Gabriel Brown
f33da41cc6
A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
102 lines
4.1 KiB
YAML
102 lines
4.1 KiB
YAML
networks:
|
|
nginx-bridge: # Change to network you plan to use
|
|
external: true
|
|
|
|
services:
|
|
stpeteit-next:
|
|
image: git.gbrown.org/gib/stpeteit-next:latest
|
|
container_name: stpeteit-next
|
|
hostname: stpeteit-next
|
|
domainname: ${NEXT_DOMAIN}
|
|
networks: ['${NETWORK:-nginx-bridge}']
|
|
#ports: ['${NEXT_PORT}:${NEXT_PORT}']
|
|
environment:
|
|
- NODE_ENV=${NODE_ENV:-development}
|
|
- SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN}
|
|
- PAYLOAD_SECRET=${PAYLOAD_SECRET}
|
|
- PAYLOAD_DB_URL=${PAYLOAD_DB_URL}
|
|
- NEXT_PUBLIC_SITE_URL=${NEXT_PUBLIC_SITE_URL:-http://localhost:${NEXT_PORT:-3000}}
|
|
- NEXT_PUBLIC_CONVEX_URL=${NEXT_PUBLIC_CONVEX_URL:-http://${BACKEND_CONTAINER_NAME:-stpeteit-backend}:${BACKEND_PORT:-3210}}
|
|
- NEXT_PUBLIC_PLAUSIBLE_URL=${NEXT_PUBLIC_PLAUSIBLE_URL:-https://plausible.stpeteit.com}
|
|
- NEXT_PUBLIC_SENTRY_DSN=${NEXT_PUBLIC_SENTRY_DSN}
|
|
- NEXT_PUBLIC_SENTRY_URL=${NEXT_PUBLIC_SENTRY_URL}
|
|
- NEXT_PUBLIC_SENTRY_ORG=${NEXT_PUBLIC_SENTRY_ORG:-sentry}
|
|
- NEXT_PUBLIC_SENTRY_PROJECT_NAME=${NEXT_PUBLIC_SENTRY_PROJECT_NAME}
|
|
labels: ['com.centurylinklabs.watchtower.enable=true']
|
|
depends_on: ['stpeteit-backend']
|
|
tty: true
|
|
stdin_open: true
|
|
restart: unless-stopped
|
|
|
|
stpeteit-backend:
|
|
image: ghcr.io/get-convex/convex-backend:${BACKEND_TAG:-latest}
|
|
container_name: ${BACKEND_CONTAINER_NAME:-stpeteit-backend}
|
|
hostname: ${BACKEND_CONTAINER_NAME:-stpeteit-backend}
|
|
domainname: ${BACKEND_DOMAIN:-convex.stpeteit.com}
|
|
networks: ['${NETWORK:-nginx-bridge}']
|
|
#user: '1000:1000'
|
|
#ports: ['${BACKEND_PORT:-3210}:3210','${SITE_PROXY_PORT:-3211}:3211']
|
|
volumes: [./data:/convex/data:z]
|
|
labels: ['com.centurylinklabs.watchtower.enable=true']
|
|
environment:
|
|
- INSTANCE_NAME
|
|
#- INSTANCE_SECRET
|
|
- CONVEX_CLOUD_ORIGIN=${CONVEX_CLOUD_ORIGIN:-http://${BACKEND_CONTAINER_NAME:-stpeteit-backend}:${BACKEND_PORT:-3210}}
|
|
- CONVEX_SITE_ORIGIN=${CONVEX_SITE_ORIGIN:-http://${BACKEND_CONTAINER_NAME:-stpeteit-backend}:${SITE_PROXY_PORT:-3211}}
|
|
- DISABLE_BEACON=${DISABLE_BEACON:-true}
|
|
- REDACT_LOGS_TO_CLIENT=${REDACT_LOGS_TO_CLIENT:-true}
|
|
- DO_NOT_REQUIRE_SSL=${DO_NOT_REQUIRE_SSL:-false}
|
|
- POSTGRES_URL=${POSTGRES_URL}
|
|
stdin_open: true
|
|
tty: true
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: curl -f http://localhost:3210/version
|
|
interval: 5s
|
|
start_period: 10s
|
|
stop_grace_period: 10s
|
|
stop_signal: SIGINT
|
|
|
|
stpeteit-dashboard:
|
|
image: ghcr.io/get-convex/convex-dashboard:${DASHBOARD_TAG:-latest}
|
|
container_name: ${DASHBOARD_CONTAINER_NAME:-stpeteit-dashboard}
|
|
hostname: ${DASHBOARD_CONTAINER_NAME:-stpeteit-dashboard}
|
|
domainname: ${DASHBOARD_DOMAIN:-dashboard.${BACKEND_DOMAIN:-convex.stpete.com}}
|
|
networks: ['${NETWORK:-nginx-bridge}']
|
|
#user: 1000:1000
|
|
#ports: ['${DASHBOARD_PORT:-6791}:6791']
|
|
labels: ['com.centurylinklabs.watchtower.enable=true']
|
|
environment:
|
|
- NEXT_PUBLIC_DEPLOYMENT_URL=${NEXT_PUBLIC_DEPLOYMENT_URL:-http://${BACKEND_CONTAINER_NAME:-stpeteit-backend}:${PORT:-3210}}
|
|
depends_on:
|
|
stpeteit-backend:
|
|
condition: service_healthy
|
|
stdin_open: true
|
|
tty: true
|
|
restart: unless-stopped
|
|
stop_grace_period: 10s
|
|
stop_signal: SIGINT
|
|
|
|
#convexmonorepo-postgresql:
|
|
#image: postgres:17
|
|
#container_name: ${POSTGRES_CONTAINER_NAME:-convexmonorepo-postgres}
|
|
#hostname: ${POSTGRES_CONTAINER_NAME:-convexmonorepo-postgres}
|
|
#domainname: postgres.${NEXT_DOMAIN:-convexmonorepo.gbrown.org}
|
|
#networks: ['${NETWORK:-nginx-bridge}']
|
|
#ports: ['5432:5432']
|
|
#environment:
|
|
#- POSTGRES_USER=${POSTGRES_USER:-convexmonorepo}
|
|
#- POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
|
|
#- POSTGRES_DB=${POSTGRES_DB:-convexmonorepo_payload}
|
|
#labels: ['com.centurylinklabs.watchtower.enable=true']
|
|
#volumes: ['./volumes/postgres:/var/lib/postgresql/data:Z']
|
|
#tty: true
|
|
#stdin_open: true
|
|
#restart: unless-stopped
|
|
#healthcheck:
|
|
#test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
|
|
#start_period: 20s
|
|
#interval: 30s
|
|
#retries: 5
|
|
#timeout: 5s
|