Server Services

Everything running on the production box that is not part of this repo's Compose stack. Each one lives in its own directory with its own docker-compose.yml, joins the external pangolin network, and uses expose: rather than ports:, so Traefik is the only way in.

They are not touched by just prod. Update them with docker compose pull && docker compose up -d in their own directory.

Layout on the host

containers/
├── manage.fish        ← brings every stack below up or down in one pass
├── .compose_order     ← the order it uses
├── pangolin/          ← Traefik + Pangolin, the reverse proxy layer
├── clashwithjpa.com/  ← this repo
├── dozzle/            ← docker log viewer
├── drizzle-gateway/   ← database browser
├── pgbackweb/         ← Postgres backup manager
├── rybbit/            ← analytics (Rybbit + ClickHouse + Postgres)
╰── db/                ← extra Postgres instances used as local mirrors

Note

The Discord bot is not here. It runs from its own directory outside containers/ on its own Compose project, and nothing in this wiki manages it.

Every one of them declares the pangolin network as external, so none of them creates it. It has to exist before any of them start, which is the manual docker network create pangolin in Production Deployment → step 2. Past that the start order between stacks does not matter, a target that comes up after Traefik is picked up on the next poll.

manage.fish brings them all up in one pass, taking its order from .compose_order and falling back to alphabetical for anything not listed:

./manage.fish dcu     # up -d, every stack
./manage.fish dcp     # pull
./manage.fish dcd     # down

What is published

Domain	Container	Port	Tool	Login required
logs.clashwithjpa.com	dozzle	8080	Dozzle	Yes
gateway.clashwithjpa.com	drizzle-gate	4983	Drizzle Gateway	Yes
pgbackweb.clashwithjpa.com	pgbackweb	8085	PG Back Web	Yes
analytics.clashwithjpa.com	rybbit-client	3002	Rybbit	Yes (uses its own auth)

"Login required" means the Pangolin resource has SSO enabled, so Badger intercepts and redirects to the dashboard login. See Production Deployment → step 5.

Note

The subdomains above are illustrative, the real ones are not published here. Containers and ports are exact. Check the Pangolin dashboard for what each one actually answers on.

Caution

Dozzle mounts /var/run/docker.sock. That is read access to every container on the host, which is exactly why it sits behind SSO. The same goes for Drizzle Gateway (full database access) and PG Back Web (holds the dumps).

Rybbit

Four containers: rybbit-client (the UI, :3002), rybbit-backend (the API, :3001), clickhouse for event storage, and its own postgres for users and config. The Pangolin resource for it needs two targets, because tracking requests and the dashboard are served by different containers:

Path	Target host	Port
/api/*	rybbit-backend	3001
(default)	rybbit-client	3002

The site's tracking snippet is hardcoded in apps/web/src/app.html. If you fork this, change or remove it.

Drizzle Gateway

A persistent database browser. Reaches jpa-db:5432 over the pangolin network, and stores its saved connections in the drizzle-gateway-data volume mounted at /app, so losing that volume means re-adding every connection.

The same image runs locally on :7103 under the analytics compose profile. Setup and the connection fields are in Database.

PG Back Web

Reaches jpa-db:5432 over the pangolin network. That is the only reason jpa-db is attached to a network it otherwise would not need. Backup and restore workflow is in Database.