From f56b9de0d68bdd091522f6f7ec0eae7bb9d6dd8e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Tue, 25 Aug 2026 10:04:36 +0000 Subject: [PATCH] todo: OPM sits on the docker network, so containers need no published port Co-Authored-By: Claude Fable 5 --- .../opm-officer-s-own-process-manager.md | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/todo/infra/opm-officer-s-own-process-manager.md b/todo/infra/opm-officer-s-own-process-manager.md index fc575d8d..bd8571a3 100644 --- a/todo/infra/opm-officer-s-own-process-manager.md +++ b/todo/infra/opm-officer-s-own-process-manager.md @@ -28,3 +28,26 @@ running on `officer-dev` or `alpha` today. Open, and the owner's call: whether OPM is a genuinely new supervisor or PM2 kept underneath with its own daemon, namespace and CLI wrapper — which would buy the separation at a fraction of the cost, since the `ecosystem.config.cjs` generation, the naming convention and the restart discipline all already exist. + +--- + +**Decided 2026-08-25: it is happening, and it answers the open question above.** OPM is a genuinely new +supervisor, not PM2-with-a-wrapper — because the next requirement needs something PM2 was never built +for: **OPM should sit ON the Docker network, so a container-backed dependency never needs a published +host port at all.** + +Verified on this host what that would remove. `docker network ls` shows dedicated bridge networks +already in place (`officerdev`, `services`, `nginx`) — the grouping this asks for exists, containers are +just not reached through it. What IS published today, purely so a host process can reach a container, +is the thing this closes: `officer-postgres` is `127.0.0.1:5432->5432`, `gitea` is +`127.0.0.1:9004->3000` and `127.0.0.1:10023->22`. Every one of those bindings exists for exactly one +reason — a process on the host, not in Docker, needs to reach the container — and every one is a port +that answers on localhost to anything else running as the same user, not only to Officer. + +If OPM itself runs attached to the Docker network (or as a container on it), it reaches +`officer-postgres:5432` and `gitea:3000` by container name, over the network Docker already isolates, +and the host-published bindings above stop being necessary for Officer's own processes to work. Whether +they can be removed entirely depends on who ELSE reaches them this way — `POSTGRES_URL` and any +migration/backup tooling run from a plain shell would need to move onto the network too, or keep a +narrower published port for that one purpose. That accounting is the first real task once this starts, +not an assumption to build on.