Tomter Vel's own platform: Caddy, NATS, Kanidm and portal as containers

One host, four containers, content fetched from tomtervel/questions.
bootstrap.sh renders configs from .env and recovers the Kanidm admin;
kanidm-setup.sh creates the portal client and the desk groups. An
optional runner profile lets the content repo's reload reach this host.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

README.md

@@ -0,0 +1,86 @@
+# Tomter Vel — infrastructure
+
+Everything the vel's own site needs on one host, as containers: Caddy
+for TLS, NATS with JetStream for the records, Kanidm for who is who,
+and portal, the site itself. The content (pages, forms, desks) lives
+in [tomtervel/questions](https://prosjekt.klingenbergbygg.no/tomtervel/questions)
+and is fetched from there; this repo owns the host.
+
+```
+Internet ──► Caddy (Let's Encrypt)
+               ├── PORTAL_HOST ──► portal:3000 ──► NATS (records) + Kanidm (login)
+               └── ID_HOST ─────► kanidm:8443 (internal TLS)
+```
+
+Today the vel's draft site runs on Klingenberg Bygg's host as
+vel.klingenbergbygg.no, sharing that host's Kanidm and NATS. This repo
+is the same site on a host of the vel's own, with a Kanidm of its own,
+so nothing about the vel's members or records depends on anyone else.
+
+## First start
+
+On a fresh Linux host with docker (compose plugin) and openssl:
+
+```sh
+git clone https://prosjekt.klingenbergbygg.no/tomtervel/infrastructure /srv/tomtervel/infrastructure
+cd /srv/tomtervel/infrastructure
+cp .env.example .env      # set PORTAL_HOST and ID_HOST; DNS must point here
+sh bootstrap.sh           # renders configs, makes the internal cert, starts, recovers Kanidm admin
+sh kanidm-setup.sh        # logs in, creates the portal client and desk groups, restarts portal
+```
+
+`bootstrap.sh` prints the `admin` and `idm_admin` passwords once;
+write them down. After `kanidm-setup.sh`, https://PORTAL_HOST serves the
+site and https://ID_HOST is the login.
+
+## People and desks
+
+Each group in the content (`qualifies:` under `questions/`) is a
+Kanidm group `tomtervel_<group>`, all members of `tomtervel_members`.
+Someone in `tomtervel_styret` logs in and sees the board's desk.
+
+```sh
+kanidm -D idm_admin -H https://ID_HOST person create kari "Kari Lien"
+kanidm -D idm_admin -H https://ID_HOST person update kari --mail kari@example.no
+kanidm -D idm_admin -H https://ID_HOST person credential create-reset-token kari
+kanidm -D idm_admin -H https://ID_HOST group add-members tomtervel_styret kari
+```
+
+Membership is read at login; someone added while logged in logs out
+and in again.
+
+## Content changes
+
+A push to tomtervel/questions is linted on push and tells the portal
+to reload over NATS. That reload reaches the host it runs on: today
+Klingenberg Bygg's. For this host, start the runner profile once with
+a registration token from the tomtervel org's Actions settings:
+
+```sh
+docker compose --profile runner up -d
+```
+
+and give the content repo's `lint-and-reload.yml` a reload job with
+`runs-on: tomtervel` that runs
+`nats --server nats://portal:$NATS_PASSWORD@127.0.0.1:4222 pub portal.content.reload ""`.
+Until then, `docker compose restart portal` picks up new content.
+
+## Upgrading portal
+
+Bump `PORTAL_RELEASE` in `.env` (a tag of uhhm/portal) and
+`docker compose up -d --build portal`. Keep `IRIS_RELEASE` in the
+content repo's workflow matched to it.
+
+## Backups
+
+- Kanidm writes a nightly backup into its volume (`/data/backups`,
+  seven kept); copy that directory off the host.
+- NATS JetStream data is the `nats_data` volume: every record ever
+  submitted and every state change. Snapshot the volume.
+- Caddy's certificates regenerate; nothing to keep.
+
+## What is not here
+
+Mail (a person's reset link is a token you hand them), monitoring, and
+the vel's current website at tomtervel.no, which stays where it is
+until the vel points the apex at PORTAL_HOST.