project-charlie/docs/layout.md

Layout

Canonical /mnt/nas/ shape after the reorg.

/mnt/nas/
├── stacks/        ← per-stack git working trees. Small, all-in-git.
│   ├── caddy/
│   ├── ldap/
│   ├── ...
├── data/          ← per-stack runtime state. Bind-mounted into containers.
│   ├── caddy/
│   ├── ldap/
│   ├── mediacompose/
│   │   ├── jellyfin/
│   │   ├── sonarr/
│   │   └── ...
│   ├── ...
├── media/         ← bulk media (renamed from media-server/)
│   ├── downloads/
│   ├── movies/
│   └── tv/
├── ca/            ← host CA material; out of scope for the reorg
├── ldap-certs/    ← LDAP server certs (renamed from ldap/); out of scope
└── home/          ← legacy; deleted at end of reorg

Naming

• All directories under stacks/ and data/ are kebab-case, lowercase.
• Repo names under Charlie/ match the stacks/ directory name 1:1.

Old	New
home/Gssh/	stacks/gssh/
home/MediaServerCompose/	stacks/mediacompose/
home/DirectoryAdmin/	stacks/directoryadmin/
home/open-ldap/	stacks/ldap/
home/VictoriaMetrics/deployment/docker/	stacks/victoriametrics/
home/mealie/mealie/docker/	stacks/mealie/
home/authentik/authentik/	stacks/authentik/
home/searxng-docker/	stacks/searxng/
home/paperless-ngx/	stacks/paperless-ngx/
home/ServerManagementUtils/	stacks/server-mgmt-utils/
home/portainer-agent/	stacks/portainer-agent/

Bind-mount convention

Every compose file binds only /mnt/nas/data/<stack>/... for runtime state. No bind into ./ (which is the git working tree).

# stacks/ldap/docker-compose.yml
services:
  openldap:
    volumes:
      - /mnt/nas/data/ldap/db:/var/lib/ldap
      - /mnt/nas/data/ldap/config:/etc/ldap/slapd.d

Small read-only configs that should be version-controlled (Caddyfile, openldap bootstrap LDIFs, etc.) live inside the stacks/<stack>/ working tree and are bind-mounted as files:

volumes:
  - ./Caddyfile:/etc/caddy/Caddyfile:ro

Out-of-scope dirs (leave alone for now)

• /mnt/nas/ca/ — host CA material. Considered separately later (Charlie/ca-tooling).
• /mnt/nas/ldap-certs/ — LDAP server certs (after rename from ldap/). Same.
• /mnt/nas/#recycle — Synology recycle bin.

Stacks-only-as-config (no container)

Some stacks/<name>/ may not deploy a container — they're just version-controlled config that belongs to the homelab:

• stacks/shell/ — shared profile.d, inputrc. Cloned by hosts to /usr/local/share/charlie-shell/, sourced by /etc/profile.
• stacks/first-time-setup/ — bootstrap docs / scripts (currently home/first-time-setup.md).

These have no docker-compose.yml and no entry in the runner deploy list.