memos: deploy to ana-docker

Stock neosmemo/memos:stable, port 5230, SQLite at
/opt/docker/conf/memos/data/. Joins traefik-net and ships homepage
labels (group=Notes) so it auto-appears on the dashboard via docker
discovery — no edit to configs/homepage/services.yaml needed.

First-run bootstrap is via the UI: visit http://10.250.50.70:5230
and create the Host account through the sign-up form.

Playbook idiom note: docker compose pull lines need the literal
block scalar (|) when the grep pattern contains colons — bare-string
shell value made YAML parse the colon as a mapping separator and
elway choked on first try.

stacks/memos/.env.example

@@ -0,0 +1,22 @@
+# memos stack tunables. Copy to `.env` on ana-docker before deploying.
+
+# Image tag — `stable` tracks upstream's stable channel. Pin a specific
+# version (e.g. `0.24.0`) before any production cutover so a stable
+# bump doesn't surprise you on the next pull.
+MEMOS_TAG=stable
+
+# ── network ──────────────────────────────────────────────────────────
+# Host port (container listens on 5230 internally).
+# Reservations on ana-docker (sample): 5001 Dockge, 7878 task-board,
+# 8080 Miniflux, 8181 news-digest. 5230 is memos' canonical port and
+# was free at deploy time.
+MEMOS_PORT=5230
+MEMOS_BIND=0.0.0.0
+
+# ── runtime ──────────────────────────────────────────────────────────
+MEMOS_TZ=America/Los_Angeles
+
+# ── persistent storage on the host ───────────────────────────────────
+# SQLite DB + uploaded resource files. Backed up via the host's restic
+# profile (memos_prod.db is small; resources/ can grow with attachments).
+MEMOS_DATA_DIR=/opt/docker/conf/memos/data

stacks/memos/README.md

@@ -0,0 +1,38 @@
+# memos
+
+[memos](https://github.com/usememos/memos) — lightweight self-hosted
+note / memo server. Single Go binary, SQLite by default, MIT license.
+
+| | |
+|---|---|
+| host | `ana-docker` |
+| port | `5230` |
+| image | `neosmemo/memos:stable` |
+| data | `/opt/docker/conf/memos/data/` (SQLite + uploaded resources) |
+| homepage group | `Notes` |
+
+## Deploy
+
+```bash
+scripts/elway ana-docker --playbook playbooks/deploy-memos.yaml
+```
+
+First run: visit <http://10.250.50.70:5230>, create the Host account
+through the sign-up form. Subsequent users register through the same
+form (or you disable open sign-up via Settings → Workspace).
+
+## Tunables
+
+See `.env.example` — copy to `.env` on the host (lives at
+`/opt/docker/compose/memos/.env`, gitignored). Knobs are intentionally
+minimal: image tag, host port, TZ, data dir. Memos itself reads its
+config from the SQLite DB (workspace settings via the UI).
+
+## Backups
+
+Data dir is `/opt/docker/conf/memos/data/`. The host's restic profile
+covers `/opt/docker/conf/` so the SQLite DB + uploaded resources go
+along for free. SQLite snapshot is consistent under restic's COW reads
+since memos uses WAL mode + fsync; for a guaranteed-quiescent backup
+take a `docker exec memos sqlite3 /var/opt/memos/memos_prod.db ".backup /var/opt/memos/snapshot.db"`
+in the restic pre-backup hook.

stacks/memos/compose.yaml

@@ -0,0 +1,45 @@
+# memos — lightweight self-hosted note / memo server.
+# Upstream: https://github.com/usememos/memos  (MIT, Go binary).
+#
+# Single container, SQLite by default (file lives in the bind-mounted
+# data dir below). Auth bootstraps via the UI on first run — first
+# user created becomes Host. No env vars required for a basic install.
+#
+# All tunables live in .env — edit that, not this file.
+
+services:
+  memos:
+    image: neosmemo/memos:${MEMOS_TAG:-stable}
+    container_name: memos
+    restart: unless-stopped
+    ports:
+      - "${MEMOS_BIND:-0.0.0.0}:${MEMOS_PORT}:5230"
+    volumes:
+      # SQLite DB + uploaded resource files. Bind mount on the host
+      # rather than a named volume so backups + manual inspection are
+      # straightforward.
+      - ${MEMOS_DATA_DIR}:/var/opt/memos
+    environment:
+      - TZ=${MEMOS_TZ:-America/Los_Angeles}
+    healthcheck:
+      # Image is alpine-based and ships busybox wget. --spider keeps it
+      # cheap (HEAD request) and 127.0.0.1 dodges the IPv6-first
+      # localhost trap that bit news-digest + chatterbox earlier.
+      test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1:5230/ || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+    networks:
+      - tnet
+    labels:
+      - homepage.group=Notes
+      - homepage.name=Memos
+      - homepage.icon=mdi-note-text-outline
+      - homepage.description=Self-hosted note + memo server (ana-docker)
+      - homepage.href=http://10.250.50.70:${MEMOS_PORT}
+
+networks:
+  tnet:
+    name: traefik-net
+    external: true