Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

server/containers/Tools/compose.yml

@@ -0,0 +1,88 @@
+# Tools — small self-hosted utilities. VPS (ROOTLESS PODMAN) port of the home server's
+# ~/Server/tools stack, migrated 2026-08-12.
+#
+# Rootless adaptations:
+#   - :Z on every bind mount (SELinux Enforcing). All mounts here are exclusive to a
+#     single container, so uppercase :Z is correct -- see AGENTS.md §6.
+#   - No ports published: NPM proxies to each container by name over nginx-bridge.
+#
+# All four images start as root and drop privileges internally, so no userns_mode is
+# needed (AGENTS.md §3.2).
+
+networks:
+  nginx-bridge:
+    external: true
+
+services:
+  convertx:
+    image: ghcr.io/c4illin/convertx:latest
+    container_name: convertx
+    hostname: convertx
+    domainname: convert.tools.gbrown.org
+    networks: ['nginx-bridge']
+    environment:
+      - TZ=America/New_York
+      - ALLOW_UNAUTHENTICATED=true
+      - ACCOUNT_REGISTRATION=false
+      - HIDE_HISTORY=true
+    volumes:
+      - ./volumes/convertx:/app/data:Z
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    tty: true
+    restart: unless-stopped
+
+  it-tools:
+    image: docker.io/corentinth/it-tools:latest
+    container_name: it-tools
+    hostname: it-tools
+    domainname: tools.gbrown.org
+    networks: ['nginx-bridge']
+    environment:
+      - TZ=America/New_York
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    tty: true
+    restart: unless-stopped
+
+  pdf-tools:
+    image: docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest
+    container_name: pdf-tools
+    hostname: pdf-tools
+    domainname: pdf.tools.gbrown.org
+    networks: ['nginx-bridge']
+    environment:
+      - TZ=America/New_York
+      - LANGS=en_US
+      - DOCKER_ENABLE_SECURITY=true
+    volumes:
+      - ./volumes/pdf-tools/trainingData:/usr/share/tessdata:Z
+      - ./volumes/pdf-tools/extraConfigs:/configs:Z
+      - ./volumes/pdf-tools/customFiles:/customFiles:Z
+      - ./volumes/pdf-tools/logs:/logs/:Z
+      - ./volumes/pdf-tools/pipeline:/pipeline/:Z
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    tty: true
+    restart: unless-stopped
+
+  bento-pdf:
+    image: ghcr.io/alam00000/bentopdf:latest
+    container_name: bento-pdf
+    hostname: bento-pdf
+    domainname: bento.tools.gbrown.org
+    networks: ['nginx-bridge']
+    environment:
+      - TZ=America/New_York
+      - PUID=1000
+      - PGID=1000
+      - VITE_BRAND_NAME="GibPDF"
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+    tty: true
+    restart: unless-stopped
+    healthcheck:
+      test: ['CMD', 'wget', '--spider', '-q', 'http://localhost:8080']
+      interval: 30s
+      timeout: 10s
+      retries: 3

server/containers/Tools/podman-tools.service

@@ -0,0 +1,21 @@
+[Unit]
+RequiresMountsFor=/home/gib/Media
+Description=Podman Compose: Tools
+After=network-online.target podman.socket
+Wants=network-online.target
+StartLimitIntervalSec=300
+StartLimitBurst=3
+
+[Service]
+Type=oneshot
+WorkingDirectory=%h/Server/Tools
+ExecStart=/usr/bin/podman compose up -d
+ExecStop=/usr/bin/podman compose down
+RemainAfterExit=yes
+TimeoutStartSec=600
+TimeoutStopSec=60
+Restart=on-failure
+RestartSec=30
+
+[Install]
+WantedBy=default.target