Gabriel Brown
f33da41cc6
A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
89 lines
2.6 KiB
YAML
89 lines
2.6 KiB
YAML
# Tools — small self-hosted utilities. VPS (ROOTLESS PODMAN) port of the home server's
|
|
# ~/Server/tools stack, migrated 2026-08-12.
|
|
#
|
|
# Rootless adaptations:
|
|
# - :Z on every bind mount (SELinux Enforcing). All mounts here are exclusive to a
|
|
# single container, so uppercase :Z is correct -- see AGENTS.md §6.
|
|
# - No ports published: NPM proxies to each container by name over nginx-bridge.
|
|
#
|
|
# All four images start as root and drop privileges internally, so no userns_mode is
|
|
# needed (AGENTS.md §3.2).
|
|
|
|
networks:
|
|
nginx-bridge:
|
|
external: true
|
|
|
|
services:
|
|
convertx:
|
|
image: ghcr.io/c4illin/convertx:latest
|
|
container_name: convertx
|
|
hostname: convertx
|
|
domainname: convert.tools.gbrown.org
|
|
networks: ['nginx-bridge']
|
|
environment:
|
|
- TZ=America/New_York
|
|
- ALLOW_UNAUTHENTICATED=true
|
|
- ACCOUNT_REGISTRATION=false
|
|
- HIDE_HISTORY=true
|
|
volumes:
|
|
- ./volumes/convertx:/app/data:Z
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
tty: true
|
|
restart: unless-stopped
|
|
|
|
it-tools:
|
|
image: docker.io/corentinth/it-tools:latest
|
|
container_name: it-tools
|
|
hostname: it-tools
|
|
domainname: tools.gbrown.org
|
|
networks: ['nginx-bridge']
|
|
environment:
|
|
- TZ=America/New_York
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
tty: true
|
|
restart: unless-stopped
|
|
|
|
pdf-tools:
|
|
image: docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest
|
|
container_name: pdf-tools
|
|
hostname: pdf-tools
|
|
domainname: pdf.tools.gbrown.org
|
|
networks: ['nginx-bridge']
|
|
environment:
|
|
- TZ=America/New_York
|
|
- LANGS=en_US
|
|
- DOCKER_ENABLE_SECURITY=true
|
|
volumes:
|
|
- ./volumes/pdf-tools/trainingData:/usr/share/tessdata:Z
|
|
- ./volumes/pdf-tools/extraConfigs:/configs:Z
|
|
- ./volumes/pdf-tools/customFiles:/customFiles:Z
|
|
- ./volumes/pdf-tools/logs:/logs/:Z
|
|
- ./volumes/pdf-tools/pipeline:/pipeline/:Z
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
tty: true
|
|
restart: unless-stopped
|
|
|
|
bento-pdf:
|
|
image: ghcr.io/alam00000/bentopdf:latest
|
|
container_name: bento-pdf
|
|
hostname: bento-pdf
|
|
domainname: bento.tools.gbrown.org
|
|
networks: ['nginx-bridge']
|
|
environment:
|
|
- TZ=America/New_York
|
|
- PUID=1000
|
|
- PGID=1000
|
|
- VITE_BRAND_NAME="GibPDF"
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
tty: true
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ['CMD', 'wget', '--spider', '-q', 'http://localhost:8080']
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|