# Storage Policy

All persistent data uses **bind mounts**: a host directory mapped directly into the container. No named volumes. This matches the preference of this repo and the existing Gitea stack on Dankclaw.

## Why Bind Mounts

- The exact host location of every byte is visible and controllable.
- Backups are a simple `tar` of known host directories.
- The data survives container recreation and `podman-compose down`.
- Ownership is explicit: everything runs as UID 1000 (`dank`) so host tools can read it.

## Conventions

| Stack | Host root |
|-------|-----------|
| Dankserver | `/opt/<service>/...` |
| Dankclaw | `/opt/<service>/...` (Gitea keeps `/opt/gitea/data/...`) |

## Ownership

Containers run as `PUID=1000` / `PGID=1000`. Host directories must be owned by `dank`:

```bash
sudo chown -R 1000:1000 /opt/<service>
```

## Secrets

Secrets never live in bind-mounted configs that get committed. They are:

1. Set in `.env` files on the host (git-ignored, `.env.example` committed as template), or
2. Injected as environment variables from the deploy script.

The live Gitea database password exists only in `.env` on Dankclaw. A test enforces that it never appears in this repo.

## See Also

- [[Deployment Flow]]
- [[Gitea]] — the existing bind-mount stack being migrated
- [[Backblaze Integration]] — future backup target for these mounts