Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

server/containers/Adminer/compose.yml

@@ -0,0 +1,44 @@
+# Adminer — database admin UI. VPS (ROOTLESS PODMAN), added 2026-08-12.
+#
+# On the home server this shipped alongside a MySQL container in the same compose
+# file. Here it is standalone and defaults to the shared PostgreSQL instance, which
+# is where the 14 databases now live (authentik, infisical_db, n8n, npm, the payload_*
+# and convex databases, usesend, lashaddict-payload, spoon_convex...).
+#
+# MySQL stays on the home server — nothing on the VPS uses it.
+#
+# It can still reach any other database reachable on nginx-bridge; ADMINER_DEFAULT_SERVER
+# only pre-fills the server field on the login form.
+#
+# ⚠️ SECURITY: Adminer has NO authentication of its own — it is a login form that
+# forwards credentials to whichever database you name. Publishing it means exposing a
+# database login prompt to the internet. Put it behind authentik forward-auth in NPM
+# (same pattern as sonarr/prowlarr on the home server), or restrict it to the LAN by
+# giving it only a UniFi record and no Cloudflare record.
+#
+# Rootless adaptations: no bind mounts (stateless, so no :Z needed), no published
+# ports — NPM proxies to http://adminer:8080 over nginx-bridge.
+#
+# NPM: adminer.gbrown.org -> http://adminer:8080
+
+networks:
+  nginx-bridge:
+    external: true
+
+services:
+  adminer:
+    image: docker.io/library/adminer:latest
+    container_name: adminer
+    hostname: adminer
+    domainname: adminer.gbrown.org
+    networks:
+      - nginx-bridge
+    environment:
+      - TZ=America/New_York
+      # Pre-fills the server field; any nginx-bridge host can still be typed in.
+      - ADMINER_DEFAULT_SERVER=postgresql
+      - ADMINER_DESIGN=dracula
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    tty: true
+    restart: unless-stopped

server/containers/Adminer/podman-adminer.service

@@ -0,0 +1,21 @@
+[Unit]
+RequiresMountsFor=/home/gib/Media
+Description=Podman Compose: Adminer
+After=network-online.target podman.socket podman-postgresql.service
+Wants=network-online.target podman-postgresql.service
+StartLimitIntervalSec=300
+StartLimitBurst=3
+
+[Service]
+Type=oneshot
+WorkingDirectory=%h/Server/Adminer
+ExecStart=/usr/bin/podman compose up -d
+ExecStop=/usr/bin/podman compose down
+RemainAfterExit=yes
+TimeoutStartSec=300
+TimeoutStopSec=60
+Restart=on-failure
+RestartSec=30
+
+[Install]
+WantedBy=default.target