41a01c60ef
Add base Docker Compose projects under platform-infra/stacks, using the Phase 1 ZFS platform datasets and shared networks: - bootstrap-networks.sh: idempotent creation of shared `proxy` (edge) and `platform` (internal) Docker networks. - traefik: edge router with TLS/ACME (HTTP-01), global HTTP->HTTPS redirect, file-based security-headers/TLS middlewares, and a basic-auth dashboard. Docker access via a least-privilege tecnativa/docker-socket-proxy instead of mounting docker.sock directly. - mariadb: shared instance on tank/platform/mariadb, utf8mb4, tuned; not published to the host (internal `platform` network only). - forgejo: Git + container registry over HTTPS (SSH disabled to avoid extra inbound ports), SQLite backend, data on tank/platform/forgejo. Each stack ships a committed .env.example (real .env is git-ignored) and the stacks README documents bring-up order, secrets, and verification. Also add root CLAUDE.md so fresh sessions orient from files cheaply: philosophy, doc pointers, naming quick-ref, repo map, commands, agreements. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| ansible | ||
| stacks | ||
| README.md | ||
platform-infra
Host baseline and platform services as code.
ansible/ — Phase 1 host baseline ✅
Idempotent Ubuntu 24.04 host config. See ansible/README.md for how to run it.
Roles: base (packages, timezone, unattended-upgrades) → zfs (pool on a
dedicated disk + platform datasets) → docker (Engine + Compose, data-root on
ZFS, zfs storage driver) → firewall (nftables inbound + container SMTP egress
block) → ssh_hardening (key-first SSH, sftponly group).
Planned (later phases)
- Phase 2 base compose projects: Traefik, shared MariaDB, Forgejo + registry, Prometheus/Grafana/Loki, Uptime-Kuma.
- Phase 5 Ansible: automysqlbackup, ZFS snapshot/
sendjobs.