5d95f8bfcc
Wire up the three foundation stacks (nginx-proxy, sql, portainer) in cloud/compose.yml and add real configs for the first two. nginx-proxy - Base nginx.conf with http + stream contexts, modern TLS profile, client_max_body_size baseline for gitea LFS / mlflow artifacts. - Vhosts under conf.d/: grafana, gitea, keycloak, nodered, mlflow, jupyter, portainer (HTTPS upstream), rabbitmq, jenkins. WebSocket upgrade headers where needed (grafana live, node-red editor, jupyterhub kernels, jenkins agents). - conf.d/00-default.conf serves /.well-known/acme-challenge/ on :80 and 301-redirects everything else. - stream.d/mqtt.conf terminates MQTT-TLS at 8883, proxies to rabbitmq:1883 internally. - All vhosts reference /etc/letsencrypt/live/infra/* — a stable path via certbot --cert-name infra, so the wildcard migration changes nothing in the vhost files. - README documents: HTTP-01 SAN interim during Versio period → DNS-01 wildcard via certbot-dns-transip after migration; bootstrap procedure (self-signed fallback → real cert issuance → reload). sql - config/init.d/01-databases.sh provisions gitea/keycloak/mlflow databases + roles on first start. Idempotent only via fresh data volume — change the script after first run requires manual psql or a volume wipe. - compose env extended with GITEA_DB_PASSWORD, KEYCLOAK_DB_PASSWORD, MLFLOW_DB_PASSWORD. cloud - include: now wires nginx-proxy + sql + portainer. Other stacks stay commented for future rounds. - .env.example adds KEYCLOAK_DB_PASSWORD and sensible defaults (LETSENCRYPT_EMAIL, GRAFANA_ROOT_URL, KEYCLOAK_HOSTNAME, GITEA_ROOT_URL, POSTFIX_FROM_DOMAIN all pointing at wbd-rd.nl). - Operator note inline: bring portainer's standalone instance down before deploying via cloud compose; comment its ports: block. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
53 lines
1.6 KiB
YAML
53 lines
1.6 KiB
YAML
# Cloud / Central layer composition.
|
|
# Includes all cloud-relevant stacks and defines the 4-network topology.
|
|
# Run: cp .env.example .env && docker compose up -d
|
|
|
|
name: cloud
|
|
|
|
# Uncomment includes as each stack is hardened beyond stub.
|
|
include:
|
|
# Foundation (round 3) — ingress, auth backing store, ops console
|
|
- ../stacks/nginx-proxy/compose.yml
|
|
- ../stacks/sql/compose.yml
|
|
- ../stacks/portainer/compose.yml
|
|
# Core identity + VPN
|
|
# - ../stacks/wireguard-server/compose.yml
|
|
# - ../stacks/keycloak/compose.yml
|
|
# Data
|
|
# - ../stacks/influxdb/compose.yml
|
|
# Apps
|
|
# - ../stacks/node-red/compose.yml
|
|
# - ../stacks/grafana/compose.yml
|
|
# - ../stacks/gitea/compose.yml
|
|
# - ../stacks/jenkins/compose.yml
|
|
# Messaging + mail
|
|
# - ../stacks/rabbitmq/compose.yml
|
|
# - ../stacks/postfix/compose.yml
|
|
# ML / notebooks
|
|
# - ../stacks/mlflow/compose.yml
|
|
# - ../stacks/jupyterhub/compose.yml
|
|
# FROST (when deployed)
|
|
# - ../stacks/mosquitto/compose.yml
|
|
|
|
# NOTE on portainer transition:
|
|
# The portainer stack publishes 9443+8000 for standalone first-run use.
|
|
# When bringing it up through this cloud compose, take the standalone
|
|
# instance down first (`cd stacks/portainer && docker compose down`) and
|
|
# comment out the `ports:` block in stacks/portainer/compose.yml so
|
|
# nginx-proxy is the only ingress. Access then via https://portainer.wbd-rd.nl/.
|
|
|
|
networks:
|
|
edge:
|
|
name: cloud-edge
|
|
driver: bridge
|
|
app:
|
|
name: cloud-app
|
|
driver: bridge
|
|
data:
|
|
name: cloud-data
|
|
driver: bridge
|
|
internal: true # databases — no internet egress
|
|
mgmt:
|
|
name: cloud-mgmt
|
|
driver: bridge
|