blandClaude Opus 4.8 de93e108ad podman: make the stack podman-friendly (drop docker.sock runner, pin XFF subnet) ...

- bootstrap.sh / kanidm-setup.sh: docker compose -> podman compose; run rootful
  (as root) so Caddy can bind 80/443 and Kanidm sees a stable source IP
- compose.yml: remove the in-compose act_runner (it mounted docker.sock) — the
  host gitea-runner already covers it; pin the project network to 172.18.0.0/16
  so Kanidm's X-Forwarded-For trust (172.16/12) stays valid under Podman, whose
  default pool hands out unmatched 10.89.x addresses
- README / deploy.yml: podman + host-runner notes

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-09-28 11:15:29 +02:00

..

deploy.yml

podman: make the stack podman-friendly (drop docker.sock runner, pin XFF subnet)

2026-09-28 11:15:29 +02:00