Provision + harden the new self-host GPU host's base Docker/compose environment

[JSONbored]

Part of #4325.

Context

The new host needs the same base runtime the current deployment already documents — Docker + Compose, the repo checked out at a known ref, .env populated from .env.selfhost.example/.env.example, and the profiles this deployment actually uses activated (postgres, qdrant, visual-review, rees, observability, tailscale — see docker-compose.yml's profile list). This issue is the base environment only; data migration, secrets, and GPU wiring are separate sub-issues.

Requirements

• Docker + Compose installed, matching the versions the current host runs (or newer within the same major line).
• Repo cloned at a pinned commit/tag (not a moving main checkout) so the two hosts run identical code during the parallel-run window.
• .env populated with every NON-secret operational setting matching the current deployment (concurrency knobs, retention windows, feature flags) — secrets themselves are explicitly out of scope here.
• Firewall: only the ports this deployment's compose file actually needs to expose publicly are open (the app's own HTTP port and, if used, the caddy profile's 80/443) — every in-network-only service (Postgres, Redis, Qdrant, browserless, REES) stays unreachable from outside the host's Docker network, matching the current deployment's posture.
• Host clock: at least two independent NTP sources configured (see docker-compose.yml's own "HOST CLOCK" comment on why a single source is insufficient — GitHub App JWT auth fails silently once drift exceeds the 60s skew tolerance).

Deliverables

• Docker/Compose installed and verified (docker compose version)
• Repo cloned at a pinned ref; profiles enabled match the current deployment's set
• .env populated with non-secret settings; diffed against the current host's .env (secrets redacted) to confirm parity
• Firewall rules confirmed: an external scan shows only the intended public port(s) open
• NTP dual-sourced and verified converged

Expected outcome

A running-but-empty instance of the full stack on the new host, healthy per scripts/selfhost-post-update-check.sh, with no data, no secrets, and no live traffic yet — ready for the sub-issues that populate it.

Effort

M

[linear-code]

JSO-3302

[JSONbored]

Verified live via direct inspection of edge-nl-01 (2026-07-09):

• Docker Compose v5.3.1 running; all expected profile services up and healthy (postgres, qdrant, rees, browserless visual-review, the full observability stack, tailscale networking).
• Repo checked out at a pinned ref (d329591c, 2026-07-08) — not a moving main checkout, as required.
• NTP dual-sourced and converged (chronyc sources: 2 independent stratum-1/2 sources).
• Firewall: only port 22 listens on a public interface; the app's own port (8787) is bound to loopback only, and no Tailscale Funnel/Serve is configured — tighter than the minimum bar this issue asked for (no public app port at all, not just a minimized one).
• /ready reports all-green: db, migrations, ai_provider, redis, qdrant all true.

Closing as done. One thing worth tracking separately (not a blocker for this issue): the pinned ref is now 154 commits behind main with no auto-update mechanism found on the host — worth a deliberate decision on when/how this resumes normal update cadence now that cutover has happened.