Plan — codefactory

Future work for the self-hosted OpenCode instance. The README describes what is deployed now; this file captures what is still to be built.

1. Docker-in-Docker for development + real Docker for image builds

Right now the container mounts the host's real /var/run/docker.sock. That is convenient for building images to deploy to Portainer + Traefik, but it is the real Docker — one bad docker rm -rf or privileged container can hurt the host.

Goal split:

• Real Docker socket (current mount): used only to build images that get pushed to the registry and deployed via Portainer + Traefik. Read-only where possible, no dev containers left running on it.
• Docker-in-Docker (DinD): a separate, nested Docker daemon inside the OpenCode container (or a sibling container) used by agents for development builds, tests, and scratch containers. It dies with the dev container and cannot touch the host Docker.

Agents should know which daemon to talk to (DOCKER_HOST) depending on the task: dev work → DinD; release image → real Docker.

2. Expose development servers to the internet

Agents spinning up dev servers (Next.js, .NET, etc.) need them reachable from a laptop/phone for testing.

Proposal:

• Run a second Traefik instance (or use the existing one with a dedicated entrypoint/router) for ephemeral dev services.
• Route through sub-sub-domains like dev-<slug>.codefactory.xn--sberg-lra.net or <project>.dev.codefactory.xn--sberg-lra.net.
• Short-lived routers/services created on demand and torn down when the dev session ends, so nothing stale is exposed.
• Ideally password-protected or internal-only (Tailscale/Cloudflare Tunnel as an alternative to public exposure).

3. Persist all configs

Current persistence:

• /bigger/codefactory/config → OpenCode/agent config.
• /bigger/codefactory/workspace → working directory.
• /big/repos → git server repos (bind-mounted, not created by this repo).

Still to add:

• Git user config (~/.gitconfig, credentials, SSH keys) saved to the config volume and restored on startup, so agents commit as me and can push to my git server.
• OpenCode skills, settings, and model preferences saved to the config volume (already mounted, just needs to be used deliberately).
• Any agent-installed per-project SDKs (see #4) restored across container restarts.

4. Per-project SDKs installed by agents, surviving restarts

Currently the image has global SDKs (Node 26, .NET 10, Rust). The wish is for agents to install SDKs per project (e.g. a specific Node version, a .NET SDK, a Rust toolchain) so projects don't interfere with each other.

Requirements:

• SDK installs must live in the persisted workspace/config volume (not the container's writable layer), so they survive docker compose down/up.
• Agents should be able to install on demand (nvm, rustup, dotnet-install script, etc.) and record what each project needs (e.g. .tool-versions, runtimeconfig.json, rust-toolchain.toml, or a project manifest).
• A "bootstrap" step in skills so any agent joining a project can reinstall the project's SDKs from the manifest.

This is explicitly marked a future item — not blocking the MVP.

5. Agent skills for "how my setup works"

When agents work on other projects (not codefactory itself), they should know how my infrastructure works so they can deploy correctly. Skills to write and store in the config volume:

• Portainer + Traefik skill: how stacks are deployed, where compose files live, how Traefik labels map to routers/services, how to add a new service to the proxy network, where certs come from.
• Git server skill: where /big/repos lives, how to create/push repos, auth method (SSH keys / HTTP), remote naming.
• Docker skill: real Docker vs DinD, which socket to use for what, image naming/tagging convention, registry to push to.
• Domain/Traefik skill: codefactory.xn--sberg-lra.net is the main entry; dev sub-sub-domains follow dev-*.codefactory.xn--sberg-lra.net; TLS is handled by Traefik.
• Deployment skill: end-to-end flow from code in /repos → build image (real Docker) → push → Portainer stack deploy → Traefik route.

Skills should be written as OpenCode skills (markdown + scripts) in /bigger/codefactory/config/ so they persist and load into every session.

Suggested order

1. Persist git config + OpenCode skills to the config volume (quick win).
2. Write the Portainer/Traefik/git/Docker agent skills.
3. Add DinD for dev builds + guardrails around the real Docker socket.
4. Dev-server exposure via Traefik sub-sub-domains.
5. Per-project SDKs with manifests + bootstrap skill.

Safety notes

• The real Docker socket is mounted rw. Avoid docker system prune, docker rm -f on host containers, or privileged containers unless intended.
• AUTH in docker-compose.yml is a placeholder — the real value is injected at runtime and never committed.
• /big/repos is my git server's data — treat it as read-only unless creating a repo deliberately.