87 lines
2.8 KiB
Markdown
87 lines
2.8 KiB
Markdown
---
|
|
created: '2026-04-16T00:45:37+00:00'
|
|
id: b49df7ba-a15d-4dba-817f-32dea4426ae2
|
|
keywords:
|
|
- compose layout
|
|
- file conventions
|
|
- traefik routing
|
|
- reverse proxy
|
|
- DNS wildcard
|
|
- planned changes
|
|
- standardization
|
|
links: []
|
|
modified: '2026-04-16T00:45:37+00:00'
|
|
summary: 'Established conventions and planned changes for the ana-colo infrastructure:
|
|
Docker file layout, network conventions, and a roadmap for standardization.'
|
|
tags:
|
|
- infrastructure
|
|
- ana-colo
|
|
- conventions
|
|
- standards
|
|
- docker
|
|
- network
|
|
title: Ana Colo — Conventions and Standards
|
|
---
|
|
|
|
# Ana Colo — Conventions and Standards
|
|
|
|
> **Last surveyed:** 2026-04-15
|
|
|
|
## Docker Conventions
|
|
|
|
### File Layout
|
|
|
|
| Path | Purpose |
|
|
|---|---|
|
|
| `/opt/docker/compose/<stack>/compose.yaml` | Compose files (one per stack) |
|
|
| `/opt/docker/conf/<service>/` | Configuration files |
|
|
| `/opt/docker/data/<service>/` | Persistent data |
|
|
| `/opt/docker/compose/<stack>/.env` | Environment variables (one per stack) |
|
|
|
|
### Networking
|
|
|
|
- **Shared proxy network:** `traefik-net` — all Traefik-routed services attach to this
|
|
- **Stack networks:** Each stack gets its own network for internal service communication (e.g., `matrix-net`, `seafile-net`, `mattermost-net`)
|
|
- **Reverse proxy:** Traefik with Docker label-based routing
|
|
- **Traefik dashboard:** :8380 (direct port, currently unprotected)
|
|
|
|
### Volumes
|
|
|
|
- Docker named volumes for persistent data (local disk)
|
|
- NFS mounts for shared storage: `/mnt/compose`, `/mnt/backup`, `/mnt/tnvms`
|
|
|
|
## Network Conventions
|
|
|
|
| Convention | Detail |
|
|
|---|---|
|
|
| Primary public IP for Docker services | 38.120.12.44 |
|
|
| HTTP/HTTPS routing | Through Traefik via hostname (SNI) |
|
|
| Non-HTTP services | Explicit VIP/port-forward on FortiGate |
|
|
| DNS wildcard | `*.phasefinal.com` → 38.120.12.44 |
|
|
| Internal DNS | 1.1.1.1, 1.0.0.1 (Cloudflare) |
|
|
| Cross-zone traffic | Fully open (ALLOW ALL) |
|
|
| WAN inbound | Explicit policies only |
|
|
|
|
## Planned Changes
|
|
|
|
### Immediate
|
|
|
|
- [ ] Externalize all secrets from compose files and configs to `.env` files (600 permissions)
|
|
- [ ] Add `.env.example` files for every stack
|
|
- [ ] Add `.gitignore` for all secret-containing files
|
|
|
|
### Standardization
|
|
|
|
- [ ] Add health checks to all compose files
|
|
- [ ] Add resource limits (`deploy.resources.limits`) to all compose files
|
|
- [ ] Add logging driver options (`max-size`, `max-file`) to all compose files
|
|
- [ ] Standardize restart policies to `unless-stopped`
|
|
- [ ] Add `README.md` for every stack
|
|
|
|
### Infrastructure
|
|
|
|
- [ ] Migrate `/opt/docker` to NFS-backed mount: `10.250.50.50:/mnt/docker/ana-docker` → `/opt/docker`
|
|
- [ ] Evaluate Portainer removal (Dockge is the replacement)
|
|
- [ ] Deploy monitoring stack (Prometheus + Grafana + Loki)
|
|
- [ ] Define and deploy backup schedules for all critical data
|
|
- [ ] Enable host firewall (UFW or nftables) |