Gabriel Brown
f33da41cc6
A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
63 lines
2.2 KiB
YAML
63 lines
2.2 KiB
YAML
# Infisical — VPS (ROOTLESS PODMAN) port of the home server's ~/Server/infisical,
|
|
# migrated 2026-08-12.
|
|
#
|
|
# CONSOLIDATED ONTO THE SHARED POSTGRES. Home runs a dedicated postgres:14 for infisical;
|
|
# here it uses the shared `postgresql` container (PG 17) alongside authentik, n8n and NPM.
|
|
# The PG14 dump restored into PG17 cleanly (no extensions, 749 tables, row counts verified
|
|
# identical). One postgres to back up, patch and monitor instead of several.
|
|
#
|
|
# role/database: infisical_user / infisical_db (created in the shared instance)
|
|
# DB_CONNECTION_URI in .env points at host `postgresql`, not the old `db`
|
|
# REDIS_URL points at `infisical-redis` -- container_name is what netavark resolves
|
|
# on nginx-bridge, so the home file's bare `redis` hostname does not work here
|
|
#
|
|
# redis stays local to this stack: it holds only cache/queue state, starts empty by
|
|
# design, and is not worth centralising.
|
|
#
|
|
# Rootless adaptations:
|
|
# - :Z on the redis data mount (SELinux Enforcing).
|
|
# - No published ports; NPM proxies to http://infisical-backend:8080 over nginx-bridge.
|
|
# - Images start as root and drop privileges internally, so no userns_mode needed.
|
|
#
|
|
# .env is copied verbatim from home (mode 600) and holds ENCRYPTION_KEY and AUTH_SECRET.
|
|
# Those MUST match the database they encrypted -- never regenerate them on migrated data.
|
|
|
|
networks:
|
|
nginx-bridge:
|
|
external: true
|
|
|
|
services:
|
|
redis:
|
|
image: docker.io/library/redis:latest
|
|
container_name: infisical-redis
|
|
hostname: infisical-redis
|
|
networks: ["nginx-bridge"]
|
|
env_file: .env
|
|
environment:
|
|
- ALLOW_EMPTY_PASSWORD=yes
|
|
- TZ=America/New_York
|
|
volumes:
|
|
- ./data/redis:/data:Z
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
restart: unless-stopped
|
|
tty: true
|
|
|
|
backend:
|
|
image: docker.io/infisical/infisical:latest
|
|
container_name: infisical-backend
|
|
hostname: infisical-backend
|
|
domainname: infisical.gbrown.org
|
|
networks: ["nginx-bridge"]
|
|
env_file: .env
|
|
environment:
|
|
- NODE_ENV=production
|
|
- TZ=America/New_York
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
depends_on:
|
|
- redis
|
|
restart: unless-stopped
|
|
tty: true
|
|
stdin_open: true
|