[jackspiering]

Description

Adds Cozy (now Twake Workplace) as a new service: cozy-stack with a CouchDB database.

cozy-stack serves every app on its own host name (<instance>-<app>.<domain> in the flat layout), and Tailscale Serve publishes one name per device. The stack therefore runs one extra Tailscale sidecar per app (home, settings, drive) next to the main one. They forward to cozy-stack in the network of the main sidecar, and Serve keeps the Host header, which cozy-stack uses to pick the app. The README lists this and the other differences under "Deviations from the standard setup", and explains how to add another app.

Related Issues

• Closes New Service: Twake (new name for Cozy Cloud) #153

Verification

• docker compose config --quiet from services/cozy, with dummy values for the required variables: exit 0, no warnings. Both Serve configurations are valid JSON.
• The stack started, Tailscale is healthy, and the service is reachable through the Tailnet. Run from a scratch copy outside the repository, with a reusable test key and a marked SERVICE. All four Tailscale containers joined the Tailnet and reported healthy. Serve was checked from inside each device's namespace with --resolve: the root device returns 200 on /status, and the home, settings, and drive devices each reach cozy-stack with their own certificate (302 to the instance). The Host header reaches cozy-stack unchanged.
• The main function of the service works, and its data survives a restart. The application (curl /status) and CouchDB (curl /_up) health commands were run with docker exec and succeeded. The command from "First run" created the instance, and the registration link redirects to /auth/passphrase on the root host. After setting a passphrase, a file was created with the files API through Serve and read back (201, then 200). cozy-stack apps install notes from "Configuration" installed the app. After docker compose down and up -d without -v, the file was still readable, and the admin passphrase was not generated again.
• rumdl check --config .markdownlint.yml . (0.2.78, the version linting.yml pins) on the whole repository: no issues. git diff --check origin/main: clean.

Not tested:

• Browser login and onboarding. The test host has no path from a browser to the test nodes, so the registration page was only checked for its redirect.
• Starting a sidecar for another app. A copied tailscale-notes block only passed docker compose config.
• Mail, which is not configured.

Impact on existing users

• None. This is a new service.

Checklist

• I have performed a self-review of my code and followed the templates structure.
• I did not commit a working auth key, password, token, or other credential.
• The service README uses the headings of the template, in the same order, and is up to date.
• I added, removed, or renamed the service in the root README.md, in alphabetical order, or this PR does not change the list of services.

Additional Context

• The stack starts four Tailnet devices, so it needs a reusable auth key. Each device without state also registers an ACME account, and Let's Encrypt allows 10 new registrations per IP address every 3 hours. The README troubleshooting section covers this, and the devices work once the limit passes.
• SERVICE must not contain a hyphen, because cozy-stack joins the instance and app names with one. The README and .env say so.
• The image uses cozy/cozy-stack:latest, as upstream's own Compose file does, and CouchDB is pinned to 3.3.