Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

server/containers/PostgreSQL/.env.example

@@ -0,0 +1,4 @@
+POSTGRES_USER=npm
+POSTGRES_PASSWORD=CHANGE_ME
+POSTGRES_NAME=npm
+POSTGRES_DB=npm

server/containers/PostgreSQL/compose.yml

@@ -0,0 +1,80 @@
+networks:
+  nginx-bridge:
+    external: true
+services:
+  postgresql:
+    # pgvector image = stock postgres:17 plus the `vector` extension compiled in. Same
+    # PostgreSQL 17.10 and same data directory format, so this is a drop-in swap with no
+    # dump/restore needed.
+    #
+    # ⚠️ THE TAG MUST STAY -trixie. This is not cosmetic.
+    #
+    # The plain `pgvector/pgvector:pg17` tag is built on Debian 12 (bookworm, glibc 2.36).
+    # The stock `postgres:17` this cluster was created under is Debian 13 (trixie,
+    # glibc 2.41). glibc supplies the collation used to order every text index, and it is
+    # NOT guaranteed stable across versions. Starting on bookworm made all 14 databases
+    # report:
+    #     WARNING: database "npm" has a collation version mismatch
+    #     DETAIL:  created using collation version 2.41, but the OS provides version 2.36
+    # An index built under one collation and read under another can silently return wrong
+    # results — missed rows in range scans, duplicate values slipping past unique
+    # constraints. It does not error; it just quietly answers incorrectly.
+    #
+    # Using the -trixie build keeps glibc at 2.41, matching how the data was written, so
+    # no REINDEX is required. If you ever must move to a different base, the correct
+    # procedure is: REINDEX DATABASE <each>, then ALTER DATABASE <each> REFRESH COLLATION
+    # VERSION — not simply silencing the warning.
+    #
+    # The extension is AVAILABLE but not enabled anywhere by default. To use it in a
+    # database, enable it per-database (it is not cluster-wide):
+    #     podman exec postgresql psql -U npm -d <dbname> -c 'CREATE EXTENSION vector;'
+    #
+    # ⚠️ Do NOT let watchtower update this to a different pg major. It is already in
+    # WATCHTOWER_DISABLE_CONTAINERS, which is what keeps that from happening.
+    image: pgvector/pgvector:pg17-trixie
+    container_name: postgresql
+    # Rootless: maps host uid 1000 (gib) -> container uid 999 (postgres), so ./pg_data
+    # stays gib-owned on the host. Postgres' entrypoint supports running as non-root
+    # provided the data dir ownership matches, which this guarantees.
+    userns_mode: "keep-id:uid=999,gid=999"
+    hostname: postgresql
+    domainname: pg.gbrown.org
+    networks:
+      - nginx-bridge
+    # ⚠️ WIREGUARD ADDRESS ONLY. This was previously '5432:5432', which bound the
+    # database to every interface including the public one — the only thing preventing
+    # the internet from reaching a Postgres auth prompt was firewalld plus the Hetzner
+    # cloud firewall. Two independent firewall rules were the sole barrier in front of
+    # all 14 databases.
+    #
+    # Nothing needs the public binding: every consumer (authentik, infisical, adminer,
+    # the payload/convex app stacks, gitea) resolves `postgresql` over the nginx-bridge
+    # container network and never touches the published port at all. This mapping now
+    # exists purely so you can point a desktop client at it across the tunnel.
+    #
+    # Same pattern as watchtower's API and authentik's 9000 — see AGENTS.md §5.
+    ports: ['192.168.2.2:5432:5432']
+    env_file: .env
+    environment:
+      - POSTGRES_USER
+      - POSTGRES_PASSWORD
+      - POSTGRES_DB
+      - TZ=America/New_York
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    volumes:
+      - ./pg_data:/var/lib/postgresql/data:Z
+      # Runs ONLY when pg_data is empty (fresh install). Recreates every role and
+      # database this VPS needs, so the environment can be rebuilt from scratch without
+      # hand-creating them. Does nothing to an existing database — safe to leave mounted.
+      # The committed file is 00-roles-and-databases.sql.TEMPLATE with placeholder
+      # passwords; copy it to .sql and fill in real values from each service's .env.
+      - ./initdb:/docker-entrypoint-initdb.d:Z
+    tty: true
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
+      start_period: 20s
+      interval: 30s
+      retries: 5
+      timeout: 5s

server/containers/PostgreSQL/podman-postgresql.service

@@ -0,0 +1,21 @@
+[Unit]
+RequiresMountsFor=/home/gib/Media
+Description=Podman Compose: PostgreSQL
+After=network-online.target
+Wants=network-online.target
+StartLimitIntervalSec=300
+StartLimitBurst=3
+
+[Service]
+Type=oneshot
+WorkingDirectory=%h/Server/PostgreSQL
+ExecStart=/usr/bin/podman compose up -d
+ExecStop=/usr/bin/podman compose down
+RemainAfterExit=yes
+TimeoutStartSec=300
+TimeoutStopSec=60
+Restart=on-failure
+RestartSec=30
+
+[Install]
+WantedBy=default.target