infra: full IaC state after hf-pdocker-01 rebuild (2026-03-08)

Replaces initial Nomad/Consul/Terraform skeleton with current Docker-based infrastructure across all three nodes (hf-pdocker-01, hf-pdocker-02, bart). Key changes: - CLAUDE.md: updated service distribution reflecting hf-pdocker-01 restored - docs/plans/2026-03-08-hf-pdocker-01-rebuild.md: new rebuild plan doc - compose/bart/: ai-agents, guacamole, matrix, media, openvas, smarthome, watchtower - compose/hf-pdocker-02/: traefik, monitoring, adguard, gitea, semaphore, wikijs, unifi, vaultwarden, actual-budget, mcpo, netclaw, trivy, watchtower, n8n - compose/hf-pdocker-01/: frigate, frigate-notify, farm-agent - stacks/: all Swarm stack definitions (monitoring, traefik, smarthome, matrix, guacamole, media, ai-agents, frigate, gitea, semaphore, wikijs, unifi, etc.) - .gitignore: exclude .env credential files and acme.json certs - .env.example: placeholder credential files for all services - .claude/agents/: gitea-backup and other infrastructure agent configs - scripts/: frigate media cleanup and NAS sync scripts Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-08 18:51:25 -05:00
parent b1d111a011
commit de1d9e1d93
102 changed files with 12634 additions and 3 deletions
@@ -0,0 +1,96 @@
+services:
+  margaret:
+    image: margaret-openclaw:latest
+    container_name: margaret
+    restart: unless-stopped
+    network_mode: host
+    user: "0:0"
+    environment:
+      - NODE_ENV=production
+      - HOME=/home/glyptic
+      - USER=glyptic
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
+      - OPENCLAW_STATE_DIR=/home/glyptic/.openclaw
+      - OPENCLAW_CONFIG_PATH=/home/glyptic/.openclaw/openclaw.json
+    volumes:
+      - /mnt/infrastructure/margaret:/home/glyptic/.openclaw
+    command: ["sh", "-c", "mkdir -p /home/glyptic && node --max-old-space-size=1500 /usr/local/lib/node_modules/openclaw/dist/index.js gateway --allow-unconfigured"]
+    mem_limit: 2G
+    memswap_limit: 2G
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  spirit:
+    image: margaret-openclaw:latest
+    container_name: spirit
+    restart: unless-stopped
+    network_mode: host
+    user: "0:0"
+    environment:
+      - NODE_ENV=production
+      - HOME=/home/glyptic
+      - USER=glyptic
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
+      - OPENCLAW_STATE_DIR=/home/glyptic/.spirit
+      - OPENCLAW_CONFIG_PATH=/home/glyptic/.spirit/openclaw.json
+    volumes:
+      - /mnt/infrastructure/spirit:/home/glyptic/.spirit
+    command: ["sh", "-c", "mkdir -p /home/glyptic && node --max-old-space-size=1500 /usr/local/lib/node_modules/openclaw/dist/index.js gateway --allow-unconfigured"]
+    mem_limit: 2G
+    memswap_limit: 2G
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  bob:
+    image: margaret-openclaw:latest
+    container_name: bob
+    restart: unless-stopped
+    network_mode: host
+    user: "0:0"
+    environment:
+      - NODE_ENV=production
+      - HOME=/home/glyptic
+      - USER=glyptic
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
+      - OPENCLAW_STATE_DIR=/home/glyptic/.bob
+      - OPENCLAW_CONFIG_PATH=/home/glyptic/.bob/openclaw.json
+    volumes:
+      - /mnt/infrastructure/bob:/home/glyptic/.bob
+    command: ["sh", "-c", "mkdir -p /home/glyptic && node --max-old-space-size=1500 /usr/local/lib/node_modules/openclaw/dist/index.js gateway --allow-unconfigured"]
+    mem_limit: 2G
+    memswap_limit: 2G
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  clippy:
+    image: margaret-openclaw:latest
+    container_name: clippy
+    restart: unless-stopped
+    network_mode: host
+    user: "0:0"
+    environment:
+      - NODE_ENV=production
+      - HOME=/home/glyptic
+      - USER=glyptic
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
+      - OPENCLAW_STATE_DIR=/home/glyptic/.clippy
+      - OPENCLAW_CONFIG_PATH=/home/glyptic/.clippy/openclaw.json
+    volumes:
+      - /mnt/infrastructure/clippy:/home/glyptic/.clippy
+    command: ["sh", "-c", "mkdir -p /home/glyptic && node --max-old-space-size=1500 /usr/local/lib/node_modules/openclaw/dist/index.js gateway --allow-unconfigured"]
+    mem_limit: 2G
+    memswap_limit: 2G
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
@@ -0,0 +1,80 @@
+services:
+  guacamole:
+    image: guacamole/guacamole:latest
+    container_name: guacamole
+    restart: unless-stopped
+    environment:
+      - GUACD_HOSTNAME=guacd
+      - MYSQL_HOSTNAME=guacamole-db
+      - MYSQL_DATABASE=guacamole_db
+      - MYSQL_USER=guacamole_user
+      - MYSQL_PASSWORD=guacamole_pass
+    ports:
+      - "8199:8080"
+    networks:
+      - guacamole-internal
+    depends_on:
+      guacamole-db:
+        condition: service_healthy
+    mem_limit: 512M
+    memswap_limit: 512M
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:8080/guacamole/ || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  guacd:
+    image: guacamole/guacd:latest
+    container_name: guacd
+    restart: unless-stopped
+    networks:
+      - guacamole-internal
+    mem_limit: 512M
+    memswap_limit: 512M
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  guacamole-db:
+    image: mysql:8.0
+    container_name: guacamole-db
+    user: "1024:100"
+    restart: unless-stopped
+    command: --innodb-use-native-aio=0 --innodb-buffer-pool-size=128M
+    environment:
+      - MYSQL_ROOT_PASSWORD=guacamole_root
+      - MYSQL_DATABASE=guacamole_db
+      - MYSQL_USER=guacamole_user
+      - MYSQL_PASSWORD=guacamole_pass
+    volumes:
+      - /var/lib/guacamole-db:/var/lib/mysql
+    networks:
+      - guacamole-internal
+    mem_limit: 512M
+    memswap_limit: 512M
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    healthcheck:
+      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --silent"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+networks:
+  guacamole-internal:
+    driver: bridge
@@ -0,0 +1,86 @@
+services:
+  synapse:
+    image: matrixdotorg/synapse:latest
+    container_name: synapse
+    restart: unless-stopped
+    environment:
+      - SYNAPSE_SERVER_NAME=mess.hobbs.farm
+      - SYNAPSE_REPORT_STATS=no
+    volumes:
+      - /mnt/docker-data/configs/matrix/data:/data
+    ports:
+      - "8008:8008"
+    networks:
+      - matrix-internal
+    depends_on:
+      synapse-db:
+        condition: service_healthy
+    mem_limit: 1G
+    memswap_limit: 1G
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fSs http://localhost:8008/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  wellknown:
+    image: nginx:alpine
+    container_name: matrix-wellknown
+    restart: unless-stopped
+    volumes:
+      - /mnt/docker-data/configs/matrix/wellknown:/usr/share/nginx/html/.well-known/matrix:ro
+    ports:
+      - "8010:80"
+    mem_limit: 64M
+    memswap_limit: 64M
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:80/ || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  synapse-db:
+    image: postgres:15-alpine
+    container_name: synapse-db
+    user: "1024:100"
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=synapse
+      - POSTGRES_PASSWORD=synapse
+      - POSTGRES_DB=synapse
+      - POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
+    volumes:
+      - /mnt/docker-data/databases/matrix-db:/var/lib/postgresql/data
+    networks:
+      - matrix-internal
+    mem_limit: 256M
+    memswap_limit: 256M
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U synapse -d synapse"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+networks:
+  matrix-internal:
+    driver: bridge
@@ -0,0 +1,151 @@
+services:
+  jellyfin:
+    image: jellyfin/jellyfin:latest
+    container_name: jellyfin
+    restart: unless-stopped
+    environment:
+      - PUID=1000
+      - PGID=1000
+    volumes:
+      - /mnt/docker-data/configs/jellyfin:/config
+      - /mnt/nas-media:/media
+    ports:
+      - "8096:8096"
+    mem_limit: 2G
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:8096/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  sonarr:
+    image: linuxserver/sonarr:latest
+    container_name: sonarr
+    restart: unless-stopped
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=America/Chicago
+    volumes:
+      - /mnt/docker-data/configs/sonarr:/config
+      - /mnt/nas-media:/media
+    ports:
+      - "8989:8989"
+    mem_limit: 512M
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:8989/ping || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  radarr:
+    image: linuxserver/radarr:latest
+    container_name: radarr
+    restart: unless-stopped
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=America/Chicago
+    volumes:
+      - /mnt/docker-data/configs/radarr:/config
+      - /mnt/nas-media:/media
+    ports:
+      - "7878:7878"
+    mem_limit: 512M
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:7878/ping || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  sabnzbd:
+    image: linuxserver/sabnzbd:latest
+    container_name: sabnzbd
+    restart: unless-stopped
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=America/Chicago
+    volumes:
+      - /mnt/docker-data/configs/sabnzbd:/config
+      - /mnt/nas-media:/media
+    ports:
+      - "8082:8080"
+    mem_limit: 1G
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:8080/api?mode=version || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  nzbhydra2:
+    image: linuxserver/nzbhydra2:latest
+    container_name: nzbhydra2
+    restart: unless-stopped
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=America/Chicago
+    volumes:
+      - /mnt/docker-data/configs/nzbhydra:/config
+    ports:
+      - "5076:5076"
+    mem_limit: 512M
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:5076/ || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 90s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  jellyseerr:
+    image: fallenbagel/jellyseerr:latest
+    container_name: jellyseerr
+    restart: unless-stopped
+    environment:
+      - TZ=America/Chicago
+    volumes:
+      - /mnt/docker-data/configs/jellyseerr:/app/config
+    ports:
+      - "5055:5055"
+    mem_limit: 512M
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:5055/api/v1/status || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 90s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
@@ -0,0 +1,2 @@
+OPENVAS_USERNAME=admin
+OPENVAS_PASSWORD=change_me
@@ -0,0 +1,34 @@
+services:
+  openvas:
+    image: immauss/openvas:latest
+    container_name: openvas
+    restart: unless-stopped
+    environment:
+      - PASSWORD=${OPENVAS_PASSWORD}
+      - USERNAME=${OPENVAS_USERNAME}
+    volumes:
+      - openvas-db:/data/database
+      - openvas-var-lib:/data/var-lib
+      - openvas-local-share:/data/local-share
+      - openvas-local-etc:/data/local-etc
+      - openvas-var-log:/data/var-log
+    ports:
+      - "9392:9392"
+    mem_limit: 6G
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+volumes:
+  openvas-db:
+    driver: local
+  openvas-var-lib:
+    driver: local
+  openvas-local-share:
+    driver: local
+  openvas-local-etc:
+    driver: local
+  openvas-var-log:
+    driver: local
@@ -0,0 +1,65 @@
+services:
+  homeassistant:
+    image: ghcr.io/home-assistant/home-assistant:stable
+    container_name: homeassistant
+    restart: unless-stopped
+    privileged: true
+    environment:
+      - TZ=America/Chicago
+    volumes:
+      - /mnt/docker-data/configs/homeassistant:/config
+    ports:
+      - "8123:8123"
+    dns:
+      - 192.168.86.1
+      - 8.8.8.8
+    mem_limit: 4G
+    memswap_limit: 4G
+    depends_on:
+      - mosquitto
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  esphome:
+    image: esphome/esphome:latest
+    container_name: esphome
+    restart: unless-stopped
+    environment:
+      - TZ=America/Chicago
+    volumes:
+      - /mnt/docker-data/configs/esphome/config:/config
+    ports:
+      - "6052:6052"
+    mem_limit: 2G
+    memswap_limit: 2G
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:6052/ || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  mosquitto:
+    image: eclipse-mosquitto:latest
+    container_name: mosquitto
+    restart: unless-stopped
+    volumes:
+      - /mnt/docker-data/configs/mosquitto:/mosquitto
+    ports:
+      - "1883:1883"
+      - "8883:8883"
+    mem_limit: 128M
+    memswap_limit: 128M
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
@@ -0,0 +1,20 @@
+services:
+  watchtower:
+    image: containrrr/watchtower:latest
+    container_name: watchtower
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      - WATCHTOWER_CLEANUP=true
+      - WATCHTOWER_INCLUDE_RESTARTING=true
+      - WATCHTOWER_POLL_INTERVAL=86400
+      - WATCHTOWER_MONITOR_ONLY=false
+      - TZ=America/Chicago
+      - DOCKER_API_VERSION=1.44
+    mem_limit: 256M
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"