Gabriel Brown
f33da41cc6
A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
45 lines
1.7 KiB
YAML
45 lines
1.7 KiB
YAML
# Adminer — database admin UI. VPS (ROOTLESS PODMAN), added 2026-08-12.
|
|
#
|
|
# On the home server this shipped alongside a MySQL container in the same compose
|
|
# file. Here it is standalone and defaults to the shared PostgreSQL instance, which
|
|
# is where the 14 databases now live (authentik, infisical_db, n8n, npm, the payload_*
|
|
# and convex databases, usesend, lashaddict-payload, spoon_convex...).
|
|
#
|
|
# MySQL stays on the home server — nothing on the VPS uses it.
|
|
#
|
|
# It can still reach any other database reachable on nginx-bridge; ADMINER_DEFAULT_SERVER
|
|
# only pre-fills the server field on the login form.
|
|
#
|
|
# ⚠️ SECURITY: Adminer has NO authentication of its own — it is a login form that
|
|
# forwards credentials to whichever database you name. Publishing it means exposing a
|
|
# database login prompt to the internet. Put it behind authentik forward-auth in NPM
|
|
# (same pattern as sonarr/prowlarr on the home server), or restrict it to the LAN by
|
|
# giving it only a UniFi record and no Cloudflare record.
|
|
#
|
|
# Rootless adaptations: no bind mounts (stateless, so no :Z needed), no published
|
|
# ports — NPM proxies to http://adminer:8080 over nginx-bridge.
|
|
#
|
|
# NPM: adminer.gbrown.org -> http://adminer:8080
|
|
|
|
networks:
|
|
nginx-bridge:
|
|
external: true
|
|
|
|
services:
|
|
adminer:
|
|
image: docker.io/library/adminer:latest
|
|
container_name: adminer
|
|
hostname: adminer
|
|
domainname: adminer.gbrown.org
|
|
networks:
|
|
- nginx-bridge
|
|
environment:
|
|
- TZ=America/New_York
|
|
# Pre-fills the server field; any nginx-bridge host can still be typed in.
|
|
- ADMINER_DEFAULT_SERVER=postgresql
|
|
- ADMINER_DESIGN=dracula
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
tty: true
|
|
restart: unless-stopped
|