Document all post-secret-change update procedures

Add a single quickstart table covering Cloudflare DDNS, Usenet, NZBgeek,
WireGuard, stack .env, and bootstrap; point secrets/.env.example and
AGENTS.md at the same workflow.

AGENTS.md

@@ -8,3 +8,4 @@
 - Prefer SSH push (`GIT_SSH_COMMAND` with `~/.ssh/id_ed25519` if needed).
 - Server checkout: `/opt/stack` is the same repo (`git pull` on ser5). Ansible uses `stack_deploy_method: git`.
 - Prefer **`.env`** for config (see `.env.example`). Demo creds: `DEMO_USER=tim` `DEMO_PASS=asdfasdf`. Fresh host: `./scripts/bootstrap-stack.sh`.
+- Secrets live in `secrets/.env` (gitignored). After edits: see **quickstart.md → After changing secrets** (Usenet → `configure-usenet.sh`; Cloudflare → `render-cloudflare-ddns-env.sh` + recreate container; NZBgeek → Prowlarr UI; WireGuard → `wg0.conf` + gluetun recreate/watch).

quickstart.md

@@ -148,33 +148,72 @@ Root folders: `/data/media/tv`, `/data/media/movies`, `/data/media/music` (hardl
 
 **Prowlarr** — Add indexers. Apps: Sonarr `http://sonarr:8989`, Radarr `http://radarr:7878`, Lidarr `http://lidarr:8686` + each API key (*Settings → General*).
 
-**Cloudflare DDNS** (`timothyjmiller/cloudflare-ddns`) — updates **devopshomelab.com** and subdomains to your **public IPv4** every 5 minutes.
+### Secrets file
+
+Path (not in git): **`/opt/stack/secrets/.env`**  
+Template: `secrets/.env.example`  
+Keys today: Usenet (NZBgeek / Newshosting / Tweaknews) + Cloudflare DDNS.
+
+Sync from a laptop if you edit there:
 
 ```bash
-# secrets/.env must include CLOUDFLAREAPIKEY, CLOUDFLAREDOMAIN, CLOUDFLARESUBDOMAINS
+scp secrets/.env tim@192.168.8.123:/opt/stack/secrets/.env
+ssh tim@192.168.8.123 'chmod 600 /opt/stack/secrets/.env'
+```
+
+---
+
+### After changing secrets (apply changes)
+
+Always edit **`secrets/.env`** first, then run only what you changed:
+
+| What you changed | Commands (on ser5, `cd /opt/stack`) |
+|------------------|-------------------------------------|
+| **Cloudflare** token / domain / subdomains / proxied | `./scripts/render-cloudflare-ddns-env.sh` then `docker compose up -d cloudflare-ddns --force-recreate` then `docker logs cloudflare-ddns --tail 30` |
+| **Usenet servers** (Newshosting / Tweaknews user, pass, host, ports) | `./scripts/configure-usenet.sh` then SABnzbd → Config → Servers → **Test** |
+| **NZBgeek API key** | Prowlarr → Indexers → NZBgeek → paste new `NZBKEEPKEY` (not automated after first setup) |
+| **WireGuard** peer / keys | Edit `wireguard/wg0.conf` (and `# EndpointHost = …`) then `docker compose up -d gluetun --force-recreate` and/or `./scripts/gluetun-endpoint-watch.sh` |
+| **Stack `.env`** (ports, AI profile, demo login, etc.) | Edit `.env` then `docker compose up -d` (rebuild bonsai if `BONSAI_BACKEND` changed: `docker compose build bonsai && docker compose up -d bonsai`) |
+| **Everything secret-driven (demo reset)** | Update `secrets/.env` + `.env` then `./scripts/bootstrap-stack.sh` (re-renders Cloudflare, reconfigures Usenet when flags allow) |
+
+**Cloudflare one-liner after secret edit:**
+
+```bash
+cd /opt/stack
 ./scripts/render-cloudflare-ddns-env.sh
-docker compose up -d cloudflare-ddns
+docker compose up -d cloudflare-ddns --force-recreate
 docker logs cloudflare-ddns --tail 30
 ```
 
-Token needs **Zone → DNS → Edit**. `PROXIED=false` by default (DNS-only; better for VPN). Set `CLOUDFLARE_PROXIED=true` in secrets if you want orange-cloud for all names.
+Needs: `CLOUDFLAREAPIKEY`, `CLOUDFLAREDOMAIN`, `CLOUDFLARESUBDOMAINS` (and optional `CLOUDFLARE_PROXIED`). Token: **Zone → DNS → Edit**. Default `PROXIED=false` (DNS-only; better for VPN).
 
-**Usenet (NZBgeek + Newshosting + Tweaknews)**  
-Credentials live in **`secrets/.env`** (not git). Example keys: see `secrets/.env.example`.
+**Usenet one-liner after secret edit:**
+
+```bash
+cd /opt/stack
+./scripts/configure-usenet.sh
+# then open http://192.168.8.123:8085 → Config → Servers → Test both green
+```
+
+Needs: Newshosting / Tweaknews vars (see `secrets/.env.example`; aliases like `TWEAKNEWSLOGIN` / `HNEWSHOSTINGPASS` are accepted).
+
+**NZBgeek after secret edit:** UI only — Prowlarr → Indexers → NZBgeek → API key = `NZBKEEPKEY`.
+
+---
+
+**Usenet first-time setup** (in addition to secrets apply above):
 
 ```bash
-# on ser5
 cd /opt/stack && git pull
 mkdir -p /storage/usenet/{incomplete,complete/{movies,tv,music}}
-# copy secrets if needed:  scp secrets/.env tim@stack:/opt/stack/secrets/
 docker compose up -d sabnzbd
 # open http://192.168.8.123:8085 once if first-run wizard appears, then:
 ./scripts/configure-usenet.sh
 ```
 
-1. **SABnzbd** (http://host:8085) — Config → Servers: Newshosting `news.newshosting.com:563` SSL; Tweaknews `news.tweaknews.eu:563` SSL. Test both green.  
+1. **SABnzbd** (http://host:8085) — Config → Servers: Newshosting + Tweaknews SSL. Test both green.  
    Folders: incomplete `/data/usenet/incomplete`, complete `/data/usenet/complete` (categories `movies`/`tv`/`music`).
-2. **Prowlarr** → Indexers → **NZBgeek** → API key from secrets (`NZBKEEPKEY` / `NZBGEEK_API_KEY`).  
+2. **Prowlarr** → Indexers → **NZBgeek** → API key from secrets (`NZBKEEPKEY`).  
    Download Clients → **SABnzbd** → host `sabnzbd`, port `8080`, API key from SABnzbd Config → General.  
    Sync download client to apps (or add SABnzbd in each *arr).
 3. **Sonarr/Radarr/Lidarr** → Download Clients → SABnzbd: host `sabnzbd`, port `8080`, categories `tv` / `movies` / `music`.

secrets/.env.example

@@ -1,4 +1,11 @@
 # Copy to secrets/.env and fill in. NEVER commit secrets/.env
+#
+# After editing secrets on the server:
+#   Usenet:     ./scripts/configure-usenet.sh
+#   Cloudflare: ./scripts/render-cloudflare-ddns-env.sh
+#               docker compose up -d cloudflare-ddns --force-recreate
+# Full table: see quickstart.md → "After changing secrets"
+#
 # scripts/configure-usenet.sh accepts these names (and a few aliases).
 
 # --- NZBgeek (Prowlarr indexer) ---