# Layout

Canonical `/mnt/nas/` shape after the reorg.

```
/mnt/nas/
├── stacks/        ← per-stack git working trees. Small, all-in-git.
│   ├── caddy/
│   ├── ldap/
│   ├── ...
├── data/          ← per-stack runtime state. Bind-mounted into containers.
│   ├── caddy/
│   ├── ldap/
│   ├── mediacompose/
│   │   ├── jellyfin/
│   │   ├── sonarr/
│   │   └── ...
│   ├── ...
├── media/         ← bulk media (renamed from media-server/)
│   ├── downloads/
│   ├── movies/
│   └── tv/
├── ca/            ← host CA material; out of scope for the reorg
├── ldap-certs/    ← LDAP server certs (renamed from ldap/); out of scope
└── home/          ← legacy; deleted at end of reorg
```

## Naming

- All directories under `stacks/` and `data/` are **kebab-case, lowercase**.
- Repo names under `Charlie/` match the `stacks/` directory name 1:1.

| Old | New |
|-----|-----|
| `home/Gssh/` | `stacks/gssh/` |
| `home/MediaServerCompose/` | `stacks/mediacompose/` |
| `home/DirectoryAdmin/` | `stacks/directoryadmin/` |
| `home/open-ldap/` | `stacks/ldap/` |
| `home/VictoriaMetrics/deployment/docker/` | `stacks/victoriametrics/` |
| `home/mealie/mealie/docker/` | `stacks/mealie/` |
| `home/authentik/authentik/` | `stacks/authentik/` |
| `home/searxng-docker/` | `stacks/searxng/` |
| `home/paperless-ngx/` | `stacks/paperless-ngx/` |
| `home/ServerManagementUtils/` | `stacks/server-mgmt-utils/` |
| `home/portainer-agent/` | `stacks/portainer-agent/` |

## Bind-mount convention

Every compose file binds **only** `/mnt/nas/data/<stack>/...` for runtime state. No bind into `./` (which is the git working tree).

```yaml
# stacks/ldap/docker-compose.yml
services:
  openldap:
    volumes:
      - /mnt/nas/data/ldap/db:/var/lib/ldap
      - /mnt/nas/data/ldap/config:/etc/ldap/slapd.d
```

Small read-only configs that *should* be version-controlled (Caddyfile, openldap bootstrap LDIFs, etc.) live inside the `stacks/<stack>/` working tree and are bind-mounted as files:

```yaml
volumes:
  - ./Caddyfile:/etc/caddy/Caddyfile:ro
```

## Out-of-scope dirs (leave alone for now)

- `/mnt/nas/ca/` — host CA material. Considered separately later (`Charlie/ca-tooling`).
- `/mnt/nas/ldap-certs/` — LDAP server certs (after rename from `ldap/`). Same.
- `/mnt/nas/#recycle` — Synology recycle bin.

## Stacks-only-as-config (no container)

Some `stacks/<name>/` may not deploy a container — they're just version-controlled config that belongs to the homelab:

- `stacks/shell/` — shared `profile.d`, `inputrc`. Cloned by hosts to `/usr/local/share/charlie-shell/`, sourced by `/etc/profile`.
- `stacks/first-time-setup/` — bootstrap docs / scripts (currently `home/first-time-setup.md`).

These have no `docker-compose.yml` and no entry in the runner deploy list.