Cozy: new service

[jackspiering]

Description

Adds Cozy (now Twake Workplace) as a new service: cozy-stack with a CouchDB database.

cozy-stack serves every app on its own host name (<instance>-<app>.<domain> in the flat layout), and Tailscale Serve publishes one name per device. The stack therefore runs one extra Tailscale sidecar per app (home, settings, drive) next to the main one. They forward to cozy-stack in the network of the main sidecar, and Serve keeps the Host header, which cozy-stack uses to pick the app. The README lists this and the other differences under "Deviations from the standard setup", and explains how to add another app.

Related Issues

• Closes New Service: Twake (new name for Cozy Cloud) #153

Verification

Run from a scratch copy outside the repository, with a reusable test key and a marked SERVICE:

• Compose validation with dummy values for the required variables: exit 0, no warnings. Both Serve configurations are valid JSON.
• rumdl 0.2.78 (the version linting.yml pins) on the whole repository: no issues. git diff --check origin/main: clean.
• All four Tailscale containers joined the Tailnet and reported healthy. The application (curl /status) and CouchDB (curl /_up) health commands were run with docker exec and succeeded.
• Serve, from inside each device's namespace with --resolve: the root device returns 200 on /status, and the home, settings, and drive devices each reach cozy-stack with their own certificate (302 to the instance). The Host header reaches cozy-stack unchanged.
• The command from "First run" created the instance. The registration link redirects to /auth/passphrase on the root host.
• Main function through Serve: after setting a passphrase, a file was created with the files API and read back (201, then 200).
• cozy-stack apps install notes from "Configuration" installed the app.
• Persistence: docker compose down and up -d without -v. The file was still readable, and the admin passphrase was not generated again.
• A copied tailscale-notes block passes docker compose config.

Not tested:

• Browser login and onboarding. This host has no path from a browser to the test nodes, so the registration page was only checked for its redirect.
• Starting a sidecar for another app (the notes block only passed docker compose config).
• Mail, which is not configured.

Checklist

• I have performed a self-review of my code and followed the templates structure.
• I have added verification that the stack works as expected.
• I have updated necessary documentation (e.g. frontpage README.md ).
• I ran Compose validation with dummy values for required variables.
• I ran rumdl on the whole repository.
• I committed no working credential.

Additional Context

• The stack starts four Tailnet devices, so it needs a reusable auth key. Each device without state also registers an ACME account, and Let's Encrypt allows 10 new registrations per IP address every 3 hours. The README troubleshooting section covers this, and the devices work once the limit passes.
• SERVICE must not contain a hyphen, because cozy-stack joins the instance and app names with one. The README and .env say so.
• The image uses cozy/cozy-stack:latest, as upstream's own Compose file does, and CouchDB is pinned to 3.3.