Gabriel Brown
f33da41cc6
A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
23 lines
1021 B
Desktop File
23 lines
1021 B
Desktop File
[Unit]
|
|
# Nightly image updates. Replaces watchtower, which recreated containers outside
|
|
# their podman-compose pod and took gitea down for three days — see the header
|
|
# of server/scripts/update-containers.
|
|
Description=Pull new container images and restart changed services
|
|
Documentation=https://git.gbrown.org/gib/Panama
|
|
# Needs the network and the podman socket path to exist.
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
# %h rather than a literal home so the unit works for whichever user linked it.
|
|
# The one assumption is the standard checkout path; a machine with PANAMA_PATH
|
|
# somewhere else edits this line, and setup-server will say so when the script
|
|
# is not where this points.
|
|
ExecStart=%h/.local/share/Panama/server/scripts/update-containers
|
|
# Pulling ~20 images over a slow registry can take a while; do not kill it early.
|
|
TimeoutStartSec=3600
|
|
# The script logs to ~/Server/logs/update-containers.log as well as the journal.
|
|
StandardOutput=journal
|
|
StandardError=journal
|