7.1 KiB
7.1 KiB
Stack inventory
Canonical list of Charlie/<stack> repos. Working trees live at /mnt/nas/stacks/<name>/.
Image source — upstream = published image used directly; gitea-registry = built off-host, pushed to gitea.alexandru.macocian.me/amacocian/<name>:<tag>.
Morgott (owner host)
| Charlie repo | Stack path | Image source | Notes |
|---|---|---|---|
caddy |
caddy/ |
local build | edge reverse proxy + caddy-security |
authentik |
authentik/ |
upstream | IdP; postgres + redis + server + worker |
ldap |
ldap/ |
upstream | openldap + ldap-ui |
ddclient |
ddclient/ |
upstream | dynamic DNS |
vaultwarden |
vaultwarden/ |
upstream | password vault |
bookstack |
bookstack/ |
upstream | wiki (+ mariadb) |
monica |
monica/ |
gitea-registry monica:4.x |
CRM (custom 4.x fork; + mariadb) |
miniflux |
miniflux/ |
upstream | RSS (+ postgres) |
mealie |
mealie/ |
upstream | recipes (sqlite) |
homarr |
homarr/ |
upstream | dashboard |
paperless-ngx |
paperless-ngx/ |
upstream | docs (+ redis) |
victoriametrics |
victoriametrics/ |
upstream | vm + vmauth + vmalert + alertmanager + grafana |
gssh |
gssh/ |
gitea-registry gssh:latest |
web SSH terminal |
portainer |
portainer/ |
upstream | container UI; CSRF trusted-origins set via CLI |
cert-issuer |
cert-issuer/ |
upstream smallstep/step-ca:0.30.2 |
SSH user-cert CA. Design: cert-issuer.md. |
cert-syncer |
cert-syncer/ |
upstream smallstep/step-cli:0.30.2-trixie |
Active bridge from cert-issuer to /mnt/nas/ca/. Renews managed server certs. Design: cert-issuer.md. |
trivy-server |
trivy-server/ |
upstream aquasec/trivy:0.70.0 (+ mcuadros/ofelia:0.3.22, mikefarah/yq:4.53.2) |
Central trivy vuln-DB cache on morgott.lan:4954 (LAN-only, no auth). Daily 03:00 sweep of compose-declared image refs across /mnt/nas/stacks/*/. Pairs with trivy-runner. |
Melina (owner host)
| Charlie repo | Stack path | Image source | Notes |
|---|---|---|---|
gitea |
gitea/ |
upstream | the git server itself (deployed manually, never via runner-on-self) |
mediacompose |
mediacompose/ |
upstream | jellyfin + arr + qbt-via-gluetun |
searxng |
searxng/ |
upstream | metasearch (+ valkey) |
invidious |
invidious/ |
gitea-registry invidious:oidc-support |
YouTube frontend (+ companion + db + gluetun) |
nitter |
nitter/ |
upstream zedeus/nitter:<commit> (no versioning) |
Twitter/X frontend (+ redis). Requires operator-seeded sessions.jsonl on host. |
planka |
planka/ |
upstream | kanban (+ postgres) |
audiobookshelf |
audiobookshelf/ |
upstream | audiobooks |
directoryadmin |
directoryadmin/ |
gitea-registry directoryadmin:latest |
LDAP admin UI |
Sidecar image (consumed by other stacks)
| Charlie repo | Image | Used by | Notes |
|---|---|---|---|
cert-watch |
gitea-registry cert-watch:latest |
ldap |
Tiny alpine sidecar. Polls cert files, restarts sibling containers on change via docker.sock. Add to any stack consuming a cert-syncer-managed cert. |
Shared — multi-host
| Charlie repo | Hosts | Layout | Auto-deploy | Notes |
|---|---|---|---|---|
runners |
morgott, melina | per-host secrets/<host>.env.sops.yaml, host-local /var/lib/charlie/runner/ |
morgott, melina (cross-deploy; see runners.md) | Gitea Actions runners. Image: amacocian/gitea-runner. |
portainer-agent |
morgott, melina, mohg, miquella | docker-compose.yml + docker-compose.miquella.yml |
morgott, melina | DSM gets a per-host compose (no /var/lib/docker/volumes bind). mohg + miquella deploy by hand until SSSD-onboarded. |
otelcollector |
morgott, melina, mohg, malenia | docker-compose.yml (shared); secrets/env.sops.yaml for the vmauth ingest header |
morgott, melina | mohg deploys by hand until reonboarding; malenia (launchd + install-mac.sh) still ships the credential in otelcol.mac.yaml until reonboarded — see roadmap. |
trivy-runner |
morgott, melina | docker-compose.yml + overrides/<host>.yml (per-host trivy-server URL + cron schedule) |
morgott, melina (sequential, mirrors otelcollector) | Daily docker ps sweep; staggered 03:00 morgott / 03:15 melina. Writes to /var/lib/charlie/trivy/metrics/ consumed by otelcollector's node-exporter. |
Mirrors (Gitea pull-mirror, no host action)
Naming: Charlie/<name>-mirror.
| Mirror | Upstream | Status |
|---|---|---|
gssh source |
https://github.com/AlexMacocian/Gssh |
pushed to amacocian/Gssh (manual) |
monica source |
https://github.com/AlexMacocian/monica (4.x) |
mirror under amacocian/monica |
directoryadmin source |
https://github.com/AlexMacocian/DirectoryAdmin |
mirror under amacocian/DirectoryAdmin |
invidious source |
https://github.com/AlexMacocian/invidious (oidc-support) |
mirror under amacocian/invidious |
gitea-runner source |
none (laptop only) | image built locally, pushed to gitea.alexandru.macocian.me/amacocian/gitea-runner:<tag>. Source: amacocian/gitea-runner. |
Optional later (upstreams we don't customise but want offline): caddy, authentik, paperless-ngx, mealie, victoriametrics, searxng-docker, nitter, gitea, act_runner.