Replace bespoke hosting growth with connected services

[moritzbrantner]

Summary

Make a connected-services architecture the canonical path for new server-setup installations instead of continuing to grow the custom deployment platform.

Service boundary

• Dokploy: Git deployments, build/runtime environment, auto-deploy webhooks, Traefik, TLS, logs, deployment history, rollback
• Uptime Kuma: uptime monitoring and status pages
• Beszel: host/container telemetry, with optional local agent
• DNSControl: declarative Porkbun/Namecheap DNS
• existing host-native hardening script: UFW, fail2ban, unattended upgrades, opt-in SSH hardening

Implementation

• adds top-level setup.sh as the canonical installer/integrator
• adds services/compose.yml and optional Dokploy Traefik overlay
• keeps operations dashboards bound to localhost unless explicitly published through Traefik
• adds DNSControl provider templates while gitignoring real credentials
• prevents the Dokploy installer from being run over an unrelated active Docker Swarm
• adds a read-only same-server cut-over preflight that inventories legacy apps, units, and occupied ports
• requires --replace-legacy plus --confirm-legacy-cutover-ready before stopping the old nginx/webhook/status units
• downloads a pinned Dokploy release before downtime, verifies ports 80/443/3000 afterward, and attempts legacy-unit rollback on installation failure
• disables legacy units only after the Dokploy edge is ready
• documents Docker/UFW interaction and Dokploy's recommended post-bootstrap port-3000 lockdown
• keeps the previous Python/systemd/nginx deployment engine as migration/compatibility code rather than deleting it in this change

Validation

• adds shell syntax/help, cut-over preflight, acknowledgement, pinned-installer, and rollback-contract validation for setup.sh
• validates both base and public-overlay Compose models in CI
• preserves the existing repository test suite
• locally verified bash -n, read-only preflight, fail-closed missing acknowledgement, and successful confirmed dry-run

Scope

This intentionally does not automate migration of existing server.conf applications into Dokploy. A same-server transition requires a maintenance window because both edges need ports 80/443. The preflight and rollback contract protect the initial edge replacement; application/data migration and any later rollback remain explicit operator work.

PR #25's provider-specific DNS UI/CLI, host runtime bootstrap, and further bespoke deployment growth are superseded. Its registry collision validation is the only candidate for a later, narrowly scoped legacy-safety change; it is not mixed into this architecture PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9ff20b130d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[moritzbrantner]

Final verification before merge:

• architecture boundary reviewed: Dokploy owns deployment/runtime/edge/TLS, Uptime Kuma owns uptime/status, Beszel owns telemetry, and DNSControl owns declarative DNS; the Python/systemd/nginx stack is compatibility-only
• same-server cut-over now has a read-only inventory, explicit readiness acknowledgement, pinned Dokploy v0.30.2 download before downtime, readiness checks on ports 80/443/3000, best-effort restoration of previously active legacy units on failure, and post-readiness legacy disablement
• bash -n passed for setup.sh and tests/test_service_stack.sh
• ShellCheck 0.10.0 passed for both changed shell files
• Docker Compose 5.5.0 validated the base and public-overlay models
• preflight, missing-acknowledgement failure, and confirmed non-mutating dry-run behavior passed locally
• the DNSControl review was resolved against the current official Porkbun contract (api_key / secret_key)
• GitHub reports the PR mergeable with all review threads resolved; no Actions workflow run or commit status is attached to the head, so there is no remote CI result to claim