Create: infrastructure/ana-colo-conventions.md

infrastructure/ana-colo-conventions.md

@@ -0,0 +1,87 @@
+---
+created: '2026-04-16T00:45:37+00:00'
+id: b49df7ba-a15d-4dba-817f-32dea4426ae2
+keywords:
+- compose layout
+- file conventions
+- traefik routing
+- reverse proxy
+- DNS wildcard
+- planned changes
+- standardization
+links: []
+modified: '2026-04-16T00:45:37+00:00'
+summary: 'Established conventions and planned changes for the ana-colo infrastructure:
+  Docker file layout, network conventions, and a roadmap for standardization.'
+tags:
+- infrastructure
+- ana-colo
+- conventions
+- standards
+- docker
+- network
+title: Ana Colo — Conventions and Standards
+---
+
+# Ana Colo — Conventions and Standards
+
+> **Last surveyed:** 2026-04-15
+
+## Docker Conventions
+
+### File Layout
+
+| Path | Purpose |
+|---|---|
+| `/opt/docker/compose/<stack>/compose.yaml` | Compose files (one per stack) |
+| `/opt/docker/conf/<service>/` | Configuration files |
+| `/opt/docker/data/<service>/` | Persistent data |
+| `/opt/docker/compose/<stack>/.env` | Environment variables (one per stack) |
+
+### Networking
+
+- **Shared proxy network:** `traefik-net` — all Traefik-routed services attach to this
+- **Stack networks:** Each stack gets its own network for internal service communication (e.g., `matrix-net`, `seafile-net`, `mattermost-net`)
+- **Reverse proxy:** Traefik with Docker label-based routing
+- **Traefik dashboard:** :8380 (direct port, currently unprotected)
+
+### Volumes
+
+- Docker named volumes for persistent data (local disk)
+- NFS mounts for shared storage: `/mnt/compose`, `/mnt/backup`, `/mnt/tnvms`
+
+## Network Conventions
+
+| Convention | Detail |
+|---|---|
+| Primary public IP for Docker services | 38.120.12.44 |
+| HTTP/HTTPS routing | Through Traefik via hostname (SNI) |
+| Non-HTTP services | Explicit VIP/port-forward on FortiGate |
+| DNS wildcard | `*.phasefinal.com` → 38.120.12.44 |
+| Internal DNS | 1.1.1.1, 1.0.0.1 (Cloudflare) |
+| Cross-zone traffic | Fully open (ALLOW ALL) |
+| WAN inbound | Explicit policies only |
+
+## Planned Changes
+
+### Immediate
+
+- [ ] Externalize all secrets from compose files and configs to `.env` files (600 permissions)
+- [ ] Add `.env.example` files for every stack
+- [ ] Add `.gitignore` for all secret-containing files
+
+### Standardization
+
+- [ ] Add health checks to all compose files
+- [ ] Add resource limits (`deploy.resources.limits`) to all compose files
+- [ ] Add logging driver options (`max-size`, `max-file`) to all compose files
+- [ ] Standardize restart policies to `unless-stopped`
+- [ ] Add `README.md` for every stack
+
+### Infrastructure
+
+- [ ] Migrate `/opt/docker` to NFS-backed mount: `10.250.50.50:/mnt/docker/ana-docker` → `/opt/docker`
+- [ ] Evaluate Portainer removal (Dockge is the replacement)
+- [ ] Deploy monitoring stack (Prometheus + Grafana + Loki)
+- [ ] Define and deploy backup schedules for all critical data
+- [ ] Enable host firewall (UFW or nftables)