-app-mediawiki/config/main.yml

@@ -3,8 +3,7 @@ server:
   domains:
     canonical:
       - "m.wiki.{{ PRIMARY_DOMAIN }}"
-    aliases:
+    aliases: []
-      - "media.wiki.{{ PRIMARY_DOMAIN }}"
 docker:
   services:
     database:

roles/web-app-mig/config/main.yml

@@ -34,8 +34,7 @@ server:
   domains:
     canonical:
       - "mig.{{ PRIMARY_DOMAIN }}"
-    aliases:
+    aliases: []
-      - "meta-infinite-graph.{{ PRIMARY_DOMAIN }}"
 
 build_data: 
   # This shouldn't be relevant anymore, because the data is anyhow build async in background

roles/web-app-mobilizon/config/main.yml

@@ -15,8 +15,8 @@ server:
   domains:
     canonical:
       - "event.{{ PRIMARY_DOMAIN }}"
-    aliases:
+    aliases: []
-      - "events.{{ PRIMARY_DOMAIN }}"
+    
 docker:
   services:
     database:

roles/web-app-moodle/config/main.yml

@@ -26,6 +26,7 @@ server:
   domains:
     canonical:
       - "academy.{{ PRIMARY_DOMAIN }}"
+    aliases: []
 docker:
   services:
     database:

roles/web-app-navigator/config/main.yml

@@ -27,3 +27,4 @@ server:
   domains:
     canonical:
       - "slides.{{ PRIMARY_DOMAIN }}"
+    aliases: []

roles/web-app-nextcloud/config/main.yml

@@ -18,6 +18,7 @@ server:
   domains:
     canonical:
       - "cloud.{{ PRIMARY_DOMAIN }}"
+    aliases: []
 docker:
   volumes:
     data: nextcloud_data

roles/web-app-oauth2-proxy/config/main.yml

@@ -10,3 +10,4 @@ server:
   domains:
     canonical:
       - oauth2-proxy.{{ PRIMARY_DOMAIN }}
+    aliases: []

roles/web-app-openproject/config/main.yml

@@ -30,8 +30,8 @@ server:
         - "data:"
   domains:
     canonical:
-      - "project.{{ PRIMARY_DOMAIN }}"
+      - "open.project.{{ PRIMARY_DOMAIN }}"
-
+    aliases: []
 docker:
   services:
     database:

roles/web-app-peertube/config/main.yml

@@ -24,8 +24,8 @@ server:
   domains:
     canonical:
       - "video.{{ PRIMARY_DOMAIN }}"
-    aliases:
+    aliases: []
-      - "videos.{{ PRIMARY_DOMAIN }}"
+    
 docker:
   services:
     redis:

roles/web-app-pgadmin/config/main.yml

@@ -26,6 +26,7 @@ server:
   domains:
     canonical:
       - pgadmin.{{ PRIMARY_DOMAIN }}
+    aliases: []
 docker:
   services:
     database:

roles/web-app-phpldapadmin/config/main.yml

@@ -15,3 +15,4 @@ server:
   domains:
     canonical:
       - phpldapadmin.{{ PRIMARY_DOMAIN }}
+    aliases: []

roles/web-app-phpmyadmin/config/main.yml

@@ -20,9 +20,7 @@ server:
       script-src-elem:
         unsafe-inline: true
   domains:
-    aliases:
+    aliases: []
-      - "mysql.{{ PRIMARY_DOMAIN }}"
-      - "mariadb.{{ PRIMARY_DOMAIN }}"
     canonical:
       - phpmyadmin.{{ PRIMARY_DOMAIN }}
 docker:

roles/web-app-pixelfed/config/main.yml

@@ -23,8 +23,7 @@ server:
   domains:
     canonical:
       - "picture.{{ PRIMARY_DOMAIN }}"
-    aliases:
+    aliases: []
-      - "pictures.{{ PRIMARY_DOMAIN }}"
 docker:
   services:
     redis:

roles/web-app-pretix/config/main.yml

@@ -27,9 +27,8 @@ server:
     flags:          {}
   domains:
     canonical:
-      - "ticket.{{ PRIMARY_DOMAIN }}"
+      - "ticket.shop.{{ PRIMARY_DOMAIN }}"
-    aliases:
+    aliases: []
-      - "pretix.{{ PRIMARY_DOMAIN }}"
 rbac:
   roles: {}
 plugins:

roles/web-app-roulette-wheel/config/main.yml

@@ -4,3 +4,4 @@ server:
   domains:
     canonical:
       - "wheel.{{ PRIMARY_DOMAIN }}"
+    aliases: []

roles/web-app-snipe-it/config/main.yml

@@ -10,6 +10,7 @@ server:
   domains:
     canonical:
       - "inventory.{{ PRIMARY_DOMAIN }}"
+    aliases: []
   csp:
     flags:
       script-src:

roles/web-app-sphinx/config/main.yml

@@ -16,3 +16,4 @@ server:
   domains:
     canonical:
       - "docs.{{ PRIMARY_DOMAIN }}"
+    aliases: []

roles/web-app-syncope/config/main.yml

@@ -17,3 +17,4 @@ server:
   domains:
     canonical:
       - syncope.{{ PRIMARY_DOMAIN }}
+    aliases: []

roles/web-app-taiga/config/main.yml

@@ -31,4 +31,4 @@ server:
         unsafe-eval:   true
   domains:
     canonical:
-      - "kanban.{{ PRIMARY_DOMAIN }}"
+      - "kanban.project.{{ PRIMARY_DOMAIN }}"

roles/web-app-wordpress/config/main.yml

@@ -41,6 +41,7 @@ server:
   domains:
     canonical:
       - "blog.{{ PRIMARY_DOMAIN }}"
+    aliases: []
 docker:
   services:
     database:

roles/web-app-xwiki/config/main.yml

@@ -35,6 +35,7 @@ server:
   domains:
     canonical:
       - "x.wiki.{{ PRIMARY_DOMAIN }}"
+    aliases: []
 rbac:
   roles: {}
 ldap:

roles/web-app-yourls/config/main.yml

@@ -17,8 +17,7 @@ server:
   domains:
     canonical:
       - "s.{{ PRIMARY_DOMAIN }}"
-    aliases:
+    aliases: []
-      - "short.{{ PRIMARY_DOMAIN }}"
   csp:
     flags:
       style-src:

roles/web-svc-asset/config/main.yml

@@ -4,3 +4,4 @@ server:
   domains:
     canonical:
       - asset.{{ PRIMARY_DOMAIN }}
+    aliases: []

roles/web-svc-cdn/config/main.yml

@@ -6,3 +6,4 @@ server:
   domains:
     canonical:
       - "cdn.{{ PRIMARY_DOMAIN }}"
+    aliases: []

roles/web-svc-collabora/config/main.yml

@@ -2,6 +2,7 @@ server:
   domains:
     canonical:
       - "collabora.{{ PRIMARY_DOMAIN }}"
+    aliases: []
   csp:
     whitelist:
       frame-ancestors:

roles/web-svc-file/config/main.yml

@@ -6,5 +6,4 @@ server:
   domains:
     canonical:
       - "file.{{ PRIMARY_DOMAIN }}"
-    alias:
+    aliases: []
-      - "files.{{ PRIMARY_DOMAIN }}"

roles/web-svc-html/config/main.yml

@@ -6,3 +6,4 @@ server:
   domains:
     canonical:
       - "html.{{ PRIMARY_DOMAIN }}"
+    aliases: []

roles/web-svc-logout/config/main.yml

@@ -8,6 +8,7 @@ server:
   domains:
     canonical:
       - "logout.{{ PRIMARY_DOMAIN }}"
+    aliases: []
   csp:
     flags:
       style-src:

roles/web-svc-simpleicons/config/main.yml

@@ -21,6 +21,7 @@ server:
   domains:
     canonical:
       - "icons.{{ PRIMARY_DOMAIN }}"
+    aliases: []
 rbac:
   roles:
     mail-bot:

roles/web-svc-xmpp/config/main.yml

@@ -5,3 +5,4 @@ server:
   domains:
     canonical:
       - xmpp.{{ PRIMARY_DOMAIN }}
+    aliases: []