Gabriel Brown
f33da41cc6
A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
28 lines
1.0 KiB
YAML
28 lines
1.0 KiB
YAML
networks:
|
|
nginx-bridge:
|
|
external: true # ALWAYS external; see AGENTS.md §5
|
|
|
|
services:
|
|
agentchat:
|
|
image: git.gbrown.org/gib/agentchat:latest
|
|
container_name: agentchat
|
|
hostname: agentchat
|
|
domainname: agentchat.gbrown.org
|
|
networks: ['nginx-bridge']
|
|
ports:
|
|
# Loopback only: lets this host's own agent reach the hub at
|
|
# http://127.0.0.1:8080 without going through NPM - the LAN access
|
|
# list there blocks the VPS's public IP. Unreachable from elsewhere.
|
|
- '127.0.0.1:8080:8080'
|
|
environment:
|
|
- TZ=America/New_York
|
|
- AGENTCHAT_DB=/data/agentchat.db
|
|
volumes:
|
|
- ./data:/data:z # lowercase :z — watchtower recreates DROP the relabel flag, and :Z-category files would lock the new container out (learned 2026-08-13); :z keeps them accessible
|
|
labels: ['com.centurylinklabs.watchtower.enable=true']
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: wget -qO- http://localhost:8080/healthz || exit 1
|
|
interval: 30s
|
|
start_period: 10s
|