Gabriel Brown
f33da41cc6
A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
51 lines
1.4 KiB
YAML
51 lines
1.4 KiB
YAML
networks:
|
|
nginx-bridge:
|
|
external: true
|
|
services:
|
|
n8n:
|
|
image: docker.n8n.io/n8nio/n8n:latest
|
|
container_name: n8n
|
|
hostname: n8n
|
|
domainname: n8n.gbrown.org
|
|
networks: ['nginx-bridge']
|
|
#ports: ['5678:5678']
|
|
env_file: [.env]
|
|
environment:
|
|
- GENERIC_TIMEZONE
|
|
- TZ
|
|
- N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS
|
|
- N8N_RUNNERS_ENABLED
|
|
- N8N_RUNNERS_MODE
|
|
- N8N_RUNNERS_BROKER_LISTEN_ADDRESS
|
|
- N8N_RUNNERS_AUTH_TOKEN
|
|
- N8N_NATIVE_PYTHON_RUNNER
|
|
- DB_TYPE
|
|
- DB_POSTGRESDB_DATABASE
|
|
- DB_POSTGRESDB_HOST
|
|
- DB_POSTGRESDB_PORT
|
|
- DB_POSTGRESDB_USER
|
|
- DB_POSTGRESDB_PASSWORD
|
|
# Rootless: replaces `user: 1000:1000`, which under a rootless userns would have
|
|
# resolved to subuid 525287 and lost access to the gib-owned ./data dir.
|
|
userns_mode: "keep-id:uid=1000,gid=1000"
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
volumes:
|
|
- './data:/home/node/.n8n:Z'
|
|
tty: true
|
|
stdin_open: true
|
|
restart: unless-stopped
|
|
|
|
task-runners:
|
|
image: n8nio/runners:1.111.0
|
|
container_name: n8n-runners
|
|
# Was missing: without this the runner sits on the compose default network and
|
|
# cannot resolve N8N_RUNNERS_TASK_BROKER_URI (http://n8n:5679).
|
|
networks: ['nginx-bridge']
|
|
env_file: [.env]
|
|
environment:
|
|
- N8N_RUNNERS_TASK_BROKER_URI
|
|
- N8N_RUNNERS_AUTH_TOKEN
|
|
depends_on:
|
|
- n8n
|