fix: add plane-admin, plane-space and configure instance URLs

New Plane stable requires 3 frontend services:
- plane-admin (nginx:80) for /god-mode/ routes
- plane-space (node:3000) for /spaces/ routes
- plane-web (nginx:80) for all other routes

Also add APP/ADMIN/SPACE_BASE_URL env vars to plane-api so the
setup wizard knows where to redirect.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

roles/services/defaults/main.yml

@@ -9,6 +9,8 @@ vaultwarden_image: "vaultwarden/server:1.32.7"                   # https://hub.d
 forgejo_image: "codeberg.org/forgejo/forgejo:9"
 forgejo_db_image: "postgres:16-alpine"
 plane_frontend_image: "makeplane/plane-frontend:stable"          # https://hub.docker.com/r/makeplane/plane-frontend/tags
+plane_admin_image: "makeplane/plane-admin:stable"                # https://hub.docker.com/r/makeplane/plane-admin/tags
+plane_space_image: "makeplane/plane-space:stable"                # https://hub.docker.com/r/makeplane/plane-space/tags
 plane_backend_image: "makeplane/plane-backend:stable"            # https://hub.docker.com/r/makeplane/plane-backend/tags
 plane_db_image: "postgres:16-alpine"
 plane_redis_image: "redis:7-alpine"

roles/services/tasks/main.yml

@@ -10,6 +10,8 @@
     - "{{ forgejo_image }}"
     - "{{ forgejo_db_image }}"
     - "{{ plane_frontend_image }}"
+    - "{{ plane_admin_image }}"
+    - "{{ plane_space_image }}"
     - "{{ plane_backend_image }}"
     - "{{ plane_db_image }}"
     - "{{ plane_redis_image }}"

roles/services/templates/docker-compose.yml.j2

@@ -163,6 +163,43 @@ services:
       - "traefik.http.routers.plane.entrypoints=websecure"
       - "traefik.http.routers.plane.tls.certresolver=letsencrypt"
       - "traefik.http.services.plane.loadbalancer.server.port=80"
+      - "traefik.http.routers.plane.priority=1"
+
+  plane-admin:
+    image: {{ plane_admin_image }}
+    container_name: plane-admin
+    restart: unless-stopped
+    depends_on:
+      - plane-api
+      - plane-web
+    networks:
+      - backend
+      - plane-internal
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.plane-admin.rule=Host(`{{ domain_plane }}`) && PathPrefix(`/god-mode/`)"
+      - "traefik.http.routers.plane-admin.entrypoints=websecure"
+      - "traefik.http.routers.plane-admin.tls.certresolver=letsencrypt"
+      - "traefik.http.services.plane-admin.loadbalancer.server.port=80"
+      - "traefik.http.routers.plane-admin.priority=10"
+
+  plane-space:
+    image: {{ plane_space_image }}
+    container_name: plane-space
+    restart: unless-stopped
+    depends_on:
+      - plane-api
+      - plane-web
+    networks:
+      - backend
+      - plane-internal
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.plane-space.rule=Host(`{{ domain_plane }}`) && PathPrefix(`/spaces/`)"
+      - "traefik.http.routers.plane-space.entrypoints=websecure"
+      - "traefik.http.routers.plane-space.tls.certresolver=letsencrypt"
+      - "traefik.http.services.plane-space.loadbalancer.server.port=3000"
+      - "traefik.http.routers.plane-space.priority=10"
 
   plane-api:
     image: {{ plane_backend_image }}
@@ -200,6 +237,9 @@ services:
       - MINIO_ROOT_USER=plane-minio
       - MINIO_ROOT_PASSWORD=${PLANE_MINIO_PASSWORD}
       - GUNICORN_WORKERS=2
+      - APP_BASE_URL=https://{{ domain_plane }}
+      - ADMIN_BASE_URL=https://{{ domain_plane }}/god-mode
+      - SPACE_BASE_URL=https://{{ domain_plane }}/spaces
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.plane-api.rule=Host(`{{ domain_plane }}`) && (PathPrefix(`/api/`) || PathPrefix(`/auth/`))"