41a01c60ef
Add base Docker Compose projects under platform-infra/stacks, using the Phase 1 ZFS platform datasets and shared networks: - bootstrap-networks.sh: idempotent creation of shared `proxy` (edge) and `platform` (internal) Docker networks. - traefik: edge router with TLS/ACME (HTTP-01), global HTTP->HTTPS redirect, file-based security-headers/TLS middlewares, and a basic-auth dashboard. Docker access via a least-privilege tecnativa/docker-socket-proxy instead of mounting docker.sock directly. - mariadb: shared instance on tank/platform/mariadb, utf8mb4, tuned; not published to the host (internal `platform` network only). - forgejo: Git + container registry over HTTPS (SSH disabled to avoid extra inbound ports), SQLite backend, data on tank/platform/forgejo. Each stack ships a committed .env.example (real .env is git-ignored) and the stacks README documents bring-up order, secrets, and verification. Also add root CLAUDE.md so fresh sessions orient from files cheaply: philosophy, doc pointers, naming quick-ref, repo map, commands, agreements. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
33 lines
1.2 KiB
YAML
33 lines
1.2 KiB
YAML
# Forgejo: Git hosting + built-in container registry. Git over HTTPS only (SSH
|
|
# disabled) so no extra inbound port is needed behind the Phase 1 firewall.
|
|
# Uses the built-in SQLite DB (simplest for a single instance); data on ZFS.
|
|
services:
|
|
forgejo:
|
|
image: codeberg.org/forgejo/forgejo:10
|
|
container_name: forgejo
|
|
restart: unless-stopped
|
|
environment:
|
|
USER_UID: "1000"
|
|
USER_GID: "1000"
|
|
FORGEJO__server__DOMAIN: ${FORGEJO_DOMAIN}
|
|
FORGEJO__server__ROOT_URL: "https://${FORGEJO_DOMAIN}/"
|
|
FORGEJO__server__DISABLE_SSH: "true"
|
|
FORGEJO__service__DISABLE_REGISTRATION: "true"
|
|
FORGEJO__packages__ENABLED: "true"
|
|
volumes:
|
|
- /tank/platform/forgejo:/data
|
|
- /etc/timezone:/etc/timezone:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
networks:
|
|
- proxy
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.forgejo.rule=Host(`${FORGEJO_DOMAIN}`)"
|
|
- "traefik.http.routers.forgejo.entrypoints=websecure"
|
|
- "traefik.http.routers.forgejo.tls.certresolver=le"
|
|
- "traefik.http.routers.forgejo.middlewares=security-headers@file"
|
|
- "traefik.http.services.forgejo.loadbalancer.server.port=3000"
|
|
|
|
networks:
|
|
proxy:
|
|
external: true
|