5d95f8bfcc
Wire up the three foundation stacks (nginx-proxy, sql, portainer) in cloud/compose.yml and add real configs for the first two. nginx-proxy - Base nginx.conf with http + stream contexts, modern TLS profile, client_max_body_size baseline for gitea LFS / mlflow artifacts. - Vhosts under conf.d/: grafana, gitea, keycloak, nodered, mlflow, jupyter, portainer (HTTPS upstream), rabbitmq, jenkins. WebSocket upgrade headers where needed (grafana live, node-red editor, jupyterhub kernels, jenkins agents). - conf.d/00-default.conf serves /.well-known/acme-challenge/ on :80 and 301-redirects everything else. - stream.d/mqtt.conf terminates MQTT-TLS at 8883, proxies to rabbitmq:1883 internally. - All vhosts reference /etc/letsencrypt/live/infra/* — a stable path via certbot --cert-name infra, so the wildcard migration changes nothing in the vhost files. - README documents: HTTP-01 SAN interim during Versio period → DNS-01 wildcard via certbot-dns-transip after migration; bootstrap procedure (self-signed fallback → real cert issuance → reload). sql - config/init.d/01-databases.sh provisions gitea/keycloak/mlflow databases + roles on first start. Idempotent only via fresh data volume — change the script after first run requires manual psql or a volume wipe. - compose env extended with GITEA_DB_PASSWORD, KEYCLOAK_DB_PASSWORD, MLFLOW_DB_PASSWORD. cloud - include: now wires nginx-proxy + sql + portainer. Other stacks stay commented for future rounds. - .env.example adds KEYCLOAK_DB_PASSWORD and sensible defaults (LETSENCRYPT_EMAIL, GRAFANA_ROOT_URL, KEYCLOAK_HOSTNAME, GITEA_ROOT_URL, POSTFIX_FROM_DOMAIN all pointing at wbd-rd.nl). - Operator note inline: bring portainer's standalone instance down before deploying via cloud compose; comment its ports: block. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
37 lines
1.4 KiB
Markdown
37 lines
1.4 KiB
Markdown
# sql
|
|
|
|
Central configuration database — the "single point of config" backing Keycloak, Gitea, MLflow, and any stack that needs a relational store. **Cloud-only.**
|
|
|
|
- **Engine**: postgres 16-alpine
|
|
- **Network**: `data` only (no internet egress)
|
|
- **Volume**: `sql-data` (PGDATA)
|
|
- **Init scripts**: `config/init.d/*.sh` runs once on first container start
|
|
|
|
## Per-app databases
|
|
|
|
On first start, `config/init.d/01-databases.sh` provisions:
|
|
|
|
| Database | Owner role | Used by |
|
|
|---|---|---|
|
|
| `gitea` | `gitea` | gitea stack |
|
|
| `keycloak` | `keycloak` | keycloak stack |
|
|
| `mlflow` | `mlflow` | mlflow stack |
|
|
|
|
Passwords come from env vars (`GITEA_DB_PASSWORD`, `KEYCLOAK_DB_PASSWORD`, `MLFLOW_DB_PASSWORD`) which must be set in the cloud `.env` *before* first start.
|
|
|
|
**Important**: init scripts only run when `sql-data` is empty. Changing the script after first start has no effect until the volume is wiped. To add a new app DB later, connect with `psql` and create it manually, then update this script for fresh deploys.
|
|
|
|
## Reset / re-init
|
|
|
|
```bash
|
|
docker compose down
|
|
docker volume rm cloud_sql-data # ⚠ destroys all data
|
|
docker compose up -d
|
|
```
|
|
|
|
## TODO
|
|
|
|
- Backup strategy (pg_dump cron sidecar vs streaming replica vs WAL archiving to MinIO)
|
|
- Per-app least-privilege grants (currently each role owns its DB only — fine for now)
|
|
- Monitoring (postgres_exporter for Prometheus when observability stack lands)
|