jackson2w·jackson2w/claude-code-skills/proxmox-docker-compose-vm/SKILL.md

proxmox-docker-compose-vm

Skill1 starsChanged 9 days agoNo licenceView on GitHub

This skill should be used when deploying an application that only ships via Docker Compose (no native/bare-metal install path — e.g. Immich, and similar multi-container stacks with a custom database extension baked into a maintained image) inside a Proxmox VM, managing its Docker Compose file and secrets as code via Ansible, debugging a Compose service that's unexpectedly reachable on the plain LAN IP instead of only over Tailscale Serve, wiring up a hardware-acceleration `extends:` stanza (hwaccel.yml, OpenVINO/VAAPI image tags) that ships commented-out in the upstream Compose file, or exposing one feature of an otherwise tailnet-only app (e.g. Immich share links) to people outside the tailnet via a purpose-built proxy sidecar + narrow Funnel rather than punching a hole in the app's own API. Also covers verifying an async first-run job (ML indexing, search embedding, etc.) actually processed something rather than just checking container health, and a shared Ansible `file` loop silently drifting a sensitive directory's mode. Trigger phrases include "tailscale serve nftables allowlist not working", "restrict tailnet peers serve", "docker compose in a proxmox vm", "immich docker deployment", "no bare-metal install path", "docker compose ports binds 0.0.0.0", "docker-proxy 0.0.0.0", "ansible deploy docker-compose.yml", "verify smart search indexed", "async job queued but not verified", "second disk for docker volumes proxmox", "hwaccel.yml extends", "immich openvino image tag", "docker compose hardware acceleration", "share immich link outside tailnet", "immich public proxy", "expose one path publicly without exposing the app", "funnel to a proxy not the app".

• Reads credentials