Gabriel Brown
f33da41cc6
A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
32 lines
1.1 KiB
YAML
32 lines
1.1 KiB
YAML
services:
|
|
portainer:
|
|
image: portainer/portainer-ee:latest
|
|
container_name: portainer
|
|
hostname: portainer
|
|
domainname: port.gibbyb.com
|
|
networks:
|
|
- nginx-bridge
|
|
environment:
|
|
- TZ=America/New_York
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
ports:
|
|
# WireGuard address only — this admin UI has no business on the public
|
|
# interface. It has its own login and the Hetzner firewall does not admit this
|
|
# port, so this is defence in depth: it removes the dependency on a firewall rule
|
|
# set that lives in a web console. See AGENTS.md §13.2.
|
|
- 192.168.2.2:9443:9443
|
|
# Required under SELinux Enforcing to reach the rootless podman socket, which
|
|
# systemd recreates at each boot with a non-container label. The socket mount
|
|
# deliberately has no :Z -- relabeling the live socket would break podman itself.
|
|
security_opt: ['label:disable']
|
|
volumes:
|
|
- ./volumes/data:/data:Z
|
|
- /run/user/1000/podman/podman.sock:/var/run/docker.sock
|
|
tty: true
|
|
restart: unless-stopped
|
|
|
|
networks:
|
|
nginx-bridge:
|
|
external: true
|