41a01c60ef
Add base Docker Compose projects under platform-infra/stacks, using the Phase 1 ZFS platform datasets and shared networks: - bootstrap-networks.sh: idempotent creation of shared `proxy` (edge) and `platform` (internal) Docker networks. - traefik: edge router with TLS/ACME (HTTP-01), global HTTP->HTTPS redirect, file-based security-headers/TLS middlewares, and a basic-auth dashboard. Docker access via a least-privilege tecnativa/docker-socket-proxy instead of mounting docker.sock directly. - mariadb: shared instance on tank/platform/mariadb, utf8mb4, tuned; not published to the host (internal `platform` network only). - forgejo: Git + container registry over HTTPS (SSH disabled to avoid extra inbound ports), SQLite backend, data on tank/platform/forgejo. Each stack ships a committed .env.example (real .env is git-ignored) and the stacks README documents bring-up order, secrets, and verification. Also add root CLAUDE.md so fresh sessions orient from files cheaply: philosophy, doc pointers, naming quick-ref, repo map, commands, agreements. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
26 lines
852 B
YAML
26 lines
852 B
YAML
# Shared MariaDB. Per-site databases + least-privilege users are created later by
|
|
# the provisioning CLI (Phase 4). Not published to the host — reachable only by
|
|
# containers on the internal `platform` network.
|
|
services:
|
|
mariadb:
|
|
image: mariadb:11.4
|
|
container_name: mariadb
|
|
restart: unless-stopped
|
|
environment:
|
|
MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD}
|
|
MARIADB_AUTO_UPGRADE: "1"
|
|
volumes:
|
|
- /tank/platform/mariadb:/var/lib/mysql
|
|
- ./conf/99-heleos.cnf:/etc/mysql/mariadb.conf.d/99-heleos.cnf:ro
|
|
networks:
|
|
- platform
|
|
healthcheck:
|
|
test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
|
|
interval: 20s
|
|
timeout: 5s
|
|
retries: 10
|
|
# Root is reachable only from within the container/platform net; no host port.
|
|
|
|
networks:
|
|
platform:
|
|
external: true
|