Vince fixed

ansible/roles/analytics/defaults/main.yaml

@@ -1,4 +1,5 @@
 ---
-# vince_container / vince_port live in ansible/vars/default.yml (the Caddy
-# template needs them at play level).
+# vince_container / vince_port / vince_admin_* / vince_site_domain /
+# stats_host live in ansible/vars/default.yml (the Caddy template needs them
+# at play level).
 vince_image: ghcr.io/vinceanalytics/vince:latest

ansible/roles/analytics/tasks/main.yaml

@@ -1,7 +1,12 @@
 ---
 # Self-hosted first-party analytics (Vince — Plausible-protocol, single
-# binary). Only reachable on the docker network: Caddy proxies /stats/*
-# on the www host to this container, so browser requests stay first-party.
+# binary). Only reachable on the docker network:
+#   - Caddy proxies /stats/* on the www host here (prefix stripped), serving
+#     the tracker script and event API first-party;
+#   - Caddy publishes the dashboard on {{ stats_host }}.
+#
+# The image's ENTRYPOINT is the bare /vince binary (prints help and exits
+# with no args), so the container MUST be given the `serve` command.
 - name: Pull Vince image
   docker_image:
     name: "{{ vince_image }}"
@@ -20,8 +25,19 @@
   docker_container:
     name: "{{ vince_container }}"
     image: "{{ vince_image }}"
+    command: serve
     state: started
     restart_policy: "unless-stopped"
+    env:
+      VINCE_DATA: /data
+      VINCE_LISTEN: "0.0.0.0:{{ vince_port }}"
+      # serve (re)creates the admin account from these on every boot —
+      # the env file is the source of truth, like the PocketBase superuser.
+      VINCE_ADMIN_NAME: "{{ vince_admin_name }}"
+      VINCE_ADMIN_PASSWORD: "{{ vince_admin_password }}"
+      # create the tracked site on startup (CSV list)
+      VINCE_DOMAINS: "{{ vince_site_domain }}"
+      VINCE_URL: "https://{{ stats_host }}"
     volumes:
       - "{{ host_directory }}/vince_data:/data"
     networks: