.env files moved to the backed-up, non-source-controlled data dir
alongside each app's other state. immich and authentik keep a
symlink instead, since their compose.yml relies on ${VAR}
interpolation which Compose only resolves from a .env next to the
compose file (or via --env-file), not from the env_file: directive.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DPXhxhLUopnuDm3dWeHd5C
caddy/.env and immich/.env were tracked despite .gitignore already
excluding .env — gitignore only applies to untracked paths, so these
kept diffing secrets into commits. Files stay on disk, just no
longer in git.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DPXhxhLUopnuDm3dWeHd5C
Joins caddy to miccheck-qa-net so it can reverse-proxy to the
admin/api containers by name. Uses self-signed internal TLS since
miccheck-qa.com is a local-only hosts-file domain, not a real zone.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Compose service registers against git.wampler.us via act_runner,
mounts docker.sock for job execution. Secrets and runtime state
(.env, data/) kept out of git.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Books.wampler.us now routes through Caddy. Port 8083 no longer
exposed directly since traffic goes through the proxy network.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
