[main]: Add server-notes

2026-10-06 16:33:29 +01:00
1 parent 68a3130159
commit 81b43de3f1
@@ -0,0 +1,65 @@
+---
+schema_version: 1
+id: home-server.portainer
+type: reference
+scope: [jupiter, portainer, deployment, configuration-state]
+sensitivity: private-infrastructure
+last_reviewed: "2026-10-06"
+sources:
+  - kind: owner-report
+    reference: "Deployed container, ~/portainer_start.sh and updated Backrest plan, 2026-10-06"
+  - kind: owner-report
+    reference: "GitHub main/PAT access, Portainer environment values, manual redeployment and container inspection, 2026-10-06"
+  - kind: repository
+    repository: jupiter-stacks
+    revision: working-tree
+    base_revision: 610e325ef6a98850511ce7a089b0b9a77bfecf15
+    paths:
+      - stacks/portainer/portainer_start.sh
+related: [home-server.reference, home-server.storage, home-server.authentication, home-server.backups, home-server.deployment]
+update_triggers: [script-change, portainer-upgrade, state-migration, backup-plan-change]
+unknowns: [local-hostname-dns-resolution, successful-state-and-secret-restore]
+---
+
+# Portainer
+
+## Deployment
+
+Managed by handwritten `~/portainer_start.sh`, **not a Compose stack**.
+Reference script: [portainer_start.sh](https://github.com/jayo60013/jupiter-stacks).
+
+| Setting | Deployed value |
+| --- | --- |
+| Image | `portainer/portainer-ce:2.45.1` |
+| Container | `portainer` |
+| Restart policy | `always` |
+| Network | External Docker network `traefik` |
+| State | Host `/data/portainer` -> container `/data` |
+| Docker API | `/var/run/docker.sock` bind mount |
+| Host publication | TCP `9123` -> container `9000` |
+| HTTPS routers | `portainer.umbra.mom`, `portainer.local.umbra.mom` |
+| Traefik backend | HTTP; container port `9000` |
+| TLS | `https` entrypoint; `letsencrypt` resolver |
+
+Script stops/removes the existing container, then recreates it; bind-mounted
+state persists. Requires Docker, the `traefik` network, and mounted `/data`.
+Supplied routers attach no Authelia middleware. Local router does not establish
+local DNS resolution.
+
+## Stack management
+
+Portainer fetches <https://github.com/jayo60013/jupiter-stacks>, branch `main`,
+using a GitHub PAT. Stack environment values/secrets are managed in Portainer.
+Repository changes are pulled/redeployed manually; committing alone does not
+update containers. See [deployment](deployment.md).
+
+## Backups
+
+Daily 03:00 UTC; Google Drive; last four snapshots. Backrest reads
+`/userdata/portainer` from host `/data/portainer`.
+
+- Before snapshot: stop `portainer`; timeout `120s`; errors fatal.
+- Snapshot end/error: start `portainer`; restart errors ignored.
+- Restore remains untested; script itself is outside the listed backup paths.
+
+The former `portainer_data` named volume is not used by the deployed container.