Gabriel Brown
f33da41cc6
A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
71 lines
2.6 KiB
YAML
71 lines
2.6 KiB
YAML
# Beszel — lightweight host + container monitoring, VPS (ROOTLESS PODMAN) edition.
|
|
#
|
|
# Adapted from the home server's Docker/root version. Differences and why:
|
|
#
|
|
# docker.sock -> /run/user/1000/podman/podman.sock
|
|
# Rootless podman's API socket. It exposes ONLY rootless containers, which is
|
|
# exactly the set we want reported. No :Z on the socket mount -- relabeling the
|
|
# live socket breaks podman. See AGENTS.md §6.
|
|
#
|
|
# security_opt: label:disable on the agent
|
|
# Required under SELinux Enforcing to read that socket, which systemd recreates
|
|
# each boot as user_tmp_t. Same treatment as portainer/uptime.
|
|
#
|
|
# EXTRA_FILESYSTEMS=/boot dropped
|
|
# The home server has /boot on its own 974M partition. This VPS does not --
|
|
# /dev/sda1 is the whole root fs and /boot/efi is a 64M ESP not worth alerting on.
|
|
#
|
|
# No hostname/domainname on the agent
|
|
# Host networking forbids them, same as on the home server.
|
|
#
|
|
# The hub generates its keypair on first start at ./volumes/hub/id_ed25519.pub.
|
|
# That public key is what goes in the agent's KEY below.
|
|
|
|
networks:
|
|
nginx-bridge:
|
|
external: true
|
|
|
|
services:
|
|
beszel:
|
|
image: docker.io/henrygd/beszel:latest
|
|
container_name: beszel
|
|
hostname: beszel
|
|
domainname: beszel.gibbyb.com
|
|
networks: ['nginx-bridge']
|
|
# No published port: NPM proxies to http://beszel:8090 over nginx-bridge.
|
|
environment:
|
|
- TZ=America/New_York
|
|
# Lets the hub reach a host-network agent. Under rootless podman this resolves to
|
|
# the nginx-bridge gateway (172.18.0.1). Add the VPS in the hub UI with host
|
|
# "host.docker.internal", port 45876.
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
volumes:
|
|
- ./volumes/hub:/beszel_data:Z
|
|
tty: true
|
|
stdin_open: true
|
|
restart: unless-stopped
|
|
|
|
beszel-agent:
|
|
image: docker.io/henrygd/beszel-agent:latest
|
|
container_name: beszel-agent
|
|
network_mode: host
|
|
environment:
|
|
- TZ=America/New_York
|
|
- PORT=45876
|
|
# This hub's public key. Newer Beszel writes only ./volumes/hub/id_ed25519 (private);
|
|
# derive the public half with: ssh-keygen -y -f volumes/hub/id_ed25519
|
|
# It is a PUBLIC key -- safe to keep in this file.
|
|
- KEY=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDBWNqxKGRltqXJZg+wlDOtICeLo19ftQ6P3P8+uJg8y
|
|
security_opt: ['label:disable']
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
volumes:
|
|
- ./volumes/agent:/var/lib/beszel-agent:Z
|
|
- /run/user/1000/podman/podman.sock:/var/run/docker.sock:ro
|
|
tty: true
|
|
stdin_open: true
|
|
restart: unless-stopped
|