bart/platform
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
heleosv2 multi-tenant hosting platform (infra + CLI)
5 commits 1 branch 0 tags 136 KiB
Find a file
Bart Van Geyt edfb4c44b8 Phase 3: site templates & base images 
Add the building blocks the provisioning CLI renders per site.

Base images (site-templates/images):
- php-fpm: non-root (www-data) php:<ver>-fpm-alpine with pdo_mysql, mysqli,
  gd, intl, zip, opcache, exif; tuned php.ini + pool; built per PHP version.
- nginx: hardened nginx:1.27-alpine with shared security + fastcgi snippets;
  per-site server block mounted at runtime.
- build.sh: build + Trivy-scan (+ optional push) for both images.

Profile templates (site-templates/profiles), Jinja2 rendered:
- static, redirect (tiny nginx 301/302), custom-php (nginx + our php-fpm,
  optional DB), wordpress (nginx + official wordpress-fpm, DB required,
  upload-exec denied). Only nginx carries Traefik labels and joins proxy;
  php-fpm uses the private <slug>_net and joins platform only when a DB is
  needed. Secrets stay in a git-ignored .env, not the compose.

CI: .forgejo/workflows/images.yml builds/scans images (gitleaks + Trivy).
README documents the render context and the Phase 4 web-root ownership item.

Templates validated: all profiles render to valid compose YAML across the
database on/off branches and single/multi-domain host rules.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-07 17:06:25 +02:00
.forgejo/workflows Phase 3: site templates & base images 2026-07-07 17:06:25 +02:00
control-panel Phase 0: architecture docs, ADRs, and repo scaffold 2026-07-07 12:26:00 +02:00
deployments Refine to nested customer -> site model 2026-07-07 12:37:39 +02:00
docs Refine to nested customer -> site model 2026-07-07 12:37:39 +02:00
platform-infra Phase 2: platform service stacks + CLAUDE.md 2026-07-07 16:58:18 +02:00
site-templates Phase 3: site templates & base images 2026-07-07 17:06:25 +02:00
.gitattributes Phase 0: architecture docs, ADRs, and repo scaffold 2026-07-07 12:26:00 +02:00
.gitignore Phase 1: Ansible host baseline for Ubuntu VM 2026-07-07 12:45:42 +02:00
CLAUDE.md Phase 2: platform service stacks + CLAUDE.md 2026-07-07 16:58:18 +02:00
README.md Phase 0: architecture docs, ADRs, and repo scaffold 2026-07-07 12:26:00 +02:00

README.md

heleosv2 — Multi-Tenant Web Hosting Platform

A rebuild of a small web-hosting business on modern, isolation-first infrastructure: container-per-customer + ZFS-dataset-per-customer, with repeatable CLI-driven provisioning and clean per-customer backup/restore.

Core philosophy — the customer is the boundary. Isolation (containers), backup (ZFS), and restore all line up on the same boundary, so a compromised or broken site is contained and restorable without touching neighbours.

Status

Phase 0 — writing the design documents before any platform code. See docs/00-roadmap.md.

Repository layout

This monorepo groups four logical areas whose contents have different lifecycles (see docs/07-repo-layout-gitops.md):

Path Purpose
docs/ Architecture, ADRs, runbooks, conventions.
platform-infra/ Ansible + base compose for host, Traefik, MariaDB, Forgejo, monitoring.
site-templates/ Dockerfiles for standard images + compose templates per site profile.
deployments/ Rendered per-customer configs (GitOps state). No plaintext secrets.
control-panel/ Provisioning CLI now; customer-facing panel later.

Key decisions

  • Single bare-metal host, Docker Compose per customer, no orchestrator.
  • Shared MariaDB (per-site DB + least-privilege user).
  • Decoupled backups: web files via ZFS snapshot/send; DB via automysqlbackup + rsync; logs via Loki.
  • Lightweight DevOps: Forgejo + built-in registry + Trivy.
  • CLI-first provisioning; web panel deferred until the platform is proven.

The full approved architecture plan lives at docs/architecture-plan.md.