Rebuild ansible on the project deploy template

- playbook.yml (hosts: monoco) + vars/default.yml, requirements.yml
- roles: network (shared docker network), greatbear (registry pull,
  bind mount /var/lib/greatbear/pb_data, .env upload, health wait),
  caddy (blockinfile snippet into the shared Caddyfile + docker exec reload)
- image honors PB_DATA_DIR and runs as root to match the bind-mount pattern
- frontend on www.greatbear.in (+apex) with /api/* and /_* proxied to
  PocketBase; admin.greatbear.in redirects to the admin UI

README.md

@@ -36,7 +36,7 @@ scripts/
   run-all.mjs        Container supervisor: PocketBase + site server
   seed.mjs           Idempotent content seeder (create-if-missing by uid)
   create-collections.sh   Dev helper used to build the schema migration
-ansible/             Deployment playbook (roles: app, caddy)
+ansible/             Deployment playbook (roles: network, greatbear, caddy)
 Dockerfile           Multi-stage image build
 deploy.sh            Build & push image to the private registry
 ```
@@ -81,7 +81,7 @@ cd app && npm run dev
 docker build -t greatbear:dev .
 docker run --rm -p 3000:3000 -p 8090:8090 \
   -e PB_SUPERUSER_EMAIL=dev@greatbear.in -e PB_SUPERUSER_PASSWORD=devpass12345 \
-  -v greatbear_dev_data:/data greatbear:dev
+  -v greatbear_dev_data:/app/pb_data greatbear:dev
 ```
 
 ## Deploying
@@ -97,29 +97,32 @@ Tags pushed: `registry.tanshu.com/tanshu/greatbear:latest` and `:<git-sha>`.
 
 ### 2. Deploy with Ansible
 
-Requirements on the controller: `ansible` + `community.docker` collection
-(`ansible-galaxy collection install community.docker`), SSH access to the host.
-
-Requirements on the host (`www.greatbear.in`): Docker and Caddy already installed.
+Requirements on the controller: `ansible` + `community.docker` collection (see
+`ansible/requirements.yml`). Requirements on the host: Docker with a Caddy **container** named
+`caddy` (config at `/var/lib/caddy/conf/Caddyfile`).
 
 ```bash
 cd ansible
-# edit group_vars/greatbear/vars.yml if needed (or encrypt it with ansible-vault)
-ansible-playbook site.yml            # add -i inventory/hosts.yml if not using ansible.cfg
+ansible-galaxy install -r requirements.yml
+ansible-playbook playbook.yml    # targets inventory host `monoco` — edit playbook.yml if needed
 ```
 
-The playbook:
+All deployment variables live in `ansible/vars/default.yml`. The playbook:
 
-1. Logs into the registry on the host, pulls the image, and (re)creates the `greatbear`
-   container with ports bound to loopback (`127.0.0.1:3000`, `127.0.0.1:8090`) and a named
-   volume `greatbear_pb_data:/data` for the database.
-2. Waits for PocketBase + site health checks.
-3. Writes `/etc/caddy/caddy.d/greatbear.conf` with both site blocks and reloads Caddy:
+1. Ensures the `greatbear_net` Docker network exists with the Caddy container attached.
+2. Pulls `registry.tanshu.com/tanshu/greatbear:latest`, uploads `/var/lib/greatbear/.env`,
+   and (re)creates the `greatbear` container on that network with
+   `/var/lib/greatbear/pb_data` bind-mounted to `/app/pb_data`, then waits for its healthcheck.
+3. Inserts a managed snippet into the shared Caddyfile and reloads Caddy via
+   `docker exec`:
 
-   - `www.greatbear.in` → `127.0.0.1:3000` (the site)
-   - `admin.greatbear.in` → `127.0.0.1:8090` (PocketBase API + admin UI)
+   - `www.greatbear.in` (+ apex `greatbear.in`) — frontend on port 3000, PocketBase
+     API/admin proxied under `/api/*` and `/_/*`
+   - `admin.greatbear.in` — redirects to the PocketBase admin UI
 
-DNS records for both domains must point at the host; Caddy obtains TLS certificates
+No host ports are published; Caddy reaches the containers over the Docker network.
+
+DNS records for all three hosts must point at the server; Caddy obtains TLS certificates
 automatically on first request.
 
 ## PocketBase admin
@@ -141,5 +144,6 @@ are never overwritten by redeploys. Schema changes belong in `pb/migrations/`.
 | ----------------------- | ------------------------ | -------------------------------------- |
 | `PORT`                  | `3000`                   | Site server port                       |
 | `PB_URL`                | `http://127.0.0.1:8090`  | PocketBase URL used by the site server |
+| `PB_DATA_DIR`           | `/data`                  | PocketBase data directory (volume)     |
 | `PB_SUPERUSER_EMAIL`    | —                        | Initial admin (bootstrapped at start)  |
 | `PB_SUPERUSER_PASSWORD` | —                        | Initial admin password                 |