windyboy
7ec29627fb
新增独立 HTTPS forward proxy：Traefik 新 entrypoint proxyin(:6443) 终止 TLS， 后端 sing-box（HTTP inbound + users 认证 + direct 出站），与既有 :443 nghttpx/squid 链路并存。宿主机只新增 6443/tcp；容器不发布 host 端口。 新增 compose/sing-box/（镜像 digest 钉版）与两份 runbook： - proxy-health.md：:443/:6443 只读健康检查，含开放代理负向测试 - proxy-client-setup.md：curl / env / 浏览器扩展配置与三类失败排查 （407 无认证头、页面加载不全=CDN 域名漏配、urllib/wget 不支持 TLS-to-proxy） 同批根盘回收 91%→43%（约 14G）：rust/node/.go/podman 孤儿存储/apt/journal/ 未用镜像/容器日志；journald 加 SystemMaxUse=200M；nghttpx+squid+traefik 加 json-file 轮转 10m×3；删除 ~/.cargo 后修好 zshenv/bashrc/profile 的失效 source。 验证：:6443 LE 证书、匿名 407、CONNECT 与绝对 URI 均返回 185.201.226.122； us4-gate 401 / update 200 / trlm 302；8 容器全部 Up；validate-repo.sh PASS。
compose/ — repo-owned Compose declarations
Non-secret Compose sources for the Docker hosts. Secrets are never in these
files: every secret is a ${VAR} reference resolved from the server-local
.env (docker compose reads .env from the project directory automatically).
Source-of-truth matrix
| Project | Host | Compose source | Mechanism |
|---|---|---|---|
vaultwarden |
us2 (/opt/vaultwarden) |
compose/vaultwarden/compose.yml |
static file + compose-deploy.yml |
pdns |
hk2 (/opt/pdns) |
compose/pdns/compose.yml |
static file + compose-deploy.yml |
pgdb |
pgdb (/opt/database, 无 ansible) |
compose/pgdb/compose.yml |
static file（手动部署：scp → docker compose config -q → up -d；服务器文件名 docker-compose.yml） |
soft-serve |
us2 (/opt/soft-serve, 已退役停用) |
compose/soft-serve/compose.yml (+ Dockerfile.backup, scripts/) |
static file（参考镜像; 2026-09-18 被 gitea 替换 VPS-94, 数据保留作回滚） |
gitea |
us2 (/opt/gitea) |
compose/gitea/compose.yml (+ Dockerfile.backup, scripts/) |
static file（参考镜像, 未接入 compose-deploy; 服务器文件为准; 2026-09-18 替换 soft-serve, VPS-94） |
adguardhome |
dns.windy.lan (/opt/adguardhome) |
— (待从 LAN 提取) | static file (pending) |
unifi |
ubnt (/home/windy/unifi-9) |
— (待从 LAN 提取) | static file (pending) |
wireguard |
us4 (/opt/wireguard) |
ansible/templates/wireguard-compose.yml.j2 |
role-rendered (inventory vars) |
rustdesk |
hk2 (/opt/rustdesk) |
ansible/roles/rustdesk/templates/compose.yml.j2 |
role-rendered (inventory vars) |
sing-box |
us4 (/opt/sing-box) |
compose/sing-box/compose.yml (+ config.example.json) |
static file（参考镜像, 未接入 compose-deploy; 服务器文件为准; 凭据仅存服务器 config.json 0600, VPS-99） |
mailcow |
mx2 (/opt/mail) |
— (mailcow update generator owns it) | excluded by design |
Mechanism rule: static compose/<project>/compose.yml for declarations that
do not vary per host; role-rendered j2 for declarations driven by inventory
vars (image pins, relay host). One mechanism per project; do not duplicate a
project in both.
Deploying a static project
cd ansible
# Read-only diff + validation against the server .env (no writes)
ansible-playbook playbooks/compose-deploy.yml --limit vaultwarden --check --diff
# Apply: stage repo file → validate `docker compose config -q` → backup current
# file → promote → `docker compose up -d` (gated)
ansible-playbook playbooks/compose-deploy.yml --limit vaultwarden \
-e '{"compose_deploy_confirm": true}'
See ../runbooks/ansible-operations.md.
Adding a project
- Sanitize the live compose so every secret is
${VAR}from.env(prefer${VAR:?missing VAR}for required keys). - Commit
compose/<project>/compose.yml+.env.example(key names only). - Add
compose_repo_project(+compose_remote_fileif notcompose.yml) to the host inansible/inventory/hosts.yml, and allowlist the project inansible/roles/compose_deploy/defaults/main.yml. - Verify with
--check --diff(zero diff) then a gated apply.