refactor: split monolith into per-domain stacks (Phase A: build)

Add stacks/<domain>/ compose + env for the 11 target stacks (proxy, media, foundry, owncloud, resume, famapp, authentik, notify, monitoring, remote, dev). Each app stack joins a shared external `edge` network for Caddy and keeps its DB/cache co-located (no shared backing services). All named volumes convert to tiered bind mounts: DBs/configs -> /config (SSD), blobs/repos/registry -> /storage1/labdata (ZFS). Gitea repos+LFS split to ZFS. Move Vault into the management plane (portainer-compose.yml) and add the shared `edge` network there. apply-compose.ps1 -Portainer now also pushes vault.hcl. Additive only: root docker-compose.yml/.env/Caddyfile untouched, so the live monolith is unchanged. Live cutover (Phase B) is next.
2026-06-04 16:11:31 -05:00
parent e174807481
commit 57cd6ed270
23 changed files with 1296 additions and 8 deletions
@@ -0,0 +1,5 @@
+# notify stack secrets
+TZ=America/Chicago
+FRESHRSS_API_PASSWORD=d0fet0th3x
+FRESHRSS_PASSWORD=d0fet0th3x
+FRESHRSS_EMAIL=3nigma.matt@gmail.com
@@ -0,0 +1,82 @@
+# notify stack — ntfy push, FreshRSS reader, and the Vigilant RSS watcher.
+#
+# Volume -> bind-mount conversion:
+#   vigilant cache -> /config/vigilant/cache  (SSD; regenerable)
+# ntfy + freshrss are proxied (ntfy.ginnoir.com, freshrss.ginnoir.com). Vigilant
+# only needs egress to post to ntfy's public URL; all three join edge.
+
+services:
+  ntfy:
+    image: binwiederhier/ntfy:latest
+    container_name: ntfy
+    command:
+      - serve
+    restart: unless-stopped
+    networks: [edge]
+    environment:
+      - TZ=${TZ}
+      - NTFY_DEFAULT_HOST=https://ntfy.ginnoir.com
+      - NTFY_BASE_URL=https://ntfy.ginnoir.com
+      - NTFY_CACHE_FILE=/var/lib/ntfy/cache.db
+      - NTFY_AUTH_FILE=/var/lib/ntfy/auth.db
+      - NTFY_AUTH_DEFAULT_ACCESS=read-write
+      - NTFY_BEHIND_PROXY=true
+      - NTFY_ATTACHMENT_CACHE_DIR=/var/lib/ntfy/attachments
+      - NTFY_ENABLE_LOGIN=true
+    user: 1000:1000
+    volumes:
+      - /config/ntfy/var/cache/ntfy:/var/cache/ntfy
+      - /config/ntfy/etc/ntfy:/etc/ntfy
+      - /config/ntfy/var/lib/ntfy:/var/lib/ntfy
+    ports:
+      - "8000:80"
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "wget -q --tries=1 http://localhost:80/v1/health -O - | grep -Eo '\"healthy\"\\s*:\\s*true' || exit 1",
+        ]
+      interval: 60s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+
+  freshrss:
+    image: freshrss/freshrss:latest
+    container_name: freshrss
+    hostname: freshrss
+    restart: unless-stopped
+    networks: [edge]
+    logging:
+      options:
+        max-size: 10m
+    volumes:
+      - /config/freshrss/data:/var/www/FreshRSS/data
+      - /config/freshrss/extensions:/var/www/FreshRSS/extensions
+    ports:
+      - "9999:80"
+    environment:
+      - CRON_MIN=3,33
+      - TRUSTED_PROXY=172.16.0.1/12 192.168.0.1/16
+      - FRESHRSS_INSTALL=--default-user ginnoir --api-enabled --base-url https://freshrss.ginnoir.com
+      - FRESHRSS_USER=--api-password ${FRESHRSS_API_PASSWORD} --email ${FRESHRSS_EMAIL} --password ${FRESHRSS_PASSWORD} --user ginnoir
+
+  vigilant:
+    container_name: vigilant
+    image: ghcr.io/verifiedjoseph/vigilant:latest
+    restart: unless-stopped
+    networks: [edge]
+    environment:
+      - VIGILANT_NOTIFICATION_SERVICE=ntfy
+      - VIGILANT_NOTIFICATION_NTFY_URL=https://ntfy.ginnoir.com/
+      - VIGILANT_NOTIFICATION_NTFY_TOPIC=RSS
+    volumes:
+      - /config/vigilant/feeds.yaml:/app/feeds.yaml
+      - /config/vigilant/cache:/app/cache
+    security_opt:
+      - no-new-privileges:true
+
+networks:
+  edge:
+    name: edge
+    external: true