Conventions

One stack = one repo under Charlie/. Repo contains compose.yaml, .env.example, .gitea/workflows/deploy.yaml.
Secrets never in Git. Use .env (host-local, gitignored) or Gitea Actions secrets.
Persistent state stays under /mnt/nas/<stack>/ on miquella. Repos define bind paths, never ship data.
Deploys are pull-based: runner on the target host runs docker compose pull && up -d.
Workflows pin host: runs-on: [self-hosted, morgott] or [self-hosted, melina]. Never bare self-hosted.
Image tags pinned in compose. No :latest.
A runner never redeploys itself mid-job — cross-host: morgott deploys melina's runner, and vice versa.
Secrets sourcing: SOPS-encrypted in each Charlie/<stack> repo, decrypted on the owner host at deploy time. Design + open decisions in secrets.md.