Gabriel Brown
f33da41cc6
A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
121 lines
4.3 KiB
YAML
121 lines
4.3 KiB
YAML
# Penpot — VPS (ROOTLESS PODMAN). Ported from the home server 2026-08-12.
|
|
#
|
|
# ⚠️ NOT STARTED. No systemd unit is enabled. It has never run on either machine, so
|
|
# there is no data to migrate. Bring it up with:
|
|
# systemctl --user enable --now podman-penpot.service
|
|
#
|
|
# BEFORE FIRST START, create its role and database on the SHARED postgres (this stack
|
|
# no longer ships its own):
|
|
# podman exec -i postgresql psql -U npm <<'SQL'
|
|
# CREATE ROLE penpot LOGIN PASSWORD '<see this service .env on the machine>';
|
|
# CREATE DATABASE penpot OWNER penpot;
|
|
# SQL
|
|
# Then add the same lines to PostgreSQL/initdb/00-roles-and-databases.sql.
|
|
#
|
|
# NOTE: the home version used postgres:15-alpine with --data-checksums. The shared
|
|
# instance is postgres 17 without checksums. Penpot does not care, and since there is
|
|
# no existing data this is not a migration — but if you ever DO need checksums, they
|
|
# can only be set at initdb time for the whole cluster.
|
|
#
|
|
# Redis stays local to this stack: Penpot uses it for transient session and
|
|
# notification state only, so it is not worth centralising.
|
|
#
|
|
# Rootless adaptations from the home version:
|
|
# - Dropped its private postgres:15-alpine; uses the shared instance (AGENTS.md §2).
|
|
# - PENPOT_DATABASE_URI repointed from penpot-db to the shared postgresql.
|
|
# - :Z on the assets bind mount. It is shared between frontend and backend, so it
|
|
# uses LOWERCASE :z -- uppercase would give each container a private MCS category
|
|
# and the second to start would lock the first out (AGENTS.md §6).
|
|
# - /etc/localtime mounts removed in favour of TZ (AGENTS.md §8).
|
|
#
|
|
# Registration is disabled by default (PENPOT_FLAGS disable-registration), so create
|
|
# the first account from the backend container before you can log in.
|
|
#
|
|
# NPM: proxy penpot.gbrown.org -> http://penpot-frontend:8080
|
|
|
|
networks:
|
|
nginx-bridge:
|
|
external: true
|
|
|
|
services:
|
|
penpot-frontend:
|
|
image: docker.io/penpotapp/frontend:latest
|
|
container_name: penpot-frontend
|
|
hostname: penpot-frontend
|
|
domainname: penpot.gbrown.org
|
|
networks: ['nginx-bridge']
|
|
environment:
|
|
- TZ=America/New_York
|
|
- PENPOT_FLAGS=disable-registration enable-login-with-password disable-smtp
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
volumes:
|
|
- ./volumes/assets:/opt/data/assets:z
|
|
depends_on:
|
|
- penpot-backend
|
|
- penpot-exporter
|
|
tty: true
|
|
stdin_open: true
|
|
restart: unless-stopped
|
|
|
|
penpot-backend:
|
|
image: docker.io/penpotapp/backend:latest
|
|
container_name: penpot-backend
|
|
hostname: penpot-backend
|
|
domainname: penpot.gbrown.org
|
|
networks: ['nginx-bridge']
|
|
environment:
|
|
- TZ=America/New_York
|
|
- PENPOT_FLAGS=disable-registration enable-login-with-password disable-smtp enable-prepl-server
|
|
- PENPOT_PUBLIC_URI=https://penpot.gbrown.org
|
|
- PENPOT_SECRET_KEY=${PENPOT_SECRET_KEY}
|
|
# Shared postgres, not a private container
|
|
- PENPOT_DATABASE_URI=postgresql://postgresql/penpot
|
|
- PENPOT_DATABASE_USERNAME=penpot
|
|
- PENPOT_DATABASE_PASSWORD=${PENPOT_DATABASE_PASSWORD}
|
|
- PENPOT_REDIS_URI=redis://penpot-redis/0
|
|
- PENPOT_ASSETS_STORAGE_BACKEND=assets-fs
|
|
- PENPOT_STORAGE_ASSETS_FS_DIRECTORY=/opt/data/assets
|
|
- PENPOT_TELEMETRY_ENABLED=false
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
volumes:
|
|
- ./volumes/assets:/opt/data/assets:z
|
|
depends_on:
|
|
- penpot-redis
|
|
tty: true
|
|
stdin_open: true
|
|
restart: unless-stopped
|
|
|
|
penpot-exporter:
|
|
image: docker.io/penpotapp/exporter:latest
|
|
container_name: penpot-exporter
|
|
hostname: penpot-exporter
|
|
domainname: penpot.gbrown.org
|
|
networks: ['nginx-bridge']
|
|
environment:
|
|
- TZ=America/New_York
|
|
- PENPOT_PUBLIC_URI=http://penpot-frontend:8080
|
|
- PENPOT_REDIS_URI=redis://penpot-redis/0
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
depends_on:
|
|
- penpot-redis
|
|
tty: true
|
|
stdin_open: true
|
|
restart: unless-stopped
|
|
|
|
penpot-redis:
|
|
image: docker.io/library/redis:7-alpine
|
|
container_name: penpot-redis
|
|
hostname: penpot-redis
|
|
domainname: penpot.gbrown.org
|
|
networks: ['nginx-bridge']
|
|
environment:
|
|
- TZ=America/New_York
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
tty: true
|
|
stdin_open: true
|
|
restart: unless-stopped
|