Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

server/containers/Beszel/compose.yml

@@ -0,0 +1,70 @@
+# Beszel — lightweight host + container monitoring, VPS (ROOTLESS PODMAN) edition.
+#
+# Adapted from the home server's Docker/root version. Differences and why:
+#
+#   docker.sock -> /run/user/1000/podman/podman.sock
+#       Rootless podman's API socket. It exposes ONLY rootless containers, which is
+#       exactly the set we want reported. No :Z on the socket mount -- relabeling the
+#       live socket breaks podman. See AGENTS.md §6.
+#
+#   security_opt: label:disable on the agent
+#       Required under SELinux Enforcing to read that socket, which systemd recreates
+#       each boot as user_tmp_t. Same treatment as portainer/uptime.
+#
+#   EXTRA_FILESYSTEMS=/boot dropped
+#       The home server has /boot on its own 974M partition. This VPS does not --
+#       /dev/sda1 is the whole root fs and /boot/efi is a 64M ESP not worth alerting on.
+#
+#   No hostname/domainname on the agent
+#       Host networking forbids them, same as on the home server.
+#
+# The hub generates its keypair on first start at ./volumes/hub/id_ed25519.pub.
+# That public key is what goes in the agent's KEY below.
+
+networks:
+  nginx-bridge:
+    external: true
+
+services:
+  beszel:
+    image: docker.io/henrygd/beszel:latest
+    container_name: beszel
+    hostname: beszel
+    domainname: beszel.gibbyb.com
+    networks: ['nginx-bridge']
+    # No published port: NPM proxies to http://beszel:8090 over nginx-bridge.
+    environment:
+      - TZ=America/New_York
+    # Lets the hub reach a host-network agent. Under rootless podman this resolves to
+    # the nginx-bridge gateway (172.18.0.1). Add the VPS in the hub UI with host
+    # "host.docker.internal", port 45876.
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    volumes:
+      - ./volumes/hub:/beszel_data:Z
+    tty: true
+    stdin_open: true
+    restart: unless-stopped
+
+  beszel-agent:
+    image: docker.io/henrygd/beszel-agent:latest
+    container_name: beszel-agent
+    network_mode: host
+    environment:
+      - TZ=America/New_York
+      - PORT=45876
+      # This hub's public key. Newer Beszel writes only ./volumes/hub/id_ed25519 (private);
+      # derive the public half with:  ssh-keygen -y -f volumes/hub/id_ed25519
+      # It is a PUBLIC key -- safe to keep in this file.
+      - KEY=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDBWNqxKGRltqXJZg+wlDOtICeLo19ftQ6P3P8+uJg8y
+    security_opt: ['label:disable']
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    volumes:
+      - ./volumes/agent:/var/lib/beszel-agent:Z
+      - /run/user/1000/podman/podman.sock:/var/run/docker.sock:ro
+    tty: true
+    stdin_open: true
+    restart: unless-stopped