refactor: split monolith into per-domain stacks (Phase A: build)

Add stacks/<domain>/ compose + env for the 11 target stacks (proxy, media, foundry, owncloud, resume, famapp, authentik, notify, monitoring, remote, dev). Each app stack joins a shared external `edge` network for Caddy and keeps its DB/cache co-located (no shared backing services). All named volumes convert to tiered bind mounts: DBs/configs -> /config (SSD), blobs/repos/registry -> /storage1/labdata (ZFS). Gitea repos+LFS split to ZFS. Move Vault into the management plane (portainer-compose.yml) and add the shared `edge` network there. apply-compose.ps1 -Portainer now also pushes vault.hcl. Additive only: root docker-compose.yml/.env/Caddyfile untouched, so the live monolith is unchanged. Live cutover (Phase B) is next.
2026-06-04 16:11:31 -05:00
parent e174807481
commit 57cd6ed270
23 changed files with 1296 additions and 8 deletions
@@ -0,0 +1,7 @@
+# owncloud stack secrets
+OWNCLOUD_DOMAIN=files.ginnoir.com
+OWNCLOUD_DB_USER=ginnoir
+OWNCLOUD_DB_PASSWORD=d0fet0th3x
+OWNCLOUD_ADMIN_USER=ginnoir
+OWNCLOUD_ADMIN_PASSWORD=d0fet0th3x
+MYSQL_ROOT_PASSWORD=d0fet0th3x
@@ -0,0 +1,81 @@
+# owncloud stack — ownCloud server + its dedicated MariaDB and Redis.
+# DB/cache stay co-located with the app so depends_on health-gating keeps working.
+# All data is bind-mounted already (/config/owncloud, /config/mysql, /config/redis).
+# Only the owncloud server joins `edge`; mariadb/redis stay private.
+
+services:
+  owncloud:
+    image: owncloud/server:latest
+    container_name: owncloud_server
+    restart: unless-stopped
+    networks: [owncloud, edge]
+    ports:
+      - "8080:8080"
+    depends_on:
+      mariadb:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    environment:
+      - OWNCLOUD_DOMAIN=${OWNCLOUD_DOMAIN}
+      - OWNCLOUD_DB_TYPE=mysql
+      - OWNCLOUD_DB_NAME=owncloud
+      - OWNCLOUD_DB_USERNAME=${OWNCLOUD_DB_USER}
+      - OWNCLOUD_DB_PASSWORD=${OWNCLOUD_DB_PASSWORD}
+      - OWNCLOUD_DB_HOST=mariadb
+      - OWNCLOUD_ADMIN_USERNAME=${OWNCLOUD_ADMIN_USER}
+      - OWNCLOUD_ADMIN_PASSWORD=${OWNCLOUD_ADMIN_PASSWORD}
+      - OWNCLOUD_MYSQL_UTF8MB4=true
+      - OWNCLOUD_REDIS_ENABLED=true
+      - OWNCLOUD_REDIS_HOST=redis
+    healthcheck:
+      test: ["CMD", "/usr/bin/healthcheck"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+    volumes:
+      - /config/owncloud:/mnt/data
+      - /storage1/Books:/mnt/books
+      - /mnt/dropbox:/mnt/data/files/dropbox
+      - /storage1/ROMs:/mnt/roms
+
+  mariadb:
+    image: mariadb:latest
+    container_name: owncloud_mariadb
+    restart: unless-stopped
+    networks: [owncloud]
+    environment:
+      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
+      - MYSQL_USER=${OWNCLOUD_DB_USER}
+      - MYSQL_PASSWORD=${OWNCLOUD_DB_PASSWORD}
+      - MYSQL_DATABASE=owncloud
+    command: ["--max-allowed-packet=128M", "--innodb-log-file-size=64M"]
+    healthcheck:
+      test: ["CMD", "mariadb-admin", "ping", "-u", "root", "--password=${MYSQL_ROOT_PASSWORD}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    volumes:
+      - /config/mysql:/var/lib/mysql
+
+  redis:
+    image: redis:latest
+    container_name: owncloud_redis
+    restart: unless-stopped
+    networks: [owncloud]
+    command: ["--databases", "1"]
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    volumes:
+      - /config/redis:/data
+
+networks:
+  owncloud:
+    name: owncloud
+    driver: bridge
+  edge:
+    name: edge
+    external: true