adding a service #

one directory per service, services/<name>/. nothing outside it needs editing, the scripts discover what is there. every file is optional except run and process.yaml. services/redis/ is a small example.

• run: exports its env and execs ${FOO_CMD:-$default}. runs what is already built, builds go in setup
• process.yaml: process-compose entry with a readiness probe and depends_on, wrapped in offline unless it needs the internet while it runs
• ports.env: loopback ports, TNGL_FOO_PORT=${TNGL_FOO_PORT:-52590}. pick one nobody has with grep -rh _PORT localinfra/pc/ports.env localinfra/pc/services/*/ports.env
• commands.env: defaults for FOO_BIN and FOO_CMD
• Caddyfile: vhosts, upstream 127.0.0.1:{$TNGL_FOO_PORT}
• setup: runs before the stack starts, may fetch and build
• doctor: checks required binaries with need prog
• profile: profile names, one per line. the service only runs when one is on, without the file it always runs
• packages: nixpkgs attributes nix run .#localinfra should bring

rules #

• loopback only: bind 127.0.0.1.
• call sibling services through *.tngl.boltless.dev because caddy terminates tls for all of them.
• trust $TNGL_CERTS/root.crt for outgoing https calls.
• one service per directory, matching the compose service name.