Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
2026-08-25 23:11:49 -04:00
parent 9b338608ef
commit f33da41cc6
93 changed files with 4735 additions and 247 deletions
@@ -0,0 +1,62 @@
+# Infisical — VPS (ROOTLESS PODMAN) port of the home server's ~/Server/infisical,
+# migrated 2026-08-12.
+#
+# CONSOLIDATED ONTO THE SHARED POSTGRES. Home runs a dedicated postgres:14 for infisical;
+# here it uses the shared `postgresql` container (PG 17) alongside authentik, n8n and NPM.
+# The PG14 dump restored into PG17 cleanly (no extensions, 749 tables, row counts verified
+# identical). One postgres to back up, patch and monitor instead of several.
+#
+#   role/database:  infisical_user / infisical_db   (created in the shared instance)
+#   DB_CONNECTION_URI in .env points at host `postgresql`, not the old `db`
+#   REDIS_URL points at `infisical-redis` -- container_name is what netavark resolves
+#   on nginx-bridge, so the home file's bare `redis` hostname does not work here
+#
+# redis stays local to this stack: it holds only cache/queue state, starts empty by
+# design, and is not worth centralising.
+#
+# Rootless adaptations:
+#   - :Z on the redis data mount (SELinux Enforcing).
+#   - No published ports; NPM proxies to http://infisical-backend:8080 over nginx-bridge.
+#   - Images start as root and drop privileges internally, so no userns_mode needed.
+#
+# .env is copied verbatim from home (mode 600) and holds ENCRYPTION_KEY and AUTH_SECRET.
+# Those MUST match the database they encrypted -- never regenerate them on migrated data.
+
+networks:
+  nginx-bridge:
+    external: true
+
+services:
+  redis:
+    image: docker.io/library/redis:latest
+    container_name: infisical-redis
+    hostname: infisical-redis
+    networks: ["nginx-bridge"]
+    env_file: .env
+    environment:
+      - ALLOW_EMPTY_PASSWORD=yes
+      - TZ=America/New_York
+    volumes:
+      - ./data/redis:/data:Z
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    restart: unless-stopped
+    tty: true
+
+  backend:
+    image: docker.io/infisical/infisical:latest
+    container_name: infisical-backend
+    hostname: infisical-backend
+    domainname: infisical.gbrown.org
+    networks: ["nginx-bridge"]
+    env_file: .env
+    environment:
+      - NODE_ENV=production
+      - TZ=America/New_York
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    depends_on:
+      - redis
+    restart: unless-stopped
+    tty: true
+    stdin_open: true