Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
2026-08-25 23:11:49 -04:00
parent 9b338608ef
commit f33da41cc6
93 changed files with 4735 additions and 247 deletions
@@ -0,0 +1,2 @@
+PENPOT_SECRET_KEY=CHANGE_ME
+PENPOT_DATABASE_PASSWORD=CHANGE_ME
@@ -0,0 +1,120 @@
+# Penpot — VPS (ROOTLESS PODMAN). Ported from the home server 2026-08-12.
+#
+# ⚠️ NOT STARTED. No systemd unit is enabled. It has never run on either machine, so
+# there is no data to migrate. Bring it up with:
+#     systemctl --user enable --now podman-penpot.service
+#
+# BEFORE FIRST START, create its role and database on the SHARED postgres (this stack
+# no longer ships its own):
+#     podman exec -i postgresql psql -U npm <<'SQL'
+#     CREATE ROLE penpot LOGIN PASSWORD '<see this service .env on the machine>';
+#     CREATE DATABASE penpot OWNER penpot;
+#     SQL
+# Then add the same lines to PostgreSQL/initdb/00-roles-and-databases.sql.
+#
+# NOTE: the home version used postgres:15-alpine with --data-checksums. The shared
+# instance is postgres 17 without checksums. Penpot does not care, and since there is
+# no existing data this is not a migration — but if you ever DO need checksums, they
+# can only be set at initdb time for the whole cluster.
+#
+# Redis stays local to this stack: Penpot uses it for transient session and
+# notification state only, so it is not worth centralising.
+#
+# Rootless adaptations from the home version:
+#   - Dropped its private postgres:15-alpine; uses the shared instance (AGENTS.md §2).
+#   - PENPOT_DATABASE_URI repointed from penpot-db to the shared postgresql.
+#   - :Z on the assets bind mount. It is shared between frontend and backend, so it
+#     uses LOWERCASE :z -- uppercase would give each container a private MCS category
+#     and the second to start would lock the first out (AGENTS.md §6).
+#   - /etc/localtime mounts removed in favour of TZ (AGENTS.md §8).
+#
+# Registration is disabled by default (PENPOT_FLAGS disable-registration), so create
+# the first account from the backend container before you can log in.
+#
+# NPM: proxy penpot.gbrown.org -> http://penpot-frontend:8080
+
+networks:
+  nginx-bridge:
+    external: true
+
+services:
+  penpot-frontend:
+    image: docker.io/penpotapp/frontend:latest
+    container_name: penpot-frontend
+    hostname: penpot-frontend
+    domainname: penpot.gbrown.org
+    networks: ['nginx-bridge']
+    environment:
+      - TZ=America/New_York
+      - PENPOT_FLAGS=disable-registration enable-login-with-password disable-smtp
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    volumes:
+      - ./volumes/assets:/opt/data/assets:z
+    depends_on:
+      - penpot-backend
+      - penpot-exporter
+    tty: true
+    stdin_open: true
+    restart: unless-stopped
+
+  penpot-backend:
+    image: docker.io/penpotapp/backend:latest
+    container_name: penpot-backend
+    hostname: penpot-backend
+    domainname: penpot.gbrown.org
+    networks: ['nginx-bridge']
+    environment:
+      - TZ=America/New_York
+      - PENPOT_FLAGS=disable-registration enable-login-with-password disable-smtp enable-prepl-server
+      - PENPOT_PUBLIC_URI=https://penpot.gbrown.org
+      - PENPOT_SECRET_KEY=${PENPOT_SECRET_KEY}
+      # Shared postgres, not a private container
+      - PENPOT_DATABASE_URI=postgresql://postgresql/penpot
+      - PENPOT_DATABASE_USERNAME=penpot
+      - PENPOT_DATABASE_PASSWORD=${PENPOT_DATABASE_PASSWORD}
+      - PENPOT_REDIS_URI=redis://penpot-redis/0
+      - PENPOT_ASSETS_STORAGE_BACKEND=assets-fs
+      - PENPOT_STORAGE_ASSETS_FS_DIRECTORY=/opt/data/assets
+      - PENPOT_TELEMETRY_ENABLED=false
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    volumes:
+      - ./volumes/assets:/opt/data/assets:z
+    depends_on:
+      - penpot-redis
+    tty: true
+    stdin_open: true
+    restart: unless-stopped
+
+  penpot-exporter:
+    image: docker.io/penpotapp/exporter:latest
+    container_name: penpot-exporter
+    hostname: penpot-exporter
+    domainname: penpot.gbrown.org
+    networks: ['nginx-bridge']
+    environment:
+      - TZ=America/New_York
+      - PENPOT_PUBLIC_URI=http://penpot-frontend:8080
+      - PENPOT_REDIS_URI=redis://penpot-redis/0
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    depends_on:
+      - penpot-redis
+    tty: true
+    stdin_open: true
+    restart: unless-stopped
+
+  penpot-redis:
+    image: docker.io/library/redis:7-alpine
+    container_name: penpot-redis
+    hostname: penpot-redis
+    domainname: penpot.gbrown.org
+    networks: ['nginx-bridge']
+    environment:
+      - TZ=America/New_York
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    tty: true
+    stdin_open: true
+    restart: unless-stopped
@@ -0,0 +1,21 @@
+[Unit]
+RequiresMountsFor=/home/gib/Media
+Description=Podman Compose: Penpot
+After=network-online.target podman.socket podman-postgresql.service
+Wants=network-online.target podman-postgresql.service
+StartLimitIntervalSec=300
+StartLimitBurst=3
+
+[Service]
+Type=oneshot
+WorkingDirectory=%h/Server/Penpot
+ExecStart=/usr/bin/podman compose up -d
+ExecStop=/usr/bin/podman compose down
+RemainAfterExit=yes
+TimeoutStartSec=900
+TimeoutStopSec=90
+Restart=on-failure
+RestartSec=30
+
+[Install]
+WantedBy=default.target