Add a deployable server stack with TLS, and strip local panels from the public board

[tschm]

Everything needed to run the board world-readable on an always-on host. The laptop stack cannot be that: Docker pauses when the Mac sleeps, and there are no working copies on a server anyway.

What's here

• docker-compose.server.yml — standalone, not an overlay. No bind mount and an empty JQ_REPO_ROOT so local scanning is skipped; JQ_PUBLIC_ONLY forced on; only Grafana publishes a port; anonymous access off, public dashboards on.

• docker-compose.tls.yml — adds Caddy, stops publishing Grafana entirely, and obtains/renews a certificate by itself. With it, only Caddy is exposed, so the admin login never crosses the internet in clear.

• scripts/bootstrap-server.sh — refuses to come up half-configured, because a half-configured public board is worse than none. Every guard is tested:

  error  .env not found
  error  ACME_EMAIL is not set in .env
  error  GF_ADMIN_PASSWORD is shorter than 16 characters - this host is on the internet
  error  nope.jqr.ae does not resolve - add the A record first
  warn   jqr.ae points at X but this host is Y - certificate issuance will fail
  error  GITHUB_TOKEN rejected by the GitHub API (HTTP 401)
  

  Only past all of those does it start the stack and run check-public-safe.sh, failing loudly rather than declaring success.

• Empty JQ_REPO_ROOT is now a clean no-op rather than an error logged every minute, with a test.

The public board no longer describes anyone's laptop

make-public-dashboard.py drops every panel sourced from jq_local_* — dirty files, checked-out branch names, fetch ages. Not secret when the repos are public, but it is someone's working state, it is meaningless to anyone else, and it is empty on a server. Mixed panels keep their non-local series, links into dropped panels are pruned, and the layout is repacked preserving bands so a row of tiles doesn't become a column.

Verified

Run from a clean git archive of this branch: all five compose combinations validate, 2 dashboards valid, 21 tests pass. The server stack was also built and run for real earlier — 719 series, 0 local, 23 repos, 0 private, anonymous reach 200 on the public dashboard and 401 on /api/search, /api/ds/query and the datasource proxy.

CI now validates the server stack and the TLS overlay alongside the others.

Why not Fly.io

Recorded in the README so nobody repeats it: flyctl v0.4.95 does not implement the [build.compose] its docs describe — neither fly deploy nor fly launch detects a compose file, and there is no --compose flag. Two further gotchas found before hitting that wall are written down in case it ever ships.

🤖 Generated with Claude Code