Conventions

One stack = one repo under Charlie/. Repo contains docker-compose.yml, .env.example, .gitea/workflows/deploy.yaml. No deploy.sh — the workflow calls the shared deploy-stack.yml reusable workflow that lives here in project-charlie. See automation.md.
Secrets never in Git in plaintext. SOPS-encrypted under secrets/ in the stack repo, decrypted on the target host at deploy time by the reusable workflow (which SSHes into the host as sys-gitea-runner and runs sops --decrypt there using /etc/charlie/age.key). Design + open decisions in secrets.md.
Persistent state stays under /mnt/nas/data/<stack>/ on miquella. Repos define bind paths, never ship data.
Deploys are SSH-driven: any runner picks up the job, then opens a short-lived step-ca-issued SSH session to the target host (as sys-gitea-runner, member of charlie-deploy) and runs all commands there. The runner itself is stateless. Manual fallback recipe: automation.md → Manual fallback.
Workflows pin the target host via the reusable workflow's host: input. Routing-by-runner-label is intentionally avoided (Gitea bug; see automation.md → Gitea quirks).
Image tags pinned in compose. No :latest.