Gabriel Brown
f33da41cc6
A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
61 lines
2.3 KiB
YAML
61 lines
2.3 KiB
YAML
# Cal.com — VPS (ROOTLESS PODMAN). Ported from the home server 2026-08-12.
|
|
#
|
|
# ⚠️ NOT STARTED. No systemd unit is enabled. It has never run on either machine, so
|
|
# there is no data to migrate. Bring it up with:
|
|
# systemctl --user enable --now podman-calcom.service
|
|
#
|
|
# BEFORE FIRST START, create its role and database on the SHARED postgres (this stack
|
|
# no longer ships its own):
|
|
# podman exec -i postgresql psql -U npm <<'SQL'
|
|
# CREATE ROLE calcom LOGIN PASSWORD '<see this service .env on the machine>';
|
|
# CREATE DATABASE calcom OWNER calcom;
|
|
# SQL
|
|
# Then add the same lines to PostgreSQL/initdb/00-roles-and-databases.sql.
|
|
#
|
|
# Also unset: EMAIL_SERVER_HOST/USER/PASSWORD are still CHANGE_ME. Cal.com will run,
|
|
# but booking confirmations and invitations will not send.
|
|
#
|
|
# Note Cal.com runs database migrations on first boot and can take several minutes to
|
|
# become responsive. The unit allows 900s for this.
|
|
#
|
|
# Rootless adaptations from the home version:
|
|
# - Dropped its private postgres:16-alpine; uses the shared instance (AGENTS.md §2).
|
|
# - /etc/localtime mount removed in favour of TZ (AGENTS.md §8).
|
|
# - No bind mounts remain, so no :Z is needed.
|
|
#
|
|
# NPM: proxy cal.gbrown.org -> http://calcom:3000
|
|
|
|
networks:
|
|
nginx-bridge:
|
|
external: true
|
|
|
|
services:
|
|
calcom:
|
|
image: docker.io/calcom/cal.com:latest
|
|
container_name: calcom
|
|
hostname: calcom
|
|
domainname: cal.gbrown.org
|
|
networks: ['nginx-bridge']
|
|
environment:
|
|
- TZ=America/New_York
|
|
- NEXT_PUBLIC_WEBAPP_URL=https://cal.gbrown.org
|
|
- NEXT_PUBLIC_WEBSITE_URL=https://cal.gbrown.org
|
|
- NEXTAUTH_URL=https://cal.gbrown.org/api/auth
|
|
- NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
|
|
- CALENDSO_ENCRYPTION_KEY=${CALENDSO_ENCRYPTION_KEY}
|
|
# Shared postgres, not a private container
|
|
- DATABASE_URL=${DATABASE_URL}
|
|
- DATABASE_DIRECT_URL=${DATABASE_DIRECT_URL}
|
|
- NEXT_PUBLIC_LICENSE_CONSENT=agree
|
|
- ALLOWED_HOSTNAMES="cal.gbrown.org"
|
|
- [email protected]
|
|
- EMAIL_SERVER_HOST=CHANGE_ME
|
|
- EMAIL_SERVER_PORT=587
|
|
- EMAIL_SERVER_USER=CHANGE_ME
|
|
- EMAIL_SERVER_PASSWORD=${EMAIL_SERVER_PASSWORD}
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
tty: true
|
|
stdin_open: true
|
|
restart: unless-stopped
|