41a01c60ef
Add base Docker Compose projects under platform-infra/stacks, using the Phase 1 ZFS platform datasets and shared networks: - bootstrap-networks.sh: idempotent creation of shared `proxy` (edge) and `platform` (internal) Docker networks. - traefik: edge router with TLS/ACME (HTTP-01), global HTTP->HTTPS redirect, file-based security-headers/TLS middlewares, and a basic-auth dashboard. Docker access via a least-privilege tecnativa/docker-socket-proxy instead of mounting docker.sock directly. - mariadb: shared instance on tank/platform/mariadb, utf8mb4, tuned; not published to the host (internal `platform` network only). - forgejo: Git + container registry over HTTPS (SSH disabled to avoid extra inbound ports), SQLite backend, data on tank/platform/forgejo. Each stack ships a committed .env.example (real .env is git-ignored) and the stacks README documents bring-up order, secrets, and verification. Also add root CLAUDE.md so fresh sessions orient from files cheaply: philosophy, doc pointers, naming quick-ref, repo map, commands, agreements. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
17 lines
651 B
INI
17 lines
651 B
INI
# heleos MariaDB tuning. Adjust innodb_buffer_pool_size to the host's RAM
|
|
# (rule of thumb: ~50-70% of RAM dedicated to the DB on a DB-heavy box; less
|
|
# here since the host also runs all the sites).
|
|
[mysqld]
|
|
character-set-server = utf8mb4
|
|
collation-server = utf8mb4_unicode_ci
|
|
|
|
innodb_buffer_pool_size = 512M
|
|
innodb_file_per_table = 1
|
|
innodb_flush_log_at_trx_commit = 1
|
|
|
|
max_connections = 200
|
|
skip-name-resolve = 1
|
|
|
|
# Bind to all interfaces *inside the container*; the container is only attached
|
|
# to the internal `platform` network, so this is not host-exposed.
|
|
bind-address = 0.0.0.0
|