Add stacks/<domain>/ compose + env for the 11 target stacks (proxy, media,
foundry, owncloud, resume, famapp, authentik, notify, monitoring, remote, dev).
Each app stack joins a shared external `edge` network for Caddy and keeps its
DB/cache co-located (no shared backing services). All named volumes convert to
tiered bind mounts: DBs/configs -> /config (SSD), blobs/repos/registry ->
/storage1/labdata (ZFS). Gitea repos+LFS split to ZFS.
Move Vault into the management plane (portainer-compose.yml) and add the shared
`edge` network there. apply-compose.ps1 -Portainer now also pushes vault.hcl.
Additive only: root docker-compose.yml/.env/Caddyfile untouched, so the live
monolith is unchanged. Live cutover (Phase B) is next.
- dev-compose.yml: 16-service dev stack on dedicated devstack network
- vault.hcl: Vault file-backend config; Vault initialized and unsealed
- docker-compose.yml: add devstack as external network on caddy
- Caddyfile: LAN-only site blocks for all 7 dev services; Plane routed
via Caddy path handles (no bundled proxy container)
- apply-compose.ps1: add -DevStack and -VaultUnseal flags
- .env: dev stack secrets + all 5 Vault unseal keys + root token
Dev URLs (LAN-only): gitea, code, registry, dbx, vault, docs, plane
Stack managed by Portainer as dev-stack (id 7)
- portainer-compose.yml now owns all three management-plane services:
portainer, github-runner, watchtower. All mount the docker socket;
none belong to the application stack.
- Watchtower carries over its existing env (DOCKER_API_VERSION, ntfy URL).
portainer, runner, and watchtower itself are labeled to opt out of
watchtower auto-updates.
- docker-compose.yml: remove github-runner (was causing self-kill during
dc up -d; exclusion workaround no longer needed)
- deploy.yml: simplified back to plain dc up -d with no service filtering
- Replace host systemd runner with myoung34/github-runner container
in the main compose stack
- Mounts docker.sock (GID 1001), /valhalla-lab, and /config/caddy
so the workflow can deploy compose and reload Caddy without SSH
- Update deploy.yml to write files via mounted paths and use a shared
COMPOSE env var for cleaner step commands
- Add GITHUB_RUNNER_ACCESS_TOKEN placeholder to .env (fine-grained PAT
with Administration:write needed for runner self-registration)
- portainer-compose.yml: moves portainer from standalone container to
compose-managed, giving the portainer_proxy network a compose owner.
This ensures the network is reliably created before the main stack
on fresh installs or after Docker state is wiped.
- .github/workflows/deploy.yml: self-hosted runner on valhalla runs
dc pull + up on push to main, and hot-reloads Caddyfile.
- apply-compose.ps1: adds -Portainer flag to manage portainer-compose.yml.
- Rename project from htpc-download-box to valhalla-lab (directory + dc alias)
- Remove portainer and watchtower from compose; run standalone outside managed stack
to prevent self-termination during Portainer-triggered redeployments
- Add portainer_proxy external network shared by caddy and standalone portainer
so Caddy can route to Portainer via Docker DNS without them being in the same stack
- Carve out POST /api/stacks/webhooks/* in Caddyfile so Portainer webhooks can
reach through the internal_only guard without exposing the full UI
- Update apply-compose.ps1 and sync-prod.ps1 paths from htpc-download-box to valhalla-lab
Define HOMARR_SECRET_ENCRYPTION_KEY in .env and reference it from docker-compose.yml instead of hardcoding it inline, keeping all secrets in .env. Resolved value is unchanged (no container recreate); deployed to valhalla and validated with 'dc config homarr'.
Add portainer, uptime-kuma, and homarr on a new 'management' network, with caddy joined to it and internal-only Caddy routes for portainer/uptime/homarr/router. Widen the internal_only allowlist to also accept 172.16.0.0/12 (Docker networks) and 127.0.0.1 so container-originated and local checks pass the LAN gate.
Watchtower's latest image defaults to API version 1.25; Docker 29 raised
its minimum supported client API to 1.40, causing watchtower to crash on
every start. Setting DOCKER_API_VERSION=1.40 via env var overrides the
default without requiring a newer watchtower image.
Every service now has an explicit container_name, eliminating the
htpc-download-box_ prefix/suffix that compose derived from the directory.
Disambiguated duplicates follow type_context naming:
postgres_resume / postgres_famapp / postgres_authentik
minio_resume / minio_famapp
redis_authentik
Also updates CLAUDE.md and the homelab-ssh skill to reflect:
- compose v2 (docker compose, space) replacing the old v1.27.4 standalone
- dc alias updated to docker compose
- htpc-download-box directory is now clean (legacy cruft removed)
Server-side migration steps (docker-compose-plugin apt install, alias
update, Docker Engine upgrade, old binary removal) are documented in
the session but not yet applied — run apply-compose.ps1 -Compose after
completing them.
RESUME_AUTH_SECRET and FAMAPP_AUTH_SECRET now replace the bare AUTH_SECRET (previously defined 3x in .env, last-wins). Each is pinned to the value its container is already running, so re-applying recreated nothing. This fixes resume's app reading \\\, which was undefined and resolved to an empty string -- the next container recreate would have wiped all resume sessions. Caddyfile: removed matrix.ginnoir.com and the ginnoir.com apex .well-known/matrix block (no Synapse backend on :8008). Applied to valhalla: dc config resolves with no warnings, Caddy reloaded, dc up -d left every service up-to-date.
Mirror the three production files (docker-compose.yml, .env, Caddyfile) that live on valhalla, plus the push/pull PowerShell scripts, CLAUDE.md, .gitignore/.gitattributes, and .claude/skills for ssh/apply/sync.
ginnoir