Initial commit: stack

infrastructure/lxc-templates/npm-compose.yml

@@ -0,0 +1,15 @@
+services:
+  npm:
+    image: jc21/nginx-proxy-manager:latest
+    ports:
+      - "80:80"
+      - "443:443"
+      - "81:81"    # admin UI — restrict access to LAN only via firewall
+    volumes:
+      - npm_data:/data
+      - npm_letsencrypt:/etc/letsencrypt
+    restart: unless-stopped
+
+volumes:
+  npm_data:
+  npm_letsencrypt:

infrastructure/lxc-templates/provision-npm.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+# Provision the NPM LXC — dual-homed (LAN + internal bridge)
+# Usage: ./provision-npm.sh <lxc-id> <lan-ip> <lan-gateway>
+# Example: ./provision-npm.sh 103 10.4.0.50 10.4.0.1
+set -e
+
+LXC_ID=$1
+LAN_IP=$2
+LAN_GW=$3
+
+if [ -z "$LXC_ID" ] || [ -z "$LAN_IP" ] || [ -z "$LAN_GW" ]; then
+  echo "Usage: $0 <lxc-id> <lan-ip> <lan-gateway>"
+  exit 1
+fi
+
+echo "==> Creating NPM LXC $LXC_ID (dual-homed)"
+
+pct create "$LXC_ID" local:vztmpl/ubuntu-22.04-standard_22.04-1_amd64.tar.zst \
+  --hostname "hnf-npm" \
+  --memory 512 \
+  --cores 1 \
+  --rootfs local-lvm:8 \
+  --net0 name=eth0,bridge=vmbr0,ip="${LAN_IP}/22",gw="${LAN_GW}" \
+  --net1 name=eth1,bridge=vmbr1,ip="10.10.10.2/24" \
+  --features nesting=1 \
+  --unprivileged 0 \
+  --start 1
+
+sleep 5
+
+pct exec "$LXC_ID" -- bash -c "
+  apt-get update -qq
+  apt-get install -y -qq ca-certificates curl gnupg
+  install -m 0755 -d /etc/apt/keyrings
+  curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+  echo 'deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu jammy stable' \
+    > /etc/apt/sources.list.d/docker.list
+  apt-get update -qq
+  apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin
+  systemctl enable docker
+"
+
+echo ""
+echo "==> NPM LXC ready"
+echo "    LAN:      $LAN_IP (vmbr0)"
+echo "    Internal: 10.10.10.2 (vmbr1)"
+echo "    Next: deploy Nginx Proxy Manager via docker compose"
+echo "    NPM admin UI will be at http://$LAN_IP:81"

infrastructure/lxc-templates/provision.sh

@@ -0,0 +1,66 @@
+#!/bin/bash
+# Provision an app LXC on the internal network (10.10.10.0/24)
+# Usage: ./provision.sh <lxc-id> <last-octet> <app-name> <git-repo-url>
+# Example: ./provision.sh 110 110 kitchen https://forgejo.yourserver.com/hnf/hnf-kitchen.git
+set -e
+
+LXC_ID=$1
+OCTET=$2
+APP=$3
+REPO=$4
+IP="10.10.10.${OCTET}"
+
+if [ -z "$LXC_ID" ] || [ -z "$OCTET" ] || [ -z "$APP" ]; then
+  echo "Usage: $0 <lxc-id> <ip-octet> <app-name> [git-repo-url]"
+  exit 1
+fi
+
+echo "==> Creating LXC $LXC_ID: $APP at $IP"
+
+# Create LXC (Ubuntu 22.04, no public template — adjust storage pool as needed)
+pct create "$LXC_ID" local:vztmpl/ubuntu-22.04-standard_22.04-1_amd64.tar.zst \
+  --hostname "hnf-$APP" \
+  --memory 512 \
+  --cores 1 \
+  --rootfs local-lvm:8 \
+  --net0 name=eth0,bridge=vmbr1,ip="${IP}/24",gw=10.10.10.1 \
+  --features nesting=1 \
+  --unprivileged 0 \
+  --start 1
+
+sleep 5
+echo "==> LXC started, installing Docker..."
+
+pct exec "$LXC_ID" -- bash -c "
+  apt-get update -qq
+  apt-get install -y -qq ca-certificates curl gnupg git openssh-server
+  install -m 0755 -d /etc/apt/keyrings
+  curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+  echo 'deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu jammy stable' \
+    > /etc/apt/sources.list.d/docker.list
+  apt-get update -qq
+  apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin
+  systemctl enable docker
+  mkdir -p /opt/$APP
+"
+
+# Copy management container's SSH public key for update webhooks
+if [ -f /root/.ssh/management_deploy.pub ]; then
+  pct exec "$LXC_ID" -- bash -c "
+    mkdir -p /root/.ssh
+    echo '$(cat /root/.ssh/management_deploy.pub)' >> /root/.ssh/authorized_keys
+    chmod 600 /root/.ssh/authorized_keys
+  "
+  echo "==> SSH key installed"
+fi
+
+# Clone app repo if provided
+if [ -n "$REPO" ]; then
+  pct exec "$LXC_ID" -- bash -c "git clone '$REPO' /opt/$APP"
+  echo "==> Repo cloned to /opt/$APP"
+fi
+
+echo ""
+echo "==> LXC $LXC_ID ($APP) ready at $IP"
+echo "    SSH: pct enter $LXC_ID"
+echo "    Next: copy .env, then: cd /opt/$APP && docker compose up -d"