Gabriel Brown
913a57f8a6
The catalog in server/containers had drifted from the VPS. Eleven compose
files and twelve units no longer matched what runs, and two running
services, Gbrown_Agent and BillTracker, were missing. server/vps is now a
copy of the live files, and panama-server reads from it.
server/home holds the home server's services in the same shape. They still
run under Docker, so the podman units there are drafts for a later move, and
nothing installs from that tree. PostHog, Sentry and Plausible are checkouts
of upstream repositories. Only their local files are kept, next to an
UPSTREAM file naming the repository and the exact commit.
Every secret in both trees is a ${VAR} reference named in .env.example, or
CHANGE_ME in files that are not compose files. The live servers still hold
some of those values inline, so a live file can differ from its copy on
those lines alone. Existing .env.example files keep their comments, with new
keys appended at the end.
The ignore rules and the secrets contract now cover both trees, plus the
volume/ and volumes/ directories the home server uses.
63 lines
2.2 KiB
YAML
63 lines
2.2 KiB
YAML
# Infisical — VPS (ROOTLESS PODMAN) port of the home server's ~/Server/infisical,
|
|
# migrated 2026-08-12.
|
|
#
|
|
# CONSOLIDATED ONTO THE SHARED POSTGRES. Home runs a dedicated postgres:14 for infisical;
|
|
# here it uses the shared `postgresql` container (PG 17) alongside authentik, n8n and NPM.
|
|
# The PG14 dump restored into PG17 cleanly (no extensions, 749 tables, row counts verified
|
|
# identical). One postgres to back up, patch and monitor instead of several.
|
|
#
|
|
# role/database: infisical_user / infisical_db (created in the shared instance)
|
|
# DB_CONNECTION_URI in .env points at host `postgresql`, not the old `db`
|
|
# REDIS_URL points at `infisical-redis` -- container_name is what netavark resolves
|
|
# on nginx-bridge, so the home file's bare `redis` hostname does not work here
|
|
#
|
|
# redis stays local to this stack: it holds only cache/queue state, starts empty by
|
|
# design, and is not worth centralising.
|
|
#
|
|
# Rootless adaptations:
|
|
# - :Z on the redis data mount (SELinux Enforcing).
|
|
# - No published ports; NPM proxies to http://infisical-backend:8080 over nginx-bridge.
|
|
# - Images start as root and drop privileges internally, so no userns_mode needed.
|
|
#
|
|
# .env is copied verbatim from home (mode 600) and holds ENCRYPTION_KEY and AUTH_SECRET.
|
|
# Those MUST match the database they encrypted -- never regenerate them on migrated data.
|
|
|
|
networks:
|
|
nginx-bridge:
|
|
external: true
|
|
|
|
services:
|
|
redis:
|
|
image: docker.io/library/redis:latest
|
|
container_name: infisical-redis
|
|
hostname: infisical-redis
|
|
networks: ["nginx-bridge"]
|
|
env_file: .env
|
|
environment:
|
|
- ALLOW_EMPTY_PASSWORD=yes
|
|
- TZ=America/New_York
|
|
volumes:
|
|
- ./data/redis:/data:Z
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
restart: unless-stopped
|
|
tty: true
|
|
|
|
backend:
|
|
image: docker.io/infisical/infisical:latest
|
|
container_name: infisical-backend
|
|
hostname: infisical-backend
|
|
domainname: infisical.gbrown.org
|
|
networks: ["nginx-bridge"]
|
|
env_file: .env
|
|
environment:
|
|
- NODE_ENV=production
|
|
- TZ=America/New_York
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
depends_on:
|
|
- redis
|
|
restart: unless-stopped
|
|
tty: true
|
|
stdin_open: true
|