infra: relocate docker-30 compose stack under vms-home/, add garage and frisbee-drills

Move the docker-30 service definitions (gitea, kanidm, vault, zot,
nginx, lab-proxy, maru-hleda-byt, fuj-management) into vms-home/ to
match the naming convention used for other hosts, and add the new
garage object-storage and frisbee-drills services alongside it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-30/readme.md

@@ -1,17 +0,0 @@
-# docker-30
-
-## taiscale
-
-```bash
-# Add signing key
-curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/$(lsb_release -cs).noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
-
-# Add repo
-echo "deb [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] https://pkgs.tailscale.com/stable/ubuntu $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/tailscale.list
-
-# Install
-sudo apt update && sudo apt install tailscale
-
-# Start
-sudo tailscale up
-```

vms-home/docker-30/frisbee-drills/run-presejpacky.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+docker rm -f drills-presejpacky
+
+# gitea registry login with kacerr / token
+docker run -d --name drills-presejpacky \
+  --restart=always \
+  -p 3101:3000 \
+  gitea.home.hrajfrisbee.cz/kacerr/flat-stack-presejpacky:presejpacky-v1

vms-home/docker-30/garage/docker-compose.yml

@@ -0,0 +1,42 @@
+services:
+  garage:
+    image: dxflrs/garage:v2.3.0
+    container_name: garage
+    restart: unless-stopped
+    networks: [garage]
+    ports:
+      - "3900:3900"   # S3 API  (LAN-reachable for your other services)
+      - "3902:3902"   # S3 web
+      # - "3901:3901" # RPC — only publish once you go multi-node
+    volumes:
+      - /srv/docker/garage/garage.toml:/etc/garage.toml:ro
+      - /srv/docker/garage/meta:/var/lib/garage/meta
+      - /srv/docker/garage/data:/var/lib/garage/data
+      - /srv/docker/garage/snapshots:/var/lib/garage/snapshots
+    healthcheck:
+      test: ["CMD", "/garage", "status"]   # image is distroless; use the binary, not curl
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+
+  garage-webui:
+    image: khairul169/garage-webui:1.1.0
+    container_name: garage-webui
+    restart: unless-stopped
+    networks: [garage]
+    depends_on:
+      garage:
+        condition: service_healthy
+    ports:
+      # - "127.0.0.1:3909:3909"   # bind localhost only — reverse-proxy in front for TLS/auth
+      - "3909:3909"
+    volumes:
+      - /srv/docker/garage/garage.toml:/etc/garage.toml:ro
+    environment:
+      API_BASE_URL:    "http://garage:3903"   # override self-pointing default
+      S3_ENDPOINT_URL: "http://garage:3900"
+
+networks:
+  garage:
+    driver: bridge

vms-home/docker-30/garage/garage.toml

@@ -0,0 +1,28 @@
+metadata_dir           = "/var/lib/garage/meta"
+data_dir               = "/var/lib/garage/data"
+metadata_snapshots_dir = "/var/lib/garage/snapshots"
+db_engine              = "lmdb"
+
+metadata_fsync                  = true
+metadata_auto_snapshot_interval = "6h"    # LMDB corruption insurance
+compression_level               = 2
+replication_factor              = 1        # single node; bump when you add nodes
+
+rpc_bind_addr   = "[::]:3901"
+rpc_public_addr = "127.0.0.1:3901"         # self-RPC only on single node
+rpc_secret      = "REPLACE_rpc_secret"     # openssl rand -hex 32
+
+[s3_api]
+s3_region     = "garage"
+api_bind_addr = "[::]:3900"
+root_domain   = ".s3.garage"
+
+[s3_web]
+bind_addr   = "[::]:3902"
+root_domain = ".web.garage"
+index       = "index.html"
+
+[admin]
+api_bind_addr = "[::]:3903"
+admin_token   = "REPLACE_admin_token"      # webui reads this for auth; openssl rand -hex 32
+metrics_token = "REPLACE_metrics_token"    # openssl rand -hex 32

vms-home/docker-30/gitea/runner-config.yaml

@@ -0,0 +1,15 @@
+runner:
+  file: /data/.runner
+  fetch_interval: 10s
+  fetch_timeout: 30s
+  capacity: 4   # number of concurrent jobs this runner will accept
+
+cache:
+  enabled: true
+  dir: /data/cache
+  host: gitea-runner
+  port: 8088
+
+container:
+  network: gitea-production_gitea-network
+  force_pull: true

vms-home/docker-30/nginx/021-drills.conf

@@ -0,0 +1,20 @@
+server {
+    listen 443 ssl http2;
+    server_name drills.home.hrajfrisbee.cz;
+
+    ssl_certificate /etc/letsencrypt/live/drills.home.hrajfrisbee.cz/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/drills.home.hrajfrisbee.cz/privkey.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+
+    location /presejpacky {
+        proxy_pass http://192.168.0.30:3101;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+}

vms-home/docker-30/readme.md

@@ -0,0 +1,43 @@
+# docker-30
+
+## taiscale
+
+```bash
+# Add signing key
+curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/$(lsb_release -cs).noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
+
+# Add repo
+echo "deb [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] https://pkgs.tailscale.com/stable/ubuntu $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/tailscale.list
+
+# Install
+sudo apt update && sudo apt install tailscale
+
+# Start
+sudo tailscale up
+```
+
+
+## connect nvmeof volume
+
+```bash
+nvme discover -t tcp -a 192.168.0.40 -s 4420
+
+nvme connect -t tcp -a 192.168.0.40  -s 4420 -n nqn.2011-06.com.truenas:uuid:6ac818fb-9f51-4e28-a5d6-41502eba031d:garage-s3
+
+nvme list
+
+mkfs.xfs -L garage /dev/nvme0n1
+mkdir -p /srv/garage
+mount /dev/disk/by-label/garage /srv/garage
+mkdir -p /srv/garage/{meta,data,snapshots}
+
+# add to fstab
+# LABEL=garage  /srv/garage  xfs  defaults,_netdev,nofail,x-systemd.requires=nvmf-autoconnect.service  0 0
+
+# /etc/nvme/discovery.conf
+-t tcp -a <TRUENAS_IP> -s 4420 -n nqn.2011-06.com.truenas:garage-s3
+systemctl enable nvmf-autoconnect.service
+
+
+
+```