Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
2026-08-25 23:11:49 -04:00
parent 9b338608ef
commit f33da41cc6
93 changed files with 4735 additions and 247 deletions
@@ -0,0 +1,16 @@
+GENERIC_TIMEZONE=America/New_York
+TZ=America/New_York
+N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true
+N8N_RUNNERS_ENABLED=true
+N8N_RUNNERS_MODE=external
+N8N_RUNNERS_BROKER_LISTEN_ADDRESS=0.0.0.0
+N8N_RUNNERS_AUTH_TOKEN=CHANGE_ME
+N8N_NATIVE_PYTHON_RUNNER=true
+DB_TYPE=postgresdb
+DB_POSTGRESDB_DATABASE=n8n
+DB_POSTGRESDB_HOST=postgresql
+DB_POSTGRESDB_PORT=5432
+DB_POSTGRESDB_USER=npm
+DB_POSTGRESDB_PASSWORD=CHANGE_ME
+N8N_RUNNERS_TASK_BROKER_URI=http://n8n:5679
+N8N_RUNNERS_AUTH_TOKEN=CHANGE_ME
@@ -0,0 +1,50 @@
+networks:
+  nginx-bridge:
+    external: true
+services:
+  n8n:
+    image: docker.n8n.io/n8nio/n8n:latest
+    container_name: n8n
+    hostname: n8n
+    domainname: n8n.gbrown.org
+    networks: ['nginx-bridge']
+    #ports: ['5678:5678']
+    env_file: [.env]
+    environment:
+      - GENERIC_TIMEZONE
+      - TZ
+      - N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS
+      - N8N_RUNNERS_ENABLED
+      - N8N_RUNNERS_MODE
+      - N8N_RUNNERS_BROKER_LISTEN_ADDRESS
+      - N8N_RUNNERS_AUTH_TOKEN
+      - N8N_NATIVE_PYTHON_RUNNER
+      - DB_TYPE
+      - DB_POSTGRESDB_DATABASE
+      - DB_POSTGRESDB_HOST
+      - DB_POSTGRESDB_PORT
+      - DB_POSTGRESDB_USER
+      - DB_POSTGRESDB_PASSWORD
+    # Rootless: replaces `user: 1000:1000`, which under a rootless userns would have
+    # resolved to subuid 525287 and lost access to the gib-owned ./data dir.
+    userns_mode: "keep-id:uid=1000,gid=1000"
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    volumes:
+      - './data:/home/node/.n8n:Z'
+    tty: true
+    stdin_open: true
+    restart: unless-stopped
+
+  task-runners:
+    image: n8nio/runners:1.111.0
+    container_name: n8n-runners
+    # Was missing: without this the runner sits on the compose default network and
+    # cannot resolve N8N_RUNNERS_TASK_BROKER_URI (http://n8n:5679).
+    networks: ['nginx-bridge']
+    env_file: [.env]
+    environment:
+      - N8N_RUNNERS_TASK_BROKER_URI
+      - N8N_RUNNERS_AUTH_TOKEN
+    depends_on:
+      - n8n
@@ -0,0 +1,21 @@
+[Unit]
+RequiresMountsFor=/home/gib/Media
+Description=Podman Compose: N8n
+After=network-online.target podman-postgresql.service
+Wants=network-online.target
+StartLimitIntervalSec=300
+StartLimitBurst=3
+
+[Service]
+Type=oneshot
+WorkingDirectory=%h/Server/N8n
+ExecStart=/usr/bin/podman compose up -d
+ExecStop=/usr/bin/podman compose down
+RemainAfterExit=yes
+TimeoutStartSec=300
+TimeoutStopSec=60
+Restart=on-failure
+RestartSec=30
+
+[Install]
+WantedBy=default.target