VuongKB/infrastructure/ana-colo-conventions.md

created, id, keywords, links, modified, summary, tags, title

created	id	keywords	links	modified	summary	tags	title
2026-04-16T00:45:37+00:00	b49df7ba-a15d-4dba-817f-32dea4426ae2	compose layout file conventions traefik routing reverse proxy DNS wildcard planned changes standardization		2026-04-16T00:45:37+00:00	Established conventions and planned changes for the ana-colo infrastructure: Docker file layout, network conventions, and a roadmap for standardization.	infrastructure ana-colo conventions standards docker network	Ana Colo — Conventions and Standards

Ana Colo — Conventions and Standards

Last surveyed: 2026-04-15

Docker Conventions

File Layout

Path	Purpose
/opt/docker/compose/<stack>/compose.yaml	Compose files (one per stack)
/opt/docker/conf/<service>/	Configuration files
/opt/docker/data/<service>/	Persistent data
/opt/docker/compose/<stack>/.env	Environment variables (one per stack)

Networking

• Shared proxy network: traefik-net — all Traefik-routed services attach to this
• Stack networks: Each stack gets its own network for internal service communication (e.g., matrix-net, seafile-net, mattermost-net)
• Reverse proxy: Traefik with Docker label-based routing
• Traefik dashboard: :8380 (direct port, currently unprotected)

Volumes

• Docker named volumes for persistent data (local disk)
• NFS mounts for shared storage: /mnt/compose, /mnt/backup, /mnt/tnvms

Network Conventions

Convention	Detail
Primary public IP for Docker services	38.120.12.44
HTTP/HTTPS routing	Through Traefik via hostname (SNI)
Non-HTTP services	Explicit VIP/port-forward on FortiGate
DNS wildcard	*.phasefinal.com → 38.120.12.44
Internal DNS	1.1.1.1, 1.0.0.1 (Cloudflare)
Cross-zone traffic	Fully open (ALLOW ALL)
WAN inbound	Explicit policies only

Planned Changes

Immediate

• Externalize all secrets from compose files and configs to .env files (600 permissions)
• Add .env.example files for every stack
• Add .gitignore for all secret-containing files

Standardization

• Add health checks to all compose files
• Add resource limits (deploy.resources.limits) to all compose files
• Add logging driver options (max-size, max-file) to all compose files
• Standardize restart policies to unless-stopped
• Add README.md for every stack

Infrastructure

• Migrate /opt/docker to NFS-backed mount: 10.250.50.50:/mnt/docker/ana-docker → /opt/docker
• Evaluate Portainer removal (Dockge is the replacement)
• Deploy monitoring stack (Prometheus + Grafana + Loki)
• Define and deploy backup schedules for all critical data
• Enable host firewall (UFW or nftables)