---
created: '2026-04-16T00:45:37+00:00'
id: b49df7ba-a15d-4dba-817f-32dea4426ae2
keywords:
- compose layout
- file conventions
- traefik routing
- reverse proxy
- DNS wildcard
- planned changes
- standardization
links: []
modified: '2026-04-16T00:45:37+00:00'
summary: 'Established conventions and planned changes for the ana-colo infrastructure:
  Docker file layout, network conventions, and a roadmap for standardization.'
tags:
- infrastructure
- ana-colo
- conventions
- standards
- docker
- network
title: Ana Colo — Conventions and Standards
---

# Ana Colo — Conventions and Standards

> **Last surveyed:** 2026-04-15

## Docker Conventions

### File Layout

| Path | Purpose |
|---|---|
| `/opt/docker/compose/<stack>/compose.yaml` | Compose files (one per stack) |
| `/opt/docker/conf/<service>/` | Configuration files |
| `/opt/docker/data/<service>/` | Persistent data |
| `/opt/docker/compose/<stack>/.env` | Environment variables (one per stack) |

### Networking

- **Shared proxy network:** `traefik-net` — all Traefik-routed services attach to this
- **Stack networks:** Each stack gets its own network for internal service communication (e.g., `matrix-net`, `seafile-net`, `mattermost-net`)
- **Reverse proxy:** Traefik with Docker label-based routing
- **Traefik dashboard:** :8380 (direct port, currently unprotected)

### Volumes

- Docker named volumes for persistent data (local disk)
- NFS mounts for shared storage: `/mnt/compose`, `/mnt/backup`, `/mnt/tnvms`

## Network Conventions

| Convention | Detail |
|---|---|
| Primary public IP for Docker services | 38.120.12.44 |
| HTTP/HTTPS routing | Through Traefik via hostname (SNI) |
| Non-HTTP services | Explicit VIP/port-forward on FortiGate |
| DNS wildcard | `*.phasefinal.com` → 38.120.12.44 |
| Internal DNS | 1.1.1.1, 1.0.0.1 (Cloudflare) |
| Cross-zone traffic | Fully open (ALLOW ALL) |
| WAN inbound | Explicit policies only |

## Planned Changes

### Immediate

- [ ] Externalize all secrets from compose files and configs to `.env` files (600 permissions)
- [ ] Add `.env.example` files for every stack
- [ ] Add `.gitignore` for all secret-containing files

### Standardization

- [ ] Add health checks to all compose files
- [ ] Add resource limits (`deploy.resources.limits`) to all compose files
- [ ] Add logging driver options (`max-size`, `max-file`) to all compose files
- [ ] Standardize restart policies to `unless-stopped`
- [ ] Add `README.md` for every stack

### Infrastructure

- [ ] Migrate `/opt/docker` to NFS-backed mount: `10.250.50.50:/mnt/docker/ana-docker` → `/opt/docker`
- [ ] Evaluate Portainer removal (Dockge is the replacement)
- [ ] Deploy monitoring stack (Prometheus + Grafana + Loki)
- [ ] Define and deploy backup schedules for all critical data
- [ ] Enable host firewall (UFW or nftables)