coder: initial import of deployed stack (v2.35.3 compose, docker template, SSOT vault)

q5vault/operations/index.md

@@ -0,0 +1,42 @@
+---
+title: "🛠️ Operations"
+description: "Operational entry point for the Coder stack: bring-up and upgrade, the auth model, workspace and template work, and the verification checklist."
+source: "verified deployment on the loca operator host, 2026-08-19"
+reviewed: 2026-08-19
+---
+
+# 🛠️ Operations
+
+Every command on these pages runs from `/home/loca/dev/coder` and every docker invocation needs `sudo -n`, because `loca` is deliberately not a member of the `docker` group.
+
+## 🧭 Pick a page
+
+| Situation | Page |
+| --- | --- |
+| Stack is down, needs starting, or a new image tag is out | [[operations/install-upgrade]] |
+| Someone asks why this host is not behind Authelia, or how the Owner account was bootstrapped | [[operations/auth-model]] |
+| A template needs writing or pushing, or a workspace app must be reached | [[operations/workspaces]] |
+| Proving the deployment is healthy after any change | [[operations/verification]] |
+| Looking up a path, container, volume, port or env var | [[reference/config-paths]] |
+| Explaining a missing feature | [[reference/limits]] |
+
+## ⚡ Five commands that cover most days
+
+- `cd /home/loca/dev/coder && sudo -n docker compose ps`
+- `sudo -n docker compose logs -f coder`
+- `curl -sf http://127.0.0.1:52226/healthz`
+- `curl -sf http://127.0.0.1:52226/api/v2/buildinfo`
+- `free -m` before and after anything that builds a workspace
+
+## 🚨 Order of debugging when the dashboard is unreachable
+
+- prove the container is up: `sudo -n docker compose ps` shows `coder` running and `coder-database` healthy
+- prove the server itself: `curl -sf http://127.0.0.1:52226/healthz` returns `OK`
+- prove the proxy: `sudo -n nginx -t`, then `curl -sSI https://code.loca.zone/`
+- a `302` to `auth.loca.zone` from this vhost means an Authelia rule was added by mistake; remove it, see [[operations/auth-model]]
+- a `502` with a healthy loopback means nginx lost the upstream; check the publish spec is still `127.0.0.1:52226:7080`
+
+## 📚 Sources
+
+- https://coder.com/docs/install/docker
+- https://coder.com/docs/admin/setup