coder: initial import of deployed stack (v2.35.3 compose, docker template, SSOT vault)

docker-compose.yml

@@ -0,0 +1,50 @@
+services:
+  database:
+    image: postgres:17
+    container_name: coder-database
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: coder
+      POSTGRES_PASSWORD: ${CODER_PG_PASSWORD}
+      POSTGRES_DB: coder
+    volumes:
+      - coder_pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U coder -d coder"]
+      interval: 5s
+      timeout: 5s
+      retries: 12
+    mem_limit: 2g
+
+  coder:
+    image: ghcr.io/coder/coder:v2.35.3
+    container_name: coder
+    restart: unless-stopped
+    depends_on:
+      database:
+        condition: service_healthy
+    ports:
+      - "127.0.0.1:52226:7080"
+    environment:
+      CODER_HTTP_ADDRESS: 0.0.0.0:7080
+      CODER_ACCESS_URL: https://code.loca.zone
+      CODER_PG_CONNECTION_URL: postgresql://coder:${CODER_PG_PASSWORD}@database:5432/coder?sslmode=disable
+      CODER_TELEMETRY_ENABLE: "false"
+      # No CODER_WILDCARD_ACCESS_URL. Nested names such as foo.code.loca.zone
+      # DO resolve via the *.loca.zone wildcard; the actual blocker is TLS
+      # issuance: this lineage covers only code.loca.zone and
+      # wiki.code.loca.zone, and a *.code.loca.zone certificate needs DNS-01
+      # validation with DNS-provider credentials that are not configured here.
+      # Path-based workspace apps and `coder port-forward` are used instead.
+    group_add:
+      # host gid of /var/run/docker.sock; required so the built-in provisioner
+      # can build docker-template workspaces.
+      - "105"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - coder_home:/home/coder
+    mem_limit: 8g
+
+volumes:
+  coder_pgdata:
+  coder_home: