Switch customer stack to Gitea + PostgreSQL two-service pattern

- web: Gitea (self-hosted Git), exposed via Traefik behind Authelia
- db: PostgreSQL 16, internal backend network only, never exposed
- Establishes the canonical web+db template structure for future products

Made-with: Cursor

docker/ss-atlas/internal/handlers/dashboard.go

@@ -38,14 +38,6 @@ func (a *App) handleDashboard(w http.ResponseWriter, r *http.Request) {
 		if err != nil {
 			log.Printf("dashboard: stack check failed for %s: %v", remoteUser, err)
 		}
-		if !exists {
-			log.Printf("dashboard: deploying missing stack %s", stackName)
-			if err := a.swarm.DeployStack(stackName, remoteUser, a.cfg.TraefikDomain); err != nil {
-				log.Printf("dashboard: stack deploy failed for %s: %v", remoteUser, err)
-			} else {
-				exists = true
-			}
-		}
 		stackDeployed = exists
 		if exists {
 			replicas, _ := a.swarm.GetWebReplicas(stackName)

docker/ss-atlas/templates/pages/dashboard.html

@@ -173,36 +173,36 @@
       {{if .StackRunning}}
       <p style="color: var(--muted); font-size: 0.9rem; margin-top: 0.75rem;">Your dedicated environment is accessible at:</p>
       <a class="stack-link" href="https://{{.User}}.{{.Domain}}">{{.User}}.{{.Domain}}</a>
-      {{else if not .StackDeployed}}
+      {{else if and .StackDeployed (not .StackRunning)}}
-      <p style="color: var(--muted); font-size: 0.9rem; margin-top: 0.75rem;">Your stack is being provisioned. Refresh this page in a moment.</p>
+      <p style="color: var(--muted); font-size: 0.9rem; margin-top: 0.75rem;">Your stack is stopped. Start it to access your environment.</p>
       {{end}}
 
-      {{if .StackDeployed}}
       <hr class="divider">
       <div class="actions">
         {{if .StackRunning}}
-        <form method="POST" action="/stack-manage" style="margin:0">
+        <form method="POST" action="/stack-manage" style="margin:0" data-stack-action>
           <input type="hidden" name="action" value="restart">
           <button type="submit" class="btn btn-outline btn-sm">Restart</button>
         </form>
-        <form method="POST" action="/stack-manage" style="margin:0">
+        <form method="POST" action="/stack-manage" style="margin:0" data-stack-action>
           <input type="hidden" name="action" value="stop">
           <button type="submit" class="btn btn-warning btn-sm">Stop</button>
         </form>
         {{else}}
-        <form method="POST" action="/stack-manage" style="margin:0">
+        <form method="POST" action="/stack-manage" style="margin:0" data-stack-action>
           <input type="hidden" name="action" value="start">
           <button type="submit" class="btn btn-sm">Start</button>
         </form>
         {{end}}
-        <form method="POST" action="/stack-manage" style="margin:0"
+        {{if .StackDeployed}}
-              onsubmit="return confirm('Destroy your stack? All containers will be removed. Volumes are preserved.')">
+        <form method="POST" action="/stack-manage" style="margin:0" data-stack-action
+              data-confirm="Destroy your stack? All containers will be removed. Volumes are preserved.">
           <input type="hidden" name="action" value="destroy">
           <button type="submit" class="btn btn-danger btn-sm">Destroy</button>
         </form>
-      </div>
         {{end}}
       </div>
+    </div>
     <div class="card">
       <h2>Manage</h2>
       <div class="actions">
@@ -244,5 +244,18 @@
     {{end}}
   </div>
   <div class="version-badge">{{.Commit}}</div>
+  <script>
+    const pending = { restart:'Restarting…', stop:'Stopping…', start:'Starting…', destroy:'Destroying…' };
+    document.querySelectorAll('form[data-stack-action]').forEach(function(form) {
+      form.addEventListener('submit', function(e) {
+        var msg = form.dataset.confirm;
+        if (msg && !confirm(msg)) { e.preventDefault(); return; }
+        var btn = form.querySelector('button');
+        var action = (form.querySelector('input[name="action"]') || {}).value;
+        btn.disabled = true;
+        btn.textContent = pending[action] || '…';
+      });
+    });
+  </script>
 </body>
 </html>

docker/ss-atlas/templates/stack-template.yml

@@ -1,17 +1,21 @@
 # =============================================================================
-# CUSTOMER STACK TEMPLATE — Uptime Kuma
+# CUSTOMER STACK TEMPLATE — Gitea + PostgreSQL
 # =============================================================================
-# This is the Docker Swarm stack that gets deployed for each paying customer.
+# This is the Docker Swarm stack deployed for each paying customer.
 # It defines what product/service they receive when they subscribe.
 #
-# PRODUCT: Uptime Kuma — a self-hosted uptime/monitoring dashboard.
+# PRODUCT: Gitea — a self-hosted Git service, backed by PostgreSQL.
 # Each customer gets their own isolated instance at their subdomain.
 #
-# To sell a different product, replace the `web` service image and adjust
+# Structure:
-# the port in the Traefik loadbalancer label accordingly.
+#   web  — the application, exposed via Traefik behind Authelia auth
+#   db   — PostgreSQL, internal only (backend network, never exposed)
+#
+# To sell a different product: replace the `web` image, update the port
+# in the Traefik loadbalancer label, and adjust `db` env/image as needed.
 #
 # Template variables (injected at deploy time by swarm/client.go):
-#   {{.ID}}             - customer's username (used for unique resource naming)
+#   {{.ID}}             - customer's username (unique resource naming)
 #   {{.Subdomain}}      - customer's subdomain (same as ID by default)
 #   {{.Domain}}         - base domain (e.g. bc.a250.ca)
 #   {{.TraefikNetwork}} - Traefik overlay network name
@@ -19,16 +23,23 @@
 # Each customer gets their stack at: https://{{.Subdomain}}.{{.Domain}}
 # Access is restricted to the owning user via Authelia forward-auth.
 # =============================================================================
-
-version: "3.8"
-
 services:
   web:
-    image: louislam/uptime-kuma:1
+    image: gitea/gitea:1-rootless
+    environment:
+      GITEA__database__DB_TYPE: postgres
+      GITEA__database__HOST: db:5432
+      GITEA__database__NAME: gitea
+      GITEA__database__USER: gitea
+      GITEA__database__PASSWD: gitea
+      GITEA__server__DOMAIN: "{{.Subdomain}}.{{.Domain}}"
+      GITEA__server__ROOT_URL: "https://{{.Subdomain}}.{{.Domain}}"
+      GITEA__server__HTTP_PORT: "3000"
     volumes:
-      - uptime_data:/app/data
+      - gitea_data:/var/lib/gitea
     networks:
       - traefik_net
+      - backend
     deploy:
       replicas: 1
       labels:
@@ -38,7 +49,22 @@ services:
         traefik.http.routers.customer-{{.ID}}-web.entrypoints: "websecure"
         traefik.http.routers.customer-{{.ID}}-web.tls: "true"
         traefik.http.routers.customer-{{.ID}}-web.middlewares: "authelia-auth@swarm"
-        traefik.http.services.customer-{{.ID}}-web.loadbalancer.server.port: "3001"
+        traefik.http.services.customer-{{.ID}}-web.loadbalancer.server.port: "3000"
+      restart_policy:
+        condition: on-failure
+
+  db:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: gitea
+      POSTGRES_USER: gitea
+      POSTGRES_PASSWORD: gitea
+    volumes:
+      - db_data:/var/lib/postgresql/data
+    networks:
+      - backend
+    deploy:
+      replicas: 1
       restart_policy:
         condition: on-failure
 
@@ -46,7 +72,11 @@ networks:
   traefik_net:
     external: true
     name: "atlas_{{.TraefikNetwork}}"
+  backend:
+    driver: overlay
 
 volumes:
-  uptime_data:
+  gitea_data:
+    driver: local
+  db_data:
     driver: local