windyboy
7ec29627fb
新增独立 HTTPS forward proxy：Traefik 新 entrypoint proxyin(:6443) 终止 TLS， 后端 sing-box（HTTP inbound + users 认证 + direct 出站），与既有 :443 nghttpx/squid 链路并存。宿主机只新增 6443/tcp；容器不发布 host 端口。 新增 compose/sing-box/（镜像 digest 钉版）与两份 runbook： - proxy-health.md：:443/:6443 只读健康检查，含开放代理负向测试 - proxy-client-setup.md：curl / env / 浏览器扩展配置与三类失败排查 （407 无认证头、页面加载不全=CDN 域名漏配、urllib/wget 不支持 TLS-to-proxy） 同批根盘回收 91%→43%（约 14G）：rust/node/.go/podman 孤儿存储/apt/journal/ 未用镜像/容器日志；journald 加 SystemMaxUse=200M；nghttpx+squid+traefik 加 json-file 轮转 10m×3；删除 ~/.cargo 后修好 zshenv/bashrc/profile 的失效 source。 验证：:6443 LE 证书、匿名 407、CONNECT 与绝对 URI 均返回 185.201.226.122； us4-gate 401 / update 200 / trlm 302；8 容器全部 Up；validate-repo.sh PASS。
53 lines
3.2 KiB
Markdown
53 lines
3.2 KiB
Markdown
# compose/ — repo-owned Compose declarations
|
||
|
||
Non-secret Compose sources for the Docker hosts. Secrets are **never** in these
|
||
files: every secret is a `${VAR}` reference resolved from the **server-local
|
||
`.env`** (docker compose reads `.env` from the project directory automatically).
|
||
|
||
## Source-of-truth matrix
|
||
|
||
| Project | Host | Compose source | Mechanism |
|
||
|---------|------|----------------|-----------|
|
||
| `vaultwarden` | us2 (`/opt/vaultwarden`) | `compose/vaultwarden/compose.yml` | static file + `compose-deploy.yml` |
|
||
| `pdns` | hk2 (`/opt/pdns`) | `compose/pdns/compose.yml` | static file + `compose-deploy.yml` |
|
||
| `pgdb` | pgdb (`/opt/database`, 无 ansible) | `compose/pgdb/compose.yml` | static file（手动部署：scp → `docker compose config -q` → `up -d`；服务器文件名 `docker-compose.yml`） |
|
||
| `soft-serve` | us2 (`/opt/soft-serve`, 已退役停用) | `compose/soft-serve/compose.yml` (+ `Dockerfile.backup`, `scripts/`) | static file（参考镜像; 2026-09-18 被 gitea 替换 VPS-94, 数据保留作回滚） |
|
||
| `gitea` | us2 (`/opt/gitea`) | `compose/gitea/compose.yml` (+ `Dockerfile.backup`, `scripts/`) | static file（参考镜像, 未接入 compose-deploy; 服务器文件为准; 2026-09-18 替换 soft-serve, VPS-94） |
|
||
| `adguardhome` | dns.windy.lan (`/opt/adguardhome`) | — (待从 LAN 提取) | static file (pending) |
|
||
| `unifi` | ubnt (`/home/windy/unifi-9`) | — (待从 LAN 提取) | static file (pending) |
|
||
| `wireguard` | us4 (`/opt/wireguard`) | `ansible/templates/wireguard-compose.yml.j2` | role-rendered (inventory vars) |
|
||
| `rustdesk` | hk2 (`/opt/rustdesk`) | `ansible/roles/rustdesk/templates/compose.yml.j2` | role-rendered (inventory vars) |
|
||
| `sing-box` | us4 (`/opt/sing-box`) | `compose/sing-box/compose.yml` (+ `config.example.json`) | static file（参考镜像, 未接入 compose-deploy; 服务器文件为准; 凭据仅存服务器 `config.json` 0600, VPS-99） |
|
||
| `mailcow` | mx2 (`/opt/mail`) | — (mailcow update generator owns it) | excluded by design |
|
||
|
||
Mechanism rule: **static** `compose/<project>/compose.yml` for declarations that
|
||
do not vary per host; **role-rendered j2** for declarations driven by inventory
|
||
vars (image pins, relay host). One mechanism per project; do not duplicate a
|
||
project in both.
|
||
|
||
## Deploying a static project
|
||
|
||
```bash
|
||
cd ansible
|
||
|
||
# Read-only diff + validation against the server .env (no writes)
|
||
ansible-playbook playbooks/compose-deploy.yml --limit vaultwarden --check --diff
|
||
|
||
# Apply: stage repo file → validate `docker compose config -q` → backup current
|
||
# file → promote → `docker compose up -d` (gated)
|
||
ansible-playbook playbooks/compose-deploy.yml --limit vaultwarden \
|
||
-e '{"compose_deploy_confirm": true}'
|
||
```
|
||
|
||
See [`../runbooks/ansible-operations.md`](../runbooks/ansible-operations.md).
|
||
|
||
## Adding a project
|
||
|
||
1. Sanitize the live compose so every secret is `${VAR}` from `.env`
|
||
(prefer `${VAR:?missing VAR}` for required keys).
|
||
2. Commit `compose/<project>/compose.yml` + `.env.example` (key names only).
|
||
3. Add `compose_repo_project` (+ `compose_remote_file` if not `compose.yml`) to
|
||
the host in `ansible/inventory/hosts.yml`, and allowlist the project in
|
||
`ansible/roles/compose_deploy/defaults/main.yml`.
|
||
4. Verify with `--check --diff` (zero diff) then a gated apply.
|