Gabriel Brown
f33da41cc6
A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
81 lines
4.0 KiB
YAML
81 lines
4.0 KiB
YAML
networks:
|
|
nginx-bridge:
|
|
external: true
|
|
services:
|
|
postgresql:
|
|
# pgvector image = stock postgres:17 plus the `vector` extension compiled in. Same
|
|
# PostgreSQL 17.10 and same data directory format, so this is a drop-in swap with no
|
|
# dump/restore needed.
|
|
#
|
|
# ⚠️ THE TAG MUST STAY -trixie. This is not cosmetic.
|
|
#
|
|
# The plain `pgvector/pgvector:pg17` tag is built on Debian 12 (bookworm, glibc 2.36).
|
|
# The stock `postgres:17` this cluster was created under is Debian 13 (trixie,
|
|
# glibc 2.41). glibc supplies the collation used to order every text index, and it is
|
|
# NOT guaranteed stable across versions. Starting on bookworm made all 14 databases
|
|
# report:
|
|
# WARNING: database "npm" has a collation version mismatch
|
|
# DETAIL: created using collation version 2.41, but the OS provides version 2.36
|
|
# An index built under one collation and read under another can silently return wrong
|
|
# results — missed rows in range scans, duplicate values slipping past unique
|
|
# constraints. It does not error; it just quietly answers incorrectly.
|
|
#
|
|
# Using the -trixie build keeps glibc at 2.41, matching how the data was written, so
|
|
# no REINDEX is required. If you ever must move to a different base, the correct
|
|
# procedure is: REINDEX DATABASE <each>, then ALTER DATABASE <each> REFRESH COLLATION
|
|
# VERSION — not simply silencing the warning.
|
|
#
|
|
# The extension is AVAILABLE but not enabled anywhere by default. To use it in a
|
|
# database, enable it per-database (it is not cluster-wide):
|
|
# podman exec postgresql psql -U npm -d <dbname> -c 'CREATE EXTENSION vector;'
|
|
#
|
|
# ⚠️ Do NOT let watchtower update this to a different pg major. It is already in
|
|
# WATCHTOWER_DISABLE_CONTAINERS, which is what keeps that from happening.
|
|
image: pgvector/pgvector:pg17-trixie
|
|
container_name: postgresql
|
|
# Rootless: maps host uid 1000 (gib) -> container uid 999 (postgres), so ./pg_data
|
|
# stays gib-owned on the host. Postgres' entrypoint supports running as non-root
|
|
# provided the data dir ownership matches, which this guarantees.
|
|
userns_mode: "keep-id:uid=999,gid=999"
|
|
hostname: postgresql
|
|
domainname: pg.gbrown.org
|
|
networks:
|
|
- nginx-bridge
|
|
# ⚠️ WIREGUARD ADDRESS ONLY. This was previously '5432:5432', which bound the
|
|
# database to every interface including the public one — the only thing preventing
|
|
# the internet from reaching a Postgres auth prompt was firewalld plus the Hetzner
|
|
# cloud firewall. Two independent firewall rules were the sole barrier in front of
|
|
# all 14 databases.
|
|
#
|
|
# Nothing needs the public binding: every consumer (authentik, infisical, adminer,
|
|
# the payload/convex app stacks, gitea) resolves `postgresql` over the nginx-bridge
|
|
# container network and never touches the published port at all. This mapping now
|
|
# exists purely so you can point a desktop client at it across the tunnel.
|
|
#
|
|
# Same pattern as watchtower's API and authentik's 9000 — see AGENTS.md §5.
|
|
ports: ['192.168.2.2:5432:5432']
|
|
env_file: .env
|
|
environment:
|
|
- POSTGRES_USER
|
|
- POSTGRES_PASSWORD
|
|
- POSTGRES_DB
|
|
- TZ=America/New_York
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
volumes:
|
|
- ./pg_data:/var/lib/postgresql/data:Z
|
|
# Runs ONLY when pg_data is empty (fresh install). Recreates every role and
|
|
# database this VPS needs, so the environment can be rebuilt from scratch without
|
|
# hand-creating them. Does nothing to an existing database — safe to leave mounted.
|
|
# The committed file is 00-roles-and-databases.sql.TEMPLATE with placeholder
|
|
# passwords; copy it to .sql and fill in real values from each service's .env.
|
|
- ./initdb:/docker-entrypoint-initdb.d:Z
|
|
tty: true
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
|
|
start_period: 20s
|
|
interval: 30s
|
|
retries: 5
|
|
timeout: 5s
|