Frank
5829a0bfe8
All in-repo path references (AGENTS.md, README, old scripts, report artifacts,
test code paths) rewritten in the same commit; focused-test map extended for
.gitignore, old/scripts/*, dankclaw/comfyui/*, and report/* per this repo's
own convention ('add one before committing'). Obsidian wikilinks are
title-based and unaffected.
41 lines
1.3 KiB
Markdown
41 lines
1.3 KiB
Markdown
# Storage Policy
|
|
|
|
All persistent data uses **bind mounts**: a host directory mapped directly into the container. No named volumes. This matches the preference of this repo and the existing Gitea stack on Dankclaw.
|
|
|
|
## Why Bind Mounts
|
|
|
|
- The exact host location of every byte is visible and controllable.
|
|
- Backups are a simple `tar` of known host directories.
|
|
- The data survives container recreation and `podman-compose down`.
|
|
- Ownership is explicit: everything runs as UID 1000 (`dank`) so host tools can read it.
|
|
|
|
## Conventions
|
|
|
|
| Stack | Host root |
|
|
|-------|-----------|
|
|
| Dankserver | `/opt/<service>/...` |
|
|
| Dankclaw | `/opt/<service>/...` (Gitea keeps `/opt/gitea/data/...`) |
|
|
|
|
## Ownership
|
|
|
|
Containers run as `PUID=1000` / `PGID=1000`. Host directories must be owned by `dank`:
|
|
|
|
```bash
|
|
sudo chown -R 1000:1000 /opt/<service>
|
|
```
|
|
|
|
## Secrets
|
|
|
|
Secrets never live in bind-mounted configs that get committed. They are:
|
|
|
|
1. Set in `.env` files on the host (git-ignored, `.env.example` committed as template), or
|
|
2. Injected as environment variables from the deploy script.
|
|
|
|
The live Gitea database password exists only in `.env` on Dankclaw. A test enforces that it never appears in this repo.
|
|
|
|
## See Also
|
|
|
|
- [[Deployment Flow]]
|
|
- [[Gitea]] — the existing bind-mount stack being migrated
|
|
- [[Backblaze Integration]] — future backup target for these mounts
|