# paas golden template

Generalized dotnews-paas platform image (Debian 13). **No instance state.**
One template for both flavours — chosen in the setup wizard:

- **Node.js** (= production): Caddy + Varnish + PM2
- **Laravel**: + PHP-FPM 8.3/8.4, composer, MariaDB (packages pre-installed, off until chosen)

## Spawn a new server

1. `qm clone <THIS_VMID> <NEWID> --name <name> --full`
2. `qm set <NEWID> --ipconfig0 ip=192.168.13.<X>/24,gw=192.168.13.1`
3. `qm start <NEWID>`
4. OPNsense: NAT 80/tcp, 443/tcp, 443/udp from a free WAN alias to the VM IP
5. DNS: `<panel-domain>` A-record to that alias (before step 6)
6. `ssh younes@192.168.13.<X>` then **`sudo paas-init`** — the wizard asks for
   the panel domain (management login), admin password, flavour (Node.js / Laravel),
   system-domain base and ACME e-mail, pulls the latest code and sets up everything.
7. Checkmk host + deploy key on the git hosts (the wizard prints both at the end)

Every server needs its **own panel domain** (production uses `deploy.younex.de`).
`sudo paas-init` can be re-run any time (e.g. to add the Laravel flavour later).

## Policy

This is the ONLY golden template. It is refreshed whenever new platform
features land in production: see `infra/golden-template.md` in the repo
(clone, `git pull`, bootstrap, `infra/generalize-golden.sh`, `qm template`,
then destroy the previous template).