Petrolyst server infrastructure: Traefik, Trino and Superset

Traefik as the server-wide edge (TLS via Let's Encrypt, dashboard on
traefik.petrolyst.com behind oauth2-proxy and Keycloak). The
fuel-monitoring stack: Superset on atoma.petrolyst.com with Keycloak login
and Petrolyst branding, Trino reading the TimescaleDB fuel-db as catalog
"fuel". Customization lives in petrolyst-insights/, deployment in the other
folders.

Deploys run server-side (deploy/deploy.sh) from a Gitea workflow or
manually; releases are immutable, Superset metadata is backed up before
migrations, and deploy/rollback.sh restores it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

stacks/fuel-monitoring/superset/Dockerfile

@@ -0,0 +1,28 @@
+# Petrolyst Superset image. Deployment only: every customization is copied from
+# petrolyst-insights/, which compose.yaml passes as the named build context
+# "insights". deploy/deploy.sh tags the result with a hash of exactly these
+# inputs (this file plus what is copied below), so the tag changes only when
+# the image would.
+FROM apache/superset:6.1.0@sha256:16b50bbef6648912a79e3293d418fefa743ce555d36c5af6b85d859119ed7f88
+
+USER root
+# The 6.1.0 image ships neither an OAuth client nor the Postgres and Trino
+# drivers.
+RUN uv pip install --no-cache --python /app/.venv/bin/python \
+      authlib==1.9.1 psycopg2-binary==2.9.13 "trino[sqlalchemy]==0.340.0"
+
+COPY --from=insights --chown=superset:superset superset_config.py petrolyst_security.py /app/pythonpath/
+COPY --from=insights --chown=superset:superset assets/branding/ /app/superset/static/assets/branding/
+COPY --from=insights patches/ /app/patches/petrolyst/
+# Stop at the first patch or verify that fails, so a later success cannot hide
+# an earlier failure.
+RUN for p in /app/patches/petrolyst/fix_*.py; do \
+      [ -e "$p" ] || continue; \
+      { python3 "$p" && python3 "$p" --verify; } || exit 1; \
+    done
+
+# Deployment, not customization: in the image (and so in the tag) rather than
+# bind-mounted, so a change to it makes deploy.sh run superset-init again.
+COPY init.sh /app/petrolyst-init.sh
+
+USER superset

stacks/fuel-monitoring/superset/init.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# superset-init: migrate the metadata database, sync roles and permissions, and
+# register the Trino connection. It is copied into the Superset image, so a
+# change here changes the image tag; deploy/deploy.sh runs it on a fresh install
+# and whenever that tag changes. Every step is idempotent. Unlike the
+# upstream docker-init.sh it never creates a local admin: users come from
+# Keycloak.
+set -euo pipefail
+
+superset db upgrade
+superset init
+superset set-database-uri \
+  --database_name "Fuel (Trino)" \
+  --uri "trino://superset@trino:8080/fuel"