LinumIQ/linumiq_net-docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8 Commits 2 Branches 0 Tags
83cbec8276fcae4c51416c7a2f104e20bfaf89b0
Commit Graph
7 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
linumiq_net-user 83cbec8276 supabase updates 2026-06-02 10:30:55 +02:00
linumiq_net-user e7a7cafa89 Add daily encrypted borgmatic backup service 
- /docker/backup: borgmatic container (daily 03:00 Berlin via BACKUP_CRON)
- Backs up /docker (ro) to local encrypted repo /var/backups/borg (repokey-blake2)
- Postgres prod+dev captured via pg_dumpall; live PG data/logs/build artifacts excluded
- Retention: keep_daily 7, keep_weekly 4, keep_monthly 6; runs prune/compact/create/check
- Secrets in backup/.env (gitignored, chmod 600)
 2026-05-31 22:29:46 +02:00
linumiq_net-user 02b4fe1fc0 custom Caddy including rate limiting module 2026-05-31 10:19:57 +02:00
linumiq_net-user f313701e5e security updates 2026-05-31 10:18:50 +02:00
linumiq_net-user 3b3f589d64 dev: document server-only pieces (authorizer + frps.toml) 
Add dev/SERVER-ONLY.md (extended check-subdomain authorizer code + dev frps
notes) and dev/frps/frps.toml.example (sanitized template) so the gitignored,
server-only parts of the dev setup are reproducible from the repo.
 2026-05-30 14:18:53 +02:00
linumiq_net-user 7fe0cc3753 dev: add parallel dev environment under /docker/dev 
Near-1:1 clone of the prod remote-access stack, isolated on a new external
dev_edge network and fronted by the same shared Caddy instance (dual-homed on
edge + dev_edge). Dev is manual-start (not on boot).

- Hostnames: app-dev / api-dev .linumiq.net, tunnels under *.dev.linumiq.net,
  dev tunnel ingress on port 7001.
- Dev Supabase (project supabase-dev, *-dev containers), web, frps, redis,
  stripe-stub, bandwidth-worker with fresh independent secrets (gitignored).
- Shared Caddyfile: app-dev -> web-dev, api-dev -> dev kong (+webhook block),
  *.dev -> frps-dev vhost. Caddy compose dual-homed on dev_edge.
- On-demand-TLS authorizer (prod check-subdomain, in gitignored volumes/)
  extended additively: app-dev/api-dev -> 200; *.dev delegated to the dev
  authorizer. Prod allow-list logic unchanged.
- dev.sh manual up/down/ps helper; README documents topology + secrets.

Secrets, frps.toml, volumes/, web worktree and data dirs are gitignored.
 2026-05-30 13:23:34 +02:00
linumiq_net-user a8593afa61 initial commit 2026-05-29 17:12:19 +02:00