From 020fd42208369faa21bff37a2f89fa8a3a4e648a Mon Sep 17 00:00:00 2001 From: whitney Date: Thu, 22 Oct 2026 12:36:24 -0700 Subject: [PATCH] Update planka restart settings --- media/plex/docker-compose.yml | 1 + .../design/penpot/.env.example | 7 +++ software-development/design/penpot/README.md | 23 +++++++-- .../infrastructure/jenkins/docker-compose.yml | 5 +- .../infrastructure/traefik/README.md | 50 +++++++++++++++++++ .../planka/docker-compose.yml | 4 +- 6 files changed, 81 insertions(+), 9 deletions(-) diff --git a/media/plex/docker-compose.yml b/media/plex/docker-compose.yml index 2db8328..a469b07 100644 --- a/media/plex/docker-compose.yml +++ b/media/plex/docker-compose.yml @@ -17,6 +17,7 @@ services: - /pwspool/archive/plex/:/config - /pwspool/archive/plex/tvseries:/tv - /pwspool/archive/plex/movies:/movies + - /pwspool/archive/plex/music:/music - /pwspool/archive/plex/photos:/photos - /pwspool/archive/plex/homevideos:/homevideos - /pwspool/archive/plex/transcode:/transcode diff --git a/software-development/design/penpot/.env.example b/software-development/design/penpot/.env.example index 2b19bd7..1a7083a 100644 --- a/software-development/design/penpot/.env.example +++ b/software-development/design/penpot/.env.example @@ -24,3 +24,10 @@ PENPOT_FLAGS=enable-registration enable-login-with-password disable-email-verifi # Or PENPOT_FLAGS=enable-login-with-password PENPOT_REGISTRATION_ENABLED=false + +# Stub out optional MCP/nitrate upstreams so nginx in the frontend image can +# resolve them at startup. We don't run these services; hitting /mcp/* or +# /control-center will 404, but the main app boots. +PENPOT_MCP_URI=http://penpot-backend:6060 +PENPOT_MCP_URI_WS=http://penpot-backend:6060 +PENPOT_NITRATE_URI=http://penpot-backend:6060 diff --git a/software-development/design/penpot/README.md b/software-development/design/penpot/README.md index e92115b..287c59d 100644 --- a/software-development/design/penpot/README.md +++ b/software-development/design/penpot/README.md @@ -1,18 +1,33 @@ # Penpot Open source Figma. -## First Time User Creation -Temporarily enable registration via manual methods: +## Setup + +1. Temporarily enable registation via flags in `.env`: + ```env PENPOT_FLAGS=enable-registration enable-login-with-password disable-email-verification enable-prepl-server ``` + and comment out `PENPOT_REGISTRATION_ENABLED=false` -Create new user either through UI or through command line: + +2. Create new user either through UI or through command line: + ```bash docker exec -it penpot-penpot-backend-1 python3 manage.py create-profile ``` -Reinstate old flags: + +3. Then reinstate old flags: + ```env PENPOT_FLAGS=enable-login-with-password ``` + and reinstate `PENPOT_REGISTRATION_ENABLED`. + +## Runbook + +```bash +docker compose down && docker system prune -af && docker compose up -d && docker logs -f penpot-penpot-backend-1 +``` + diff --git a/software-development/infrastructure/jenkins/docker-compose.yml b/software-development/infrastructure/jenkins/docker-compose.yml index 86e2577..5675e47 100644 --- a/software-development/infrastructure/jenkins/docker-compose.yml +++ b/software-development/infrastructure/jenkins/docker-compose.yml @@ -1,5 +1,3 @@ -volumesersion: '3.7' - networks: traefik: external: true @@ -16,7 +14,8 @@ services: volumes: - /pwspool/software/jenkins:/var/jenkins_home - /var/run/docker.sock:/var/run/docker.sock - - /usr/local/bin/docker:/usr/local/bin/docker + - /usr/bin/docker:/usr/local/bin/docker:ro + - /usr/libexec/docker/cli-plugins/docker-compose:/usr/local/lib/docker/cli-plugins/docker-compose:ro labels: - traefik.http.routers.jenkins.rule=Host(`jenkins.whitney.rip`) - traefik.http.routers.jenkins.tls=true diff --git a/software-development/infrastructure/traefik/README.md b/software-development/infrastructure/traefik/README.md index 8e809bb..2ebc619 100644 --- a/software-development/infrastructure/traefik/README.md +++ b/software-development/infrastructure/traefik/README.md @@ -16,6 +16,56 @@ Before the first run, create `acme.json` with the initial contents `{}`. Make su In addition to the above files, make sure the docker socket is mounted: - `/var/run/docker.sock:/var/run/docker.sock:ro` +## Adding a Website + +Each website is a container on the `traefik` network exposed via Traefik labels. Copy the block below into the service's `docker-compose.yml` and replace `myapp`, the host(s), and the port. + +**Important:** the cert resolver is named `lets-encrypt` (with a hyphen) in `traefik.toml`. The label value must match it **exactly**. A mismatch like `letsencrypt` makes Traefik fall back to a self-signed `TRAEFIK DEFAULT CERT`, which browsers flag as "Not Secure". + +```yaml +services: + myapp: + image: myimage:latest + restart: unless-stopped + networks: + - traefik + labels: + - "traefik.enable=true" + - "traefik.http.routers.myapp.rule=Host(`myapp.whitney.rip`)" + - "traefik.http.routers.myapp.entrypoints=websecure" + - "traefik.http.routers.myapp.tls.certresolver=lets-encrypt" + - "traefik.http.services.myapp.loadbalancer.server.port=3000" + +networks: + traefik: + external: true +``` + +HTTP-to-HTTPS redirection is handled globally by the `web` entrypoint, so you only need the `websecure` entrypoint here. + +### Covering `www` (or multiple hostnames) + +Traefik only serves a real cert for hostnames named in the router rule — anything else gets the self-signed default cert. To cover the apex **and** `www` on a single certificate, match both hosts and declare the SAN: + +```yaml + - "traefik.http.routers.myapp.rule=Host(`myapp.com`) || Host(`www.myapp.com`)" + - "traefik.http.routers.myapp.entrypoints=websecure" + - "traefik.http.routers.myapp.tls.certresolver=lets-encrypt" + - "traefik.http.routers.myapp.tls.domains[0].main=myapp.com" + - "traefik.http.routers.myapp.tls.domains[0].sans=www.myapp.com" +``` + +To force a single canonical URL, redirect `www` to the apex (note the `$$` — Compose needs it to pass a literal `$` to Traefik): + +```yaml + - "traefik.http.routers.myapp.middlewares=myapp-www" + - "traefik.http.middlewares.myapp-www.redirectregex.regex=^https://www\\.(.*)" + - "traefik.http.middlewares.myapp-www.redirectregex.replacement=https://$${1}" + - "traefik.http.middlewares.myapp-www.redirectregex.permanent=true" +``` + +**DNS / Cloudflare:** every hostname in the rule must have a DNS record pointing at this server and must **not** be proxied through Cloudflare (orange cloud) — the TLS challenge has to reach Traefik directly, or issuance fails and the account can get rate-limited/paused. To keep the Cloudflare proxy on, switch that domain to the DNS-01 challenge instead. + ## Notes ### Adjustments diff --git a/software-development/project-management/planka/docker-compose.yml b/software-development/project-management/planka/docker-compose.yml index 1f7b8ae..3b3b9f0 100644 --- a/software-development/project-management/planka/docker-compose.yml +++ b/software-development/project-management/planka/docker-compose.yml @@ -8,7 +8,7 @@ services: planka: image: ghcr.io/plankanban/planka:2.0.0-rc.2 container_name: planka - restart: on-failure + restart: unless-stopped networks: - planka - traefik @@ -31,7 +31,7 @@ services: postgres: image: postgres:16-alpine container_name: planka-db - restart: on-failure + restart: unless-stopped networks: - planka volumes: