dongarandClaude Opus 5.5
eafe1b9f4a
deploy/agent-host sets up the vault on nisse-host (infra/tofu#77) and SilverBullet over it: the operator writes the vault, the agents' memory/ is read-only to it, and only the operator's Caddy reaches it, which serves vault.dongar.net to the LAN. scripts/agent-host.sh installs and checks it from here. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk
27 lines
1.1 KiB
YAML
27 lines
1.1 KiB
YAML
# SilverBullet on the agent host: the operator's view of the vault (L10, M5.4).
|
|
# Installed to /opt/stacks/silverbullet by ../setup.sh. No secrets here: its
|
|
# accounts are made in its setup wizard and kept in its data folder.
|
|
services:
|
|
silverbullet:
|
|
# Pinned: the docker role updates stacks' images nightly, and a pinned
|
|
# version only changes in a PR here.
|
|
image: ghcr.io/silverbulletmd/silverbullet:2.11.1-slim
|
|
restart: unless-stopped
|
|
environment:
|
|
PUID: "1000"
|
|
PGID: "1000"
|
|
SB_NAME: Nisse vault
|
|
ports:
|
|
# IPv4 only; setup.sh's firewall lets only the operator's Caddy in.
|
|
- "0.0.0.0:3000:3000"
|
|
volumes:
|
|
# Its own accounts and settings.
|
|
- /srv/nisse/silverbullet:/data
|
|
# The vault, the space's folder: the operator writes everything in it...
|
|
- /srv/nisse/vault:/vault
|
|
# ...except the agents' memory, which only the agents write (one writer
|
|
# per folder, enforced by the kernel).
|
|
- /srv/nisse/vault/memory:/vault/memory:ro
|
|
logging:
|
|
driver: journald # logs go to the host's journal (L12)
|