ci: keep docker-compose.yml as the controller; move the agent to its own file

Turning ci/jenkins/docker-compose.yml from the controller into the agent meant
that redeploying a Jenkins set up from the old file would replace the
controller with an agent. Keep that file as the controller instead: the same
jenkins service and jenkins_home volume, now on the stock Java 25 image (its
old build context, ci/jenkins/Dockerfile, is the agent image now). The agent
moves to docker-compose.agent.yml. This replaces the previous commit's warning.

ci/jenkins/README.md

@@ -60,38 +60,27 @@ Resolve a table for another build locally with `build.py build --dump-cs`.
 
 ### 1. Jenkins itself
 
-Jenkins runs as a Coolify service from a Compose file:
+The controller is `ci/jenkins/docker-compose.yml`: stock Jenkins, no build
+tools. On Coolify, deploy it as a Docker Compose application from this
+repository (base directory `/ci/jenkins`), or paste it into a Compose service.
 
-- **Use the Java 25 image**, e.g. `jenkins/jenkins:latest-jdk25`, or
+- **Java 25.** The file defaults to `jenkins/jenkins:lts-jdk25`; set
-  `2.587-jdk25` to pin. Jenkins supports Java 25 until September 2029, Java 21
+  `JENKINS_IMAGE` to pin a version, e.g. `jenkins/jenkins:2.587-jdk25`.
-  only until September 2027, and Java 17 not at all. Keep the agent on the same
+  Jenkins supports Java 25 until September 2029, Java 21 only until September
-  Java major version; its image defaults to Java 25.
+  2027, and Java 17 not at all. Keep the agent on the same Java major version;
-- **Add `restart: unless-stopped`** to the `jenkins` service. A restart from
+  its image defaults to Java 25.
-  the Jenkins UI exits the container with code 5 and relies on Docker to
+- **`restart: unless-stopped`** is in the file: a restart from the Jenkins UI
-  start it again. Without a restart policy it stays stopped.
+  exits the container with code 5 and relies on Docker to start it again.
 - **Turn on "Connect to predefined network"** (Advanced) so the agent can
-  reach Jenkins by its container name, `jenkins-<service uuid>`.
+  reach Jenkins by its container name, `jenkins-<uuid>`.
 - **Run no builds on it:** **Manage Jenkins → Nodes → Built-In Node →
   Configure**, set **Number of executors** to `0`.
 
-#### Upgrading from the old setup
+Earlier versions of this file built the controller from `ci/jenkins/Dockerfile`,
-
+which is now the agent's image. The service and data volume keep their names,
-`ci/jenkins/docker-compose.yml` used to define the Jenkins **controller**
+so an existing Jenkins deployed from this file keeps its jobs and credentials
-(its `jenkins` service, built from `ci/jenkins/Dockerfile`, with the
+when redeployed; it switches to the stock image, and its builds wait until
-`jenkins_home` volume). It now defines only the build agent. If your Jenkins
+the agent (step 3) is connected.
-was deployed from that file, **don't redeploy that application** from this
-version: it would replace the controller with an agent, and Jenkins stops
-until you rebuild it. The data volume survives, but nothing serves it.
-
-Instead:
-
-1. Create a new service for the controller as above, on the stock Java 25
-   image, mounting the **same** data volume: reference the old volume by its
-   full name and mark it `external: true`, or Jenkins starts empty.
-2. Stop the old application, start the new service, and check that your jobs
-   and credentials are there.
-3. Deploy the agent (step 3) as a **new** application, then delete the old
-   one without deleting its volume.
 
 ### 2. The agent node
 
@@ -111,7 +100,7 @@ Save, open the node, and copy its **secret**.
 
 1. **Create a Docker Compose application** from this repository: build pack
    Docker Compose, base directory **`/ci/jenkins`**, compose location
-   `/docker-compose.yml`. The base directory is the build context, so with
+   **`/docker-compose.agent.yml`**. The base directory is the build context, so with
    `/` the build would pick up the server's `Dockerfile` at the repo root. It
    needs no domain. Under Advanced, turn on **Connect to predefined network**.
 2. **Set its environment:**

ci/jenkins/docker-compose.agent.yml

@@ -0,0 +1,34 @@
+# DorkNet build agent on Coolify. Deploy as its own Docker Compose application
+# from this repository with base directory /ci/jenkins, compose location
+# /docker-compose.agent.yml and "Connect to predefined network" on. It needs no
+# domain: it dials out to Jenkins over WebSocket on Docker's internal network.
+# Set the variables in the resource's Environment Variables; see
+# ci/jenkins/README.md. The controller is docker-compose.yml.
+services:
+  agent:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    environment:
+      # Jenkins as seen from inside Docker (e.g. http://<jenkins container
+      # name>:8080), not the public URL, which is behind Cloudflare Access.
+      # Both are needed at runtime only; keep them out of the image build so
+      # the node secret never reaches a build argument.
+      JENKINS_URL: ${JENKINS_URL}
+      JENKINS_AGENT_NAME: ${JENKINS_AGENT_NAME:-dorknet-builder}
+      JENKINS_SECRET: ${JENKINS_SECRET}
+      JENKINS_WEB_SOCKET: "true"
+      JENKINS_AGENT_WORKDIR: /home/jenkins/agent
+      # Where the stock builds live in the archive (restic repository folders
+      # on the FTP, plain text). Overridable per run.
+      ARCHIVE_PC_REPO: ${ARCHIVE_PC_REPO:-}
+      ARCHIVE_QUEST_REPO: ${ARCHIVE_QUEST_REPO:-}
+      ARCHIVE_FTP_TLS: ${ARCHIVE_FTP_TLS:-explicit}
+    volumes:
+      - dorknet_cache:/home/jenkins/dorknet-cache
+      - agent_work:/home/jenkins/agent
+
+volumes:
+  dorknet_cache:
+  agent_work:

ci/jenkins/docker-compose.yml

@@ -1,39 +1,25 @@
-# DorkNet build agent on Coolify. Deploy as a Docker Compose application from
+# The Jenkins controller: stock Jenkins on Java 25. It runs no builds; the
-# this repository with base directory /ci/jenkins, compose location
+# client builds run on the agent (docker-compose.agent.yml). On Coolify,
-# /docker-compose.yml and "Connect to predefined network" on. It needs no domain: it dials out to
+# deploy it as a Docker Compose application from this repository (base
-# Jenkins over WebSocket on Docker's internal network. Set the variables in
+# directory /ci/jenkins) or paste it into a Compose service, with "Connect to
-# the resource's Environment Variables; see ci/jenkins/README.md.
+# predefined network" on so the agent can reach it. See ci/jenkins/README.md.
 #
-# This file used to define the Jenkins controller itself. If your Jenkins was
+# Earlier versions of this file built the controller from ci/jenkins/Dockerfile,
-# deployed from it, don't redeploy that application from this version: it
+# which is now the agent's image. The service name and data volume are the
-# would replace the controller with an agent. Move the controller to its own
+# same, so redeploying an existing Jenkins from this file keeps its jobs and
-# service first and deploy this as a NEW application (README: "Upgrading from
+# credentials; its builds then wait for the agent.
-# the old setup").
 services:
-  agent:
+  jenkins:
-    build:
+    # Pin a version with e.g. jenkins/jenkins:2.587-jdk25. Keep the agent on
-      context: .
+    # the same Java major version (its image defaults to Java 25).
-      dockerfile: Dockerfile
+    image: ${JENKINS_IMAGE:-jenkins/jenkins:lts-jdk25}
+    # A restart from the Jenkins UI exits with code 5 and relies on Docker to
+    # start it again.
     restart: unless-stopped
-    environment:
+    expose:
-      # Jenkins as seen from inside Docker (e.g. http://<jenkins container
+      - "8080"
-      # name>:8080), not the public URL, which is behind Cloudflare Access.
-      # Both are needed at runtime only; keep them out of the image build so
-      # the node secret never reaches a build argument.
-      JENKINS_URL: ${JENKINS_URL}
-      JENKINS_AGENT_NAME: ${JENKINS_AGENT_NAME:-dorknet-builder}
-      JENKINS_SECRET: ${JENKINS_SECRET}
-      JENKINS_WEB_SOCKET: "true"
-      JENKINS_AGENT_WORKDIR: /home/jenkins/agent
-      # Where the stock builds live in the archive (restic repository folders
-      # on the FTP, plain text). Overridable per run.
-      ARCHIVE_PC_REPO: ${ARCHIVE_PC_REPO:-}
-      ARCHIVE_QUEST_REPO: ${ARCHIVE_QUEST_REPO:-}
-      ARCHIVE_FTP_TLS: ${ARCHIVE_FTP_TLS:-explicit}
     volumes:
-      - dorknet_cache:/home/jenkins/dorknet-cache
+      - jenkins_home:/var/jenkins_home
-      - agent_work:/home/jenkins/agent
 
 volumes:
-  dorknet_cache:
+  jenkins_home:
-  agent_work: