Gabriel Brown
f33da41cc6
A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
53 lines
1.7 KiB
YAML
53 lines
1.7 KiB
YAML
services:
|
|
nginx-proxy-manager:
|
|
image: jc21/nginx-proxy-manager:latest
|
|
container_name: nginx-proxy-manager
|
|
hostname: nginx-proxy-manager
|
|
domainname: nginx.gibbyb.com
|
|
networks: ['nginx-bridge']
|
|
restart: unless-stopped
|
|
ports:
|
|
- '80:80'
|
|
- '443:443'
|
|
# ⚠️ ONLY 81 moves. 80 and 443 above MUST stay on 0.0.0.0 — they are the
|
|
# public front door and firewalld already restricts them to Cloudflare ranges.
|
|
# 81 is the admin UI and is reached over WireGuard (http://192.168.2.2:81).
|
|
- '192.168.2.2:81:81' # Admin Web Port — WireGuard only
|
|
#- '21:21' # FTP
|
|
#- '22:22' # SSH
|
|
#- '25565:25565' # Minecraft
|
|
environment:
|
|
- TZ=America/New_York
|
|
- DB_POSTGRES_HOST
|
|
- DB_POSTGRES_PORT
|
|
- DB_POSTGRES_USER
|
|
- DB_POSTGRES_PASSWORD
|
|
- DB_POSTGRES_NAME
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: 'true'
|
|
volumes:
|
|
- ./volumes/data:/data:Z
|
|
- ./volumes/letsencrypt:/etc/letsencrypt:Z
|
|
#depends_on: [postgresql]
|
|
|
|
#postgresql:
|
|
#image: postgres:17
|
|
#container_name: nginx-proxy-manager-db
|
|
#hostname: nginx-proxy-manager-db
|
|
#networks: ['nginx-bridge']
|
|
#environment:
|
|
#POSTGRES_USER: 'npm'
|
|
#POSTGRES_PASSWORD: '<see this service .env on the machine>'
|
|
#POSTGRES_DB: 'npm'
|
|
#labels:
|
|
#com.centurylinklabs.watchtower.enable: 'true'
|
|
#volumes:
|
|
#- ./volumes/postgres:/var/lib/postgresql/data
|
|
#restart: unless-stopped
|
|
|
|
networks:
|
|
# Created out-of-band so all nine stacks agree and there is no create race at boot:
|
|
# podman network create --subnet 172.18.0.0/24 nginx-bridge
|
|
nginx-bridge:
|
|
external: true
|