Files

T

Frank e3eb5334cb feat: initialize serverAppConfigs with podman stacks for Dankserver and Dankclaw

- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter
- Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI
  (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy
  reverse proxy, Grafana+Prometheus+Loki+Alloy observability
- Caddyfiles with .local hostname convention and basicauth homepage
- bind-mount storage policy, no named volumes
- deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health)
- docs/ Obsidian vault: per-service docs from frank-default-small research
  subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu)
- bats test suite at 6 seams — 22 tests green

2026-08-13 20:19:41 -07:00

1.3 KiB

Raw Blame History

Storage Policy

All persistent data uses bind mounts: a host directory mapped directly into the container. No named volumes. This matches the preference of this repo and the existing Gitea stack on Dankclaw.

Why Bind Mounts

The exact host location of every byte is visible and controllable.
Backups are a simple tar of known host directories.
The data survives container recreation and podman-compose down.
Ownership is explicit: everything runs as UID 1000 (dank) so host tools can read it.

Conventions

Stack	Host root
Dankserver	`/opt/<service>/...`
Dankclaw	`/opt/<service>/...` (Gitea keeps `/opt/gitea/data/...`)

Ownership

Containers run as PUID=1000 / PGID=1000. Host directories must be owned by dank:

sudo chown -R 1000:1000 /opt/<service>

Secrets

Secrets never live in bind-mounted configs that get committed. They are:

Set in .env files on the host (git-ignored, .env.example committed as template), or
Injected as environment variables from the deploy script.

The live Gitea database password exists only in .env on Dankclaw. A test enforces that it never appears in this repo.

1.3 KiB Raw Blame History