Petrolyst server infrastructure: Traefik, Trino and Superset

Traefik as the server-wide edge (TLS via Let's Encrypt, dashboard on
traefik.petrolyst.com behind oauth2-proxy and Keycloak). The
fuel-monitoring stack: Superset on atoma.petrolyst.com with Keycloak login
and Petrolyst branding, Trino reading the TimescaleDB fuel-db as catalog
"fuel". Customization lives in petrolyst-insights/, deployment in the other
folders.

Deploys run server-side (deploy/deploy.sh) from a Gitea workflow or
manually; releases are immutable, Superset metadata is backed up before
migrations, and deploy/rollback.sh restores it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

stacks/fuel-monitoring/trino/etc/access-control.properties

@@ -0,0 +1,3 @@
+# Analytics never writes through Trino. fuel-db's trino_ro role is read-only as
+# well; this is the second lock.
+access-control.name=read-only

stacks/fuel-monitoring/trino/etc/catalog/fuel.properties

@@ -0,0 +1,5 @@
+# The fuel-monitoring operational store (service fuel-db), read-only.
+connector.name=postgresql
+connection-url=jdbc:postgresql://fuel-db:5432/fuel
+connection-user=trino_ro
+connection-password=${ENV:FUEL_DB_TRINO_PASSWORD}

stacks/fuel-monitoring/trino/etc/config.properties

@@ -0,0 +1,14 @@
+# Single node: coordinator and worker in one process. Reachable only on the
+# backend network (Superset); no port is published and Traefik has no route.
+coordinator=true
+node-scheduler.include-coordinator=true
+http-server.http.port=8080
+discovery.uri=http://localhost:8080
+catalog.management=static
+
+# Memory bounds. The container is capped at 3g (compose.yaml) and jvm.config
+# gives the heap 75 % of it (~2.25 GB); 1 GB for queries plus 512 MB headroom
+# leaves room for the rest of the heap.
+query.max-memory=1GB
+query.max-memory-per-node=1GB
+memory.heap-headroom-per-node=512MB

stacks/fuel-monitoring/trino/etc/jvm.config

@@ -0,0 +1,14 @@
+-server
+-agentpath:/usr/lib/trino/bin/libjvmkill.so
+-XX:InitialRAMPercentage=75
+-XX:MaxRAMPercentage=75
+-XX:G1HeapRegionSize=32M
+-XX:+ExplicitGCInvokesConcurrent
+-XX:+HeapDumpOnOutOfMemoryError
+-XX:+ExitOnOutOfMemoryError
+-XX:-OmitStackTraceInFastThrow
+-XX:ReservedCodeCacheSize=256M
+-XX:PerMethodRecompilationCutoff=10000
+-XX:PerBytecodeRecompilationCutoff=10000
+-Djdk.attach.allowAttachSelf=true
+-Djdk.nio.maxCachedBufferSize=2000000

stacks/fuel-monitoring/trino/etc/log.properties

@@ -0,0 +1 @@
+io.trino=INFO

stacks/fuel-monitoring/trino/etc/node.properties

@@ -0,0 +1,3 @@
+node.environment=petrolyst
+node.data-dir=/data/trino
+node.id=${ENV:HOSTNAME}