docs(maintainers): STACK_NAME not initializing early enough

See toolshed/organising#680

docs/abra/hack.md

@@ -12,8 +12,8 @@ In other words, we're happy to give you, as contributor, "the commit bit" (read/
 
 We maintain a "team" called "Co-operators" on our 2 main repositories:
 
-* [`git.coopcloud.tech/org/toolshed`](https://git.coopcloud.tech/org/toolshed/)
-* [`git.coopcloud.tech/org/coop-cloud`](https://git.coopcloud.tech/org/coop-cloud/)
+* [`git.coopcloud.tech/org/toolshed`](https://git.coopcloud.tech/toolshed/)
+* [`git.coopcloud.tech/org/coop-cloud`](https://git.coopcloud.tech/coop-cloud/)
 
 This gives you read/write access to all the repositories of the organisation.
 
@@ -30,14 +30,28 @@ Install [Go >= 1.16](https://golang.org/doc/install) and then:
 - `make build` to build. If this fails, run `go mod tidy`.
 - `./abra` to run commands
 - `make test` will run tests
-- `make install-abra` will install abra to `$GOPATH/bin`
-- `make install-kadabra` will install kadabra to `$GOPATH/bin`
+- `make install` will install abra to `$GOPATH/bin`
 - `go get <package>`, `go mod tidy` and `go mod vendor` to add a new dependency
 
 Our [Drone CI configuration](https://git.coopcloud.tech/toolshed/abra/src/branch/main/.drone.yml) runs a number of checks on each pushed commit. See the [Makefile](https://git.coopcloud.tech/toolshed/abra/src/branch/main/Makefile) for more handy targets.
 
 Please use the [conventional commit format](https://www.conventionalcommits.org/en/v1.0.0/) for your commits so we can automate our change log.
 
+### Super quick-start (Ubuntu Server)
+
+```bash
+cd 
+sudo apt update && DEBIAN_FRONTEND=noninteractive sudo apt install -y golang make git 
+git clone https://git.coopcloud.tech/toolshed/abra.git && cd abra 
+make build
+mkdir -p  ~/.local/bin/
+ln -sF $PWD/abra ~/.local/bin/abradev
+if [[ "$PATH" != *".local/bin"* ]]; then export PATH="$PATH:~/.local/bin/"; echo 'export PATH=$PATH:~/.local/bin' >> ~/.bashrc; fi
+# Set up Spanish auto-completion
+LANG=es abra autocompletar bash | sed 's/abra/abradev/g' | sudo tee /etc/bash_completion.d/abra-dev
+abradev --help
+```
+
 ## Unit tests
 
 ### Run tests
@@ -112,16 +126,7 @@ Then, before running tests, set `export BATS_LIB_PATH=~/.local/share/bats/`
 ##### Debian
 
 ```
-apt install bats-file bats-assert bats-support jq make git
-```
-
-Unfortunately, the latest `bats` version in Debian stable does not have the "filter tests by tags" feature, which is very handy for running a subset of the tests. For this, we need to install `bats` from source. It's easy.
-
-```
-apt purge -y bats
-git clone https://github.com/bats-core/bats-core.git
-cd bats-core
-sudo ./install.sh /usr/local
+apt install bats bats-file bats-assert bats-support jq make git
 ```
 
 #### Setup Test Server
@@ -220,7 +225,7 @@ bats -Tp tests/integration --filter-status failed # re-run only failed
 
 If you're running into issues and want to debug stuff, you can pass `-x` to `bats` to trace all commands run in the test. You can add `echo '...' >&3` debug statements to your test to output stuff also.
 
-## Internationalisation
+## Internationalisation (`i18n`)
 
 `abra` can be translated into other languages. We use a combination of [`gettext`](https://www.gnu.org/software/gettext/), [`weblate`](https://translate.coopcloud.tech) and some [intermediate automation](https://git.coopcloud.tech/toolshed/abra/src/commit/20909695e0e05c6251029dba270b3d4741aeb7a8/.drone.yml#L10-L29) to help developers and translators work together conveniently.
 
@@ -249,6 +254,16 @@ make i18n
 
 Commit the changes. Ignore `*.mo` changes if they only update the generation timestamp.
 
+#### Resolving a merge conflict
+
+```
+git remote add weblate https://translate.coopcloud.tech/git/co-op-cloud/abra/
+git remote update weblate
+git merge weblate/main
+```
+
+Once you've resolved the conflict and pushed it, you'll need admin permissions on the Weblate repository to unlock it.
+
 ### Translator workflow
 
 You can translate strings on [Weblate (`translate.coopcloud.tech`)](https://translate.coopcloud.tech). 
@@ -305,7 +320,7 @@ func main() {
 
 Some tools that are making use of the API so far are:
 
-* [`kadabra`](https://git.coopcloud.tech/toolshed/abra/src/branch/main/cmd/kadabra/main.go)
+* [`kadabra`](https://git.coopcloud.tech/toolshed/kadabra)
 
 ## Cross-compiling
 
@@ -345,6 +360,26 @@ For developers, while using this `-beta` format, the `y` part is the "major" ver
 - Wait until the build finishes on [build.coopcloud.tech](https://build.coopcloud.tech/toolshed/abra)
 - Deploy the new installer script (e.g. `cd ./scripts/installer && make`)
 - Check the release worked, (e.g. `abra upgrade; abra -v`)
+- Share the announcement:
+
+```
+📢📢📢 abra v0.XX  is finally here 📢📢📢
+
+TLDR; `abra upgrade` 👍
+
+Upgrade docs:
+https://docs.coopcloud.tech/abra/upgrade/
+
+Changelog:
+https://git.coopcloud.tech/toolshed/abra/releases/tag/0.XX.0-beta
+
+0.XX.x-beta 👉 0.XX.x-beta migration guide:
+https://docs.coopcloud.tech/abra/upgrade/#XXx-beta-0XXx-beta
+
+A huge thanks to everyone who helped get this release done ❤️‍🔥
+
+Happy Hacking 🫂
+```
 
 ## Fork maintenance
 

docs/abra/upgrade.md

@@ -53,10 +53,20 @@ And test things work.
 
 > General release notes are [here](https://git.coopcloud.tech/toolshed/abra/releases/)
 
-### `0.10.x-beta` -> `WIP`
+### `0.10.x-beta` -> `0.11.x-beta`
 
-* We now ensure that `$ABRA_DIR/servers` has stricter permissions (`0600`).
-  See [`#592`](https://git.coopcloud.tech/toolshed/abra/pulls/592) for more.
+* Timeouts are no longer used unless specifically set in the app `.env` file,
+  e.g `TIMEOUT=180`. Recipe maintainers should remove defaults so that these
+  are not imposed on operators. See
+  [`#596`](https://git.coopcloud.tech/toolshed/abra/issues/596).
+
+* `--ignore-env-version` has gone away as a global flag. `--latest` is now
+  present on `abra app deploy`. See
+  [`#617`](https://git.coopcloud.tech/toolshed/abra/issues/617).
+
+* We now ensure that `$ABRA_DIR/servers` has stricter permissions (`0600`). See
+  [`#592`](https://git.coopcloud.tech/toolshed/abra/pulls/592) for more. No
+  migration step should be required.
 
 ### `0.9.x-beta` -> `0.10.x-beta`
 

docs/federation/finance.md

@@ -60,10 +60,6 @@ Finally, please let us know what your username/email is for your Open Collective
 
 #### FAQ
 
-##### Where are the bank details of federation members?
-
-Please see [`Finance.md` in the internal Federation Wiki](https://git.coopcloud.tech/Federation/organising/wiki/Finance)
-
 ##### What transfer type do we use for USD?
 
 `ACH`. If you see `Abartn`, that is the `ACH routing number`.

docs/federation/index.md

@@ -38,6 +38,12 @@ This is the public facing page where we publish all things federation in the ope
 
     [Tools We Use](/federation/tools){ .md-button .md-button--primary }
 
+- __Shared Infrastructure Inventory__
+
+    Tools we maintain for the federation 🛠
+
+    [Tools We Maintain](/federation/infra){ .md-button .md-button--primary }
+
 - __Code of Co-operation__
 
     Be excellent to each other 💝

docs/federation/infra.md

@@ -0,0 +1,22 @@
+---
+title: Shared Infrastructure Inventory
+---
+
+## Shared repository for fedi maintainers
+
+> [coop-cloud-apps](https://git.coopcloud.tech/toolshed/coop-cloud-apps)
+
+## 2025 State of The Co-op Cloud Infra
+
+| service | server | recipe/app | notes |
+| --- | --- | --- | --- |
+| build.coopcloud.tech | `swarm-0.coopcloud.tech` | drone | should probably be moved to separate VPS |
+| (drone build runner) | `swarm-0.coopcloud.tech` | drone-docker-runner | should probably be moved to separate VPS |
+| git.coopcloud.tech |  `swarm-0.coopcloud.tech` | gitea | |
+| recipes.coopcloud.tech |  `swarm-0.coopcloud.tech` | [toolshed/recipes.coopcloud.tech](https://git.coopcloud.tech/coop-cloud/recipes.coopcloud.tech/)
+| recipes.coopcloud.tech/recipes.json | `swarm-0.coopcloud.tech` | [toolshed/recipes-catalogue-json](https://git.coopcloud.tech/toolshed/recipes-catalogue-json) | |
+| coopcloud.tech | `swarm-0.coopcloud.tech` | [toolshed/coopcloud.tech](https://git.coopcloud.tech/coop-cloud/coopcloud.tech/) | |
+| docs.coopcloud.tech | `swarm-0.coopcloud.tech` | [toolshed/docs.coopcloud.tech](https://git.coopcloud.tech/toolshed/docs.coopcloud.tech/) |  |
+| install.abra.coopcloud.tech | `swarm-0.coopcloud.tech` | [toolshed/abra/scripts/installer](https://git.coopcloud.tech/toolshed/abra/src/branch/main/scripts/installer) | |
+| sso.coopcloud.tech | `swarm-1.coopcloud.tech` | rauthy | |
+| translate.coopcloud.tech | `swarm-1.coopcloud.tech` | weblate | |

docs/federation/membership.md

@@ -19,5 +19,5 @@ title: Membership
 | `@decentral1se` | Waiver | - | `@decentral1se` |
 | [ruangrupa](https://ruangrupa.id) | - | - | Henry `@babystepper:matrix.org` |
 | [RTM](https://resisttechmonopolies.online) | ✅ | - | `@ammaratef45:matrix.org` + `@linnealovespie:matrix.org`|
-| [MIR](https://mirnet.org/) | ✅ | - | `@brooke:pub.solar` |
+| [MIR](https://mirnet.org/) | ✅ | - | `@sixsmith:matrix.org` |
 | [Red Abya Yala](https://abyayala.sutty.nl/) | - | - | `@fauno:sutty.nl` |

docs/federation/minutes/2022-03-03.md

@@ -100,8 +100,6 @@ Recap:
 
 ### decision-making process
 
-proposal: https://git.coopcloud.tech/Federation/Federation/wiki/Proposals
-
 - Trav: We adapted an old proposal for descision making process.
 - https://pad.autonomic.zone/s/MLafJE2jC#Overview
 - https://coopcloud.tech/blog/federation-proposal/

docs/federation/resolutions/in-progress/034.md

@@ -0,0 +1,20 @@
+---
+title: Resolution 034
+---
+
+- Topic: Budget 015: Extra budget for recipes needed by Escuela Común
+- Date: 2025-10-27
+- Deadline: 2025-11-10
+- Size: medium
+
+## Summary
+
+Budget 015 for 20 estimated hours of work towards Escuela Común, **to be reimbursed** from next year's budget from the Sepal fund to the Co-op Cloud Federation Common Fund.
+
+## Details
+
+As Escuela Común 2026 planning proceeds, many `abra` bugs were closed, and we even gained the translations feature, but we've realised that we'll need at least one extra recipe to support Escuela's organizing: [`tellaweb`](https://github.com/Horizontal-org/tellaweb).
+
+This work has been supported by the Sepal fund we're sharing with Escuela Común. The budget allocated for this year has been used in full, so we're requesting the Federation to allocate budget from its own funds to cover for 20 estimated hours, to be reimbursed from next year's budget, that will be available on April 2026.
+
+`@3wc` will carry out this work.

docs/federation/resolutions/passed/001.md

@@ -13,13 +13,13 @@ Institute descision making process as per below. Special consensus voting in org
 
 ### Decision Making Process
 
-* Write up a proposal using the below template, and add to the [Proposals wiki page](https://git.coopcloud.tech/Federation/Federation/wiki/Proposals).
+* Write up a proposal using the below template, and add to the [Resolutions documentation "in-progress" section](https://docs.coopcloud.tech/federation/resolutions/).
 * Specify if they are a large or medium proposal
 * Votes are done via emoji-reaction in the Community Organising Matrix channel (<https://matrix.to/#/#coopcloud-comm-org:autonomic.zone>)
-* List the decision on the [decisions page](https://docs.coopcloud.tech/federation/resolutions) on our documentation
 * Decisions can be split intro three categories: Small, Medium and Large.
 * Votes can be in favour :+1:, against :-1: (block),  or abstain :shrug:
 * Announce the result in the [Federation chat (#coop-cloud-fedi:autonomic.zone)](https://docs.coopcloud.tech/intro/contact/#matrix) and record it on the [decisions page](https://docs.coopcloud.tech/federation/resolutions) of the documentation
+* Move it to the [Resolutions documentation "passed" section](https://docs.coopcloud.tech/federation/resolutions/).
 
 ### Types of Proposals
 

docs/federation/resolutions/passed/005.md

@@ -1,5 +1,5 @@
 ---
-title: "Resolution 005: Public federation membership.."
+title: "Resolution 005: Public federation membership"
 ---
 
 * Topic: Public federation membership, notes and decisions
@@ -18,4 +18,4 @@ The following federation info will be made public on [`docs.coopcloud.tech/feder
 
 ### Details
 
-This will make the process of documenting easier to mutualise and increase transparency for those interested in joining. The [`git.coopcloud.tech/Federation`](https://git.coopcloud.tech/Federation/Federation/wiki/) wiki can still be used for storing private details such as bank account information. If members do not want to be listed, they can do so even when this decision passes.
+This will make the process of documenting easier to mutualise and increase transparency for those interested in joining. The `git.coopcloud.tech/Federation` wiki (**NOTE(d1) from the future**: this repository is now decommissioned) can still be used for storing private details such as bank account information. If members do not want to be listed, they can do so even when this decision passes.

docs/federation/resolutions/passed/032.md

@@ -1,5 +1,5 @@
 ---
-title: "Resolution 032: RIM joins"
+title: "Resolution 032: RTM joins"
 ---
 
 - Topic: RTM joins Coopcloud
@@ -11,7 +11,7 @@ title: "Resolution 032: RIM joins"
 
 Ammar's membership was approved in [Resolution 022](/federation/resolutions/passed/022).
 
-Since the establishment of RTM (Resist Rech Monopolies) collective in Seattle, Ammar has been unofficially representing the collective with coopcloud and vice versa.
+Since the establishment of RTM (Resist Tech Monopolies) collective in Seattle, Ammar has been unofficially representing the collective with coopcloud and vice versa.
 	
 ### Details
 	

docs/federation/tools.md

@@ -3,9 +3,10 @@ title: Digital tools
 ---
 
 - [Public documentation](https://docs.coopcloud.tech/federation)
-- [Organising repository (private)](https://git.coopcloud.tech/Federation/organising)
-- [Wiki (private)](https://git.coopcloud.tech/Federation/organising/wiki)
 - [Git hosting](https://git.coopcloud.tech/)
 - [Matrix Space](https://matrix.to/#/#coop-cloud-space:autonomic.zone)
 - [Website](https://coopcloud.tech/)
+- [Single Sign On](https://translate.coopcloud.tech/)
+- [Translation](https://translate.coopcloud.tech/)
+- [Sheets and time tracking](https://sheets.coopcloud.tech/)
 - [Drone CI/CD](https://build.coopcloud.tech)

docs/intro/comparisons.md

@@ -175,6 +175,29 @@ handful of popular team collaboration apps.
 - 👎 It is not designed to be a general specification.
 - 👎 Hard to share configurations into the commons.
 - 👎 Limited library of apps.
-- 👎 Uses *OpenNebula*, *Ansible*, and *Puppet* as underlying technologies.
+- 👎 Uses Ansible (see above)
 - 👎 Appears to be only a team of two people.
 - 👎 Appears to be inactive on Mastodon and limited GitLab activity. 
+
+### Dokploy 
+
+[Dokploy](https://dokploy.com/) (who have [their own comparison](https://docs.dokploy.com/docs/core/comparison)).
+
+- 👍 Supports builds from Git repositories, Dockerfiles, Nixpacks, and Buildpacks like Heroku and Paketo.
+- 👍 [~100 application templates](https://docs.dokploy.com/docs/core/templates)
+
+- 👎 [Bespoke TOML config](https://github.com/Dokploy/templates?tab=readme-ov-file#templatetoml-structure)
+- 👎 Community on Discord and Github discussions
+- 👎 Freemium / open-core model
+
+### Cosmos Cloud 
+
+[Cosmos Cloud](https://cosmos-cloud.io/), "The cloud doesn't need to be someone else's computer"
+
+- 👍 [Native client apps](https://cosmos-cloud.io/clients/)
+- 👍 Built-in VPN 
+
+- 👎 Community on Discord, Github discussions, and Reddit
+- 👎 "Up to 19 users" even on paid plans
+- 👎 Freemium / open-core model
+- 👎 ["Commons clause"](https://github.com/azukaar/Cosmos-Server/blob/master/LICENCE)

docs/maintainers/handbook.md

@@ -86,6 +86,16 @@ Because configurations are maintained in-repository by maintainers, we version t
 export NGINX_CONFIG_VERSION=v1
 ```
 
+!!! warning
+
+    It is **very important** that the naming convention of the config matches
+    the whole way down. In the above example, that is `nginx_config` in the
+    `configs:` stanza, `nginx_config` in `name:
+    ${STACK_NAME}_nginx_config_${NGINX_CONFIG_VERSION}` and finally
+    `NGINX_CONFIG_VERSION` in the `abra.sh`. This is the naming convention that
+    `abra` will perform to carry out the lookup of all matching names/values.
+    See [`#693`](https://git.coopcloud.tech/toolshed/abra/issues/693) for more.
+
 ## Manage environment variables
 
 !!! warning
@@ -124,6 +134,45 @@ You can also access it in your configs using the following syntax:
 {{ env "FOO" }}
 ```
 
+### Example: Adding environment variables to existing recipe
+Here is a four step example how to add a new environment variable to a recipe without breaking existing deployments. 
+
+1. add env-var to the `compose.yml` in section `environment`:
+   ```yaml
+       environment:
+         # ... existing envs
+         - REQUIRE_AUTH_FOR_PROFILE_REQUESTS=${REQUIRE_AUTH_FOR_PROFILE_REQUESTS:-false}
+         # ... other existing envs
+   ```
+
+   With `${REQUIRE_AUTH_FOR_PROFILE_REQUESTS:-false}` you set a default value (`false`), ensuring not to break existing deployments. 
+   If you're sure that it won't cause problems, if operators of existing deployments don't set the variable, you could also just put:
+   ```yaml
+       environment:
+         # ... existing envs
+         - REQUIRE_AUTH_FOR_PROFILE_REQUESTS
+         # ... other exisitng envs
+   ```
+   
+   Note: If you need to break something, make sure to add a [release note](/maintainers/handbook/#how-do-i-write-version-release-notes) explaining to operators what they should change before upgrading.
+
+2. add env-var to the `.env.sample`
+   ```yaml
+   #REQUIRE_AUTH_FOR_PROFILE_REQUESTS=true
+   ```
+
+3. now you can use the environment-variable in your `.tmpl` files, e.g. add to `homserver.yaml.tmpl`
+   ```yaml
+   require_auth_for_profile_requests: {{ env "REQUIRE_AUTH_FOR_PROFILE_REQUESTS" }}
+   ```
+   
+4. increase number of YAML-version in `abra.sh` (e.g. from `v30` to `v31`), only then it will be deployed. 
+   ```yaml
+   export HOMESERVER_YAML_VERSION=v31
+   ```
+
+   Note: If during development and testing you have to increase it several times, you can just "flatten" it in the end. Only make sure that you `undeploy`/`deploy` your existing instance.
+
 ### Global environment variables
 
 - `TYPE`: specifies the recipe name
@@ -256,10 +305,39 @@ file_env "DB_PASSWORD"
 Sometimes the containers don't even have Bash installed on them. You had better just use `/bin/sh` or, in your entrypoint script, install Bash :upside_down: The entrypoint secrets hack listed above doesn't work in this case (as it requires Bash), so instead you can just do `export FOO=$(cat /run/secrets/<secret-name>)`.
 
 
+## Templating
+
+### Templating domain names in the `.env.sample`
+
+`<recipe>.example.com` will be transformed into the end-user app domain when `abra app new` is run.
+
+### Templating domain names in release notes
+
+!!! warning "Watch out for old versions of `abra` 🚧"
+
+    This feature is only available in the >= 0.11.x series of `abra`.
+
+`<recipe>.example.com` will be transformed into the end-user app domain when `abra app upgrade` shows release notes.
+
 ## How do I reference services in configs?
 
 When referencing an `app` service in a config file, you should prefix with the `STACK_NAME` to avoid namespace conflicts (because all these containers sit on the traefik overlay network). You might want to do something like this `{{ env "STACK_NAME" }}_app` (using  the often obscure dark magic of the Golang templating language). You can find examples of this approach used in the [Peertube recipe](https://git.coopcloud.tech/coop-cloud/peertube/src/commit/d1b297c5a6a23a06bf97bb954104ddfd7f736568/nginx.conf.tmpl#L9).
 
+!!! warning "Here be timing dragons 🐉"
+
+    Due to how `STACK_NAME` as an environment variable is initialized within `abra`, it won't be available *early enough* for use within config templates (`*.tmpl`) unless you **use it as an environment variable for one of your compose services**.
+    Ideally this is addressed in a newer version of `abra`, but for now, this workaround suffices ✅
+
+    E.g.
+    ```
+      services:
+        web:
+          image: nginx:1.29.3
+          environment:
+            - ...
+            - STACK_NAME
+    ```
+
 ## How are recipes versioned?
 
 We'll use an example to work through this. Let's use [Gitea](https://hub.docker.com/r/gitea/gitea).
@@ -354,7 +432,7 @@ You'll notice that `abra` figured out how to upgrade the Co-op Cloud version lab
 At this point, we're all set, we can run `abra recipe release --publish wordpress`. This will do the following:
 
 1. run `git commit` the new changes
-1. run `git tag` to create a new git tag named `1.1.0+5.9.0`
+1. run `git tag -am "chore: publish 1.1.0+5.9.0 release" 1.1.0+5.9.0` to create a new annotated git tag named `1.1.0+5.9.0` (abra only accepts annotated tags)
 1. run `git push` to publish changes to the Wordpress repository
 
 !!! warning "Here be more SSH dragons"
@@ -688,10 +766,10 @@ Please note:
 1. The `file_env` / `_FILE` hack is to pass secrets into the container runtime without exposing them in plaintext in the configuration. See [this entry](/maintainers/handbook/#exposing-secrets) for more.
 
 1. In order to pass execution back to the original entrypoint, it's a good idea to find the original entrypoint script and run it from your own entrypoint script. If there is none, you may want to reference the `CMD` definition or if that isn't working, try to actually specify `cmd: ...` in the `compose.yml` definition (there are other recipes which do this).
-  
+
 1. Also it might be necessary to define command: although there is an original entrypoint. That's [due to the fact](https://docs.docker.com/reference/compose-file/services/#entrypoint) that if entrypoint is non-null, Compose ignores any default command from the image, for example the `CMD` instruction in the Dockerfile.
 
-  1. Pratically you would e.g. look for the Dockerfile of the upstream image. In there you should find the docker-entrypoint.sh (or similar) and where it's located. Furthermore you find the `CMD`-line there. 
+  1. Pratically you would e.g. look for the Dockerfile of the upstream image. In there you should find the docker-entrypoint.sh (or similar) and where it's located. Furthermore you find the `CMD`-line there.
   1. Just put in your entrypoint.sh in the last line: exec /path/to/docker-entrypoint.sh "@" (path and filename you should find in upstream Dockerfile) and insert  command:  to your service in compose.yml with the value of what you find in the CMD line of the Dockerfile.
 
 1. If you're feeling reckless, you can also use the Golang templating engine to do things conditionally.

docs/maintainers/tutorial.md

@@ -50,7 +50,7 @@ Open the `compose.yml` in your favourite editor and have a gander 🦢. The
 5. The MariaDB service doesn't need to be exposed to the internet, so we can define an `internal` network for it to communicate with Matomo.
 6. Lastly, we want to use `deploy.labels` and remove the `ports:` definition, to tell Traefik to forward requests to Matomo based on hostname and generate an SSL certificate.
 
-The resulting `compose.yml` is available [here](https://git.autonomic.zone/coop-cloud/matomo/src/branch/main/compose.yml).
+The resulting `compose.yml` is available [here](https://git.coopcloud.tech/coop-cloud/matomo/src/branch/main/compose.yml).
 
 ### Updating the `.env.sample`
 
@@ -87,7 +87,7 @@ Otherwise, or once you've done that, go ahead and deploy the app:
 abra app deploy swarm.example.com
 ```
 
-Then, open the `DOMAIN` you configured (you might need to wait a while for Traefik to generate SSL certificates) to finish the set-up. Luckily, this container is (mostly) configurable via environment variables, if we want to auto-generate the configuration we can use a `config` and / or a custom `entrypoint` (see [`coop-cloud/mediawiki`](https://git.autonomic.zone/coop-cloud/mediawiki) for examples of both).
+Then, open the `DOMAIN` you configured (you might need to wait a while for Traefik to generate SSL certificates) to finish the set-up. Luckily, this container is (mostly) configurable via environment variables, if we want to auto-generate the configuration we can use a `config` and / or a custom `entrypoint` (see [`coop-cloud/mediawiki`](https://git.coopcloud.tech/coop-cloud/mediawiki) for examples of both).
 
 ### Finishing up
 

docs/operators/handbook.md

@@ -116,7 +116,7 @@ Then `$ABRA_DIR` will be automatically picked up as `$PWD`. This is useful when
 
 ## Running abra server side
 
-If you're on an environment where it's hard to run Docker, or command-line programs in general, you might want to install `abra` on a server instead of your local work station.
+If you're on an environment where it's hard to run Docker, or command-line programs in general, you might want to install `abra` on a server instead of your local computer.
 
 To install `abra` on the same server where you'll be hosting your apps, just follow [getting started guide](/operators/tutorial#deploy-your-first-app) as normal except for one difference. Instead of providing your SSH connection details when you run `abra server add ...`, just pass `--local`.
 
@@ -126,7 +126,7 @@ abra server add --local
 
 !!! note "Technical details"
 
-	This will tell `abra` to look at the Docker system running on the server, instead of a remote one (using the Docker internal `default` context). Once this is wired up, `abra` knows that the deployment target is the local server and not a remote one. This will be handle seamlessly for all other deployments on this server.
+	This will tell `abra` to look at the Docker system running on the server itself, instead of a remote one (using the Docker internal `default` context). Once this is wired up, `abra` knows that the deployment target is the local server and not a remote one. This will be handled seamlessly for all other deployments on this server.
 
 Make sure to back up your `~/.abra` directory on the server, or put it in version control, as well as other files you'd like to keep safe.
 

docs/operators/tutorial.md

@@ -13,24 +13,23 @@ In order to deploy an app you need two things:
 
 This tutorial tries to help you make choices about which server and which DNS setup you need to run a _Co-op Cloud_ deployment but it does not go into great depth about how to set up a new server.
 
-### Server setup
+We will deploy a new Nextcloud instance in this guide, so you will only need 1GB of RAM according to [their documentation](https://docs.nextcloud.com/server/latest/admin_manual/installation/system_requirements.html).
 
-Co-op Cloud has itself near zero system requirements. You only need to worry about the system resource usage of your apps and the overhead of running containers with the docker runtime (often negligible. If you want to know more, see [this FAQ entry](/intro/faq/#isnt-running-everything-in-containers-inefficient)).
+### Server provisioning
 
-We will deploy a new Nextcloud instance in this guide, so you will only need 1GB of RAM according to [their documentation](https://docs.nextcloud.com/server/latest/admin_manual/installation/system_requirements.html). You may also be interested in this [FAQ entry](/intro/faq/#arent-containers-horrible-from-a-security-perspective) if you are curious about security in the context of containers.
+Co-op Cloud is designed to run on a variety of hardware, so you can use those single-board computers, old laptops/desktops, or refurbished servers. However, hardware setup is a skill that's beyond the scope of this guide. As long as it's running Linux and has networking, it should be fine! Most Co-op Cloud deployments have been run on Debian machines so far.
 
-Most Co-op Cloud deployments have been run on Debian machines so far. Some experiments have been done on single board computers & servers with low resource capacities.
+If you don't have the time or equipment to run your own hardware, rented hardware is fine too! There are many hosting providers which will provide a Linux server to you for a monthly fee.
 
-You need to keep port `:80` and `:443` free on your server for web proxying to your apps. Typically, you don't need to keep any other ports free as the core web proxy ([Traefik](https://traefik.io)) keeps all app ports internal to its network. Sometimes however, you need to expose an app port when you need to use a transport which would perform better or more reliably without proxying.
+### Server configuration
 
-`abra` has support for creating servers (`abra server new`) but that is a more advanced automation feature which is covered in the [handbook](/operators/handbook). For this tutorial, we'll focus on the basics. Assuming you've managed to create a testing VPS with some `$hosting_provider`, you'll need to install Docker, add your user to the Docker group & setup swarm mode:
+Assuming you've got a running server, it's now time to configure it.
 
-!!! warning "You may need to log in/out"
+Co-op Cloud has very few system requirements. You only need to worry about the system resource usage of your apps and the overhead of running containers with the docker runtime (often negligible. If you want to know more, see [this FAQ entry](/intro/faq/#isnt-running-everything-in-containers-inefficient)).
 
-    When running `usermod ...`, you may need to (depending on your system) log
-    in and out again of your shell session to get the required permissions for
-    Docker.
-    Alternatively you can run [`newgrp`](https://www.man7.org/linux/man-pages/man1/newgrp.1.html) to register the group chnage.
+To get started, you'll need to install Docker, add your user to the Docker group & setup swarm mode. Many hosting providers support [cloud-init](https://cloudinit.readthedocs.io/en/latest/index.html), which allows you to automate the steps in this section. If that applies to you, you can use [our cloud-init file](https://git.coopcloud.tech/toolshed/abra/raw/branch/main/scripts/cloud-init/cloud-init.yaml).
+
+Otherwise, here are the step required:
 
 ```
 # ssh into your server
@@ -39,34 +38,32 @@ ssh <server-domain>
 # docker install convenience script
 wget -O- https://get.docker.com | bash
 
+# check that docker was installed correctly
+sudo docker run hello-world
+
+# now setup swarm
+sudo docker swarm init
+sudo docker network create -d overlay proxy
+```
+
+#### Using docker without sudo
+
+Abra can't deploy any applications in future steps unless it can run `docker` commands without sudo.
+
+```
 # check if the docker group exists
 groups | grep docker
 
 # if the docker group doesn't already exist, add it manually
-sudo groupadd docker
+groupadd docker
 
 # add user to docker group
 sudo usermod -aG docker $USER
-
-# check that docker installed correctly
-docker run hello-world
-
-# exit and re-login to load the group
-exit
-ssh <server-domain>
-
-# back on the server, setup swarm
-docker swarm init
-docker network create -d overlay proxy
-
-# now you can exit and start using abra
-exit
 ```
-Abra can't deploy any applications in future steps if the docker group cannot run without sudo. If you install docker a different way, it may not create a docker group automatically. The [official Docker documentation](https://docs.docker.com/engine/install/linux-postinstall/) can help if you run into further issues.
 
-??? question "Do you support multiple web proxies?"
+After running `usermod`, you may need to (depending on your system) log out (`exit`) and back in again (`ssh <server-domain>`) to get the required permissions for Docker before proceeding.
 
-    We do not know if it is feasible and convenient to set things up on an existing server with another web proxy which uses ports `:80` & `:443`. We'd happily receive reports and documentation on how to do this if you manage to set it up!
+The [official Docker documentation](https://docs.docker.com/engine/install/linux-postinstall/) can help if you run into further issues.
 
 ### DNS setup
 
@@ -79,7 +76,9 @@ Your entries in your DNS provider setup might look like the following.
 
 Where `116.203.211.204` can be replaced with the IP address of your server.
 
-Warning: If the you are in the same local netwrok as the server, you might run into [NAT Hairpin](https://superuser.com/questions/663820/port-forwarding-from-inner-network-to-inner-network-hairpin-nat) issues.
+!!! warning Beware local network pitfalls!
+
+    If you are in the same local network as the server, you might run into [NAT Hairpin](https://superuser.com/questions/663820/port-forwarding-from-inner-network-to-inner-network-hairpin-nat) issues.
 
 ??? question "How do I know my DNS is working?"
 
@@ -87,8 +86,7 @@ Warning: If the you are in the same local netwrok as the server, you might run i
 
 ### Install `abra`
 
-Now we can install [`abra`](/abra) locally on your machine and hook it up to
-your server. We support a script-based installation method ([script source](https://git.coopcloud.tech/toolshed/abra/src/branch/main/scripts/installer/installer)):
+Now we can install [`abra`](/abra) locally on your machine and hook it up to your server. We support a script-based installation method ([script source](https://git.coopcloud.tech/toolshed/abra/src/branch/main/scripts/installer/installer)):
 
 ```bash
 curl https://install.abra.coopcloud.tech | bash
@@ -112,7 +110,7 @@ you have immediate access to `abra` on the current terminal.
 export PATH=$PATH:$HOME/.local/bin
 ```
 
-If you run into issues during installation, [please report a ticket](https://git.coopcloud.tech/toolshed/organising/issues/new) :pray:
+If you run into issues during installation, [please report a ticket](https://git.coopcloud.tech/toolshed/abra/issues/new) :pray:
 
 ??? question "Can I install `abra` on my server?"
 
@@ -126,7 +124,7 @@ With autocomplete enabled, you can run a command like `abra app deploy myapp.exa
 
 ### Add your server
 
-Now you can connect `abra` with your server. You must have a working SSH configuration for your server before you can proceed. That means you can run `ssh <server-domain>` on your command-line and everything Works :tm:. See the [`abra` SSH troubleshooting](/abra/trouble/#ssh-connection-issues) for a working SSH configuration example.
+Now you can connect `abra` with your server. You must have a working SSH configuration for your server before you can proceed. That means you can run `ssh <server-domain>` on your command-line and everything Works :tm:. See the [`abra` SSH troubleshooting](/abra/trouble/#ssh-connection-issues) for a working SSH configuration example or use `abra server add -h` for the help output.
 
 ??? warning "Beware of SSH dragons :dragon_face:"
 
@@ -140,21 +138,21 @@ Now you can connect `abra` with your server. You must have a working SSH configu
     troubleshooting entry](/abra/trouble/#ssh-connection-issues).
 
 ```bash
-ssh <server-domain> # make sure it works
+ssh <server-domain> hostname -I # make sure it works
 abra server add <server-domain>
 ```
 
-It is important to note that `<server-domain>` here is a publicy accessible domain name which points to your server IP address. `abra` does make sure this is the case and this is done to avoid issues with HTTPS certificate rate limiting.
+It is important to note that `<server-domain>` here is a publicly accessible domain name which points to your server IP address. `abra` does make sure this is the case and this is done to avoid issues with HTTPS certificate rate limiting.
 
 ??? warning "Can I use arbitrary server names?"
 
-    Yes, this is possible. You need to pass `-D` to `server add` and ensure
-    that your `Host ...` entry in your SSH configuration includes the name.
-    So, for example, in `~/.ssh/config`:
+    Yes, this is possible. You need to ensure that your `Host ...` entry in your SSH configuration includes the name.  So, for example, in `~/.ssh/config`:
+
     ```
       Host example.com example
         ...
     ```
+
     And then:
 
       abra server add example
@@ -169,8 +167,9 @@ abra server ls
 
 ??? question "How do I share my configs in `~/.abra`?"
 
-    It's possible and quite easy, for more see [this handbook
+    It's possible and relatively easy, for more see [this handbook
     entry](/operators/handbook/#understanding-app-and-server-configuration).
+    [Git](https://git-scm.com) skills are generally required.
 
 ### Web proxy setup
 
@@ -180,6 +179,14 @@ Traefik is the main entrypoint for all web requests (e.g. like NGINX) and
 supports automatic SSL certificate configuration and other quality-of-life
 features which make deploying libre apps more enjoyable.
 
+You need to keep port `:80` and `:443` free on your server for web proxying to your apps. Typically, you don't need to keep any other ports free as the core web proxy keeps all app ports internal to its network. Sometimes however, you need to expose an app port when you need to use a transport which would perform better or more reliably without proxying.
+
+??? question "Do you support multiple web proxies?"
+
+   Yes, this is possible. See [this handbook
+   entry](/operators/handbook/#proxying-apps-outside-of-co-op-cloud-with-traefik)
+   for more. Be warned, this is a relatively advanced topic.
+
 **1. To get started, you'll need to create a new app:**
 
 ```bash
@@ -187,8 +194,10 @@ abra app new traefik
 ```
 
 Choose your newly registered server and specify a domain name. By default `abra`
-will suggest `<app-name>.server.org` or prompt you with a list of servers.
+will suggest `<app-name>.<your-server>` or prompt you with a list of servers.
 
+??? question "Should I use www for traefik?"
+    Generally no. No one will be directly accessing the traefik domain name unless they want to see the traefik dashboard. You should reserve the `www` or apex domains for apps like [custom-html](https://recipes.coopcloud.tech/custom-html-tiny) which let you host sites. Traefik is just a proxy to other apps!
 
 **2. Configure this new `traefix` app**
 
@@ -217,8 +226,6 @@ DASHBOARD_ENABLED=false
 
 **3. Now it is time to deploy your app:**
 
-Ensure `<traefic-domain>` is registered in `/etc/hosts` then run:
-
 ```
 abra app deploy <traefik-domain>
 ```
@@ -231,7 +238,7 @@ Voila. Abracadabra :magic_wand: your first app is deployed :sparkles:
 And now we can deploy apps. Let's create a new Nextcloud app.
 
 ```bash
-abra app new nextcloud -S
+abra app new nextcloud --secrets
 ```
 
 The `-S` or `--secrets` flag is used to generate secrets for the app: database connection password, root password and admin password.
@@ -240,7 +247,7 @@ The `-S` or `--secrets` flag is used to generate secrets for the app: database c
 
     Take care, these secrets are only shown once on the terminal so make sure to take note of them! `abra` makes use of the [Docker secrets](/operators/handbook/#managing-secret-data) mechanism to ship these secrets securely to the server and store them as encrypted data. Only the apps themselves have access to the values from here on, they're placed in `/run/secrets` on the container file system.
 
-Make sure` <nextcloud-domain>` is registered in `/etc/hosts`, then we can deploy Nextcloud:
+Now we can deploy Nextcloud:
 
 ```bash
 abra app deploy <nextcloud-domain>
@@ -254,7 +261,7 @@ abra app logs <nextcloud-domain>      # logs trailing
 abra app errors -w <nextcloud-domain> # error catcher
 ```
 
-Your new `traefik` instance will detect that a new app is coming up and generate SSL certificates for it. You can see what `traefik` is up to using the same commands above but replacing `<netcloud-domain>` with the `<traefik-domain>` you chose earlier (`abra app ls` will remind you what domains you chose :grinning:).
+Your new `traefik` instance will detect that a new app is coming up and generate TLS certificates for it. You can see what `traefik` is up to using the same commands above but replacing `<nextcloud-domain>` with the `<traefik-domain>` you chose earlier (`abra app ls` will remind you what domains you chose :grinning:).
 
 ### Upgrade Nextcloud
 
@@ -264,35 +271,6 @@ To upgrade an app manually to the newest available version run:
 abra app upgrade <nextcloud-domain>
 ```
 
-### Automatic Upgrades
-
-`kadabra` the auto-updater is still under development, use it with care and don't use it in production environments. To setup the auto-updater copy the `kadabra` binary to the server and configure a cronjob for regular app upgrades. The following script will configure ssmtp for email notifications and setup a cronjob. This cronjob checks daily for new app versions, notifies if any kind of update is available and upgrades all apps to the latest patch/minor version.
-
-
-```bash
-apt install ssmtp
-
-cat > /etc/ssmtp/ssmtp.conf << EOF
-mailhub=$MAIL_SERVER:587
-hostname=$MAIL_DOMAIN
-AuthUser=$USER
-AuthPass=$PASSWORD
-FromLineOverride=yes
-UseSTARTTLS=yes
-EOF
-
-cat > /etc/cron.d/abra_updater << EOF
-MAILTO=admin@example.com
-MAILFROM=noreply@example.com
-
-0  6 * * *       root    ~/kadabra notify --major
-30 4 * * *       root    ~/kadabra upgrade --all
-EOF
-
-```
-
-Add `ENABLE_AUTO_UPDATE=true` to the env config (`abra app config <app name>`) to enable the auto-updater for a specific app.
-
 ## Finishing up
 
 Hopefully you got something running! Well done! The [operators handbook](/operators/handbook) would probably be the next place to go check out if you're looking for more help. Especially on topics of ongoing maintenance.

mkdocs.yml

@@ -88,6 +88,7 @@ nav:
       - "Finance": federation/finance.md
       - "Membership": federation/membership.md
       - "Code of Co-operation": federation/code-of-coop.md
+      - "Shared Infrastructure Inventory": federation/infra.md
       - "Proposals":
         - federation/proposals/index.md
         - federation/proposals/federation.md
@@ -124,12 +125,13 @@ nav:
               - federation/resolutions/passed/029.md
               - federation/resolutions/passed/032.md
               - federation/resolutions/passed/031.md
+              - federation/resolutions/passed/033.md
           - "Stalled":
               - federation/resolutions/stalled/013.md
               - federation/resolutions/stalled/030.md
           - "In Progress":
               - federation/resolutions/index.md
-              - federation/resolutions/in-progress/033.md
+              - federation/resolutions/in-progress/034.md
       - "Minutes":
           - federation/minutes/index.md
           - "Recently":