Fix the Quadlet healthcheck so the deploy gate can pass

podman builds an OCI image by default and drops the Dockerfile's HEALTHCHECK
instruction, so the first deploy failed at "Wait for the container healthcheck
to pass" with "container ... has no defined healthcheck" even though the app was
up and healthy.

- Declare the same check on the greatbear.container unit (HealthCmd plus
  interval, timeout, retries, start period), the convention hops and menu-admin
  already use.
- Flush handlers right after starting, before the gate: the unit template's
  restart handler otherwise runs at the end of the play, so a run that changes
  only the unit would test the stale container.

Mirrors hops 7366596, so the two deployments keep the same shape.

.containerignore

@@ -1,24 +1,40 @@
 # Keep the build context small and secret-free.
 # Read by Podman/Buildah (`.containerignore`) and, as a fallback, Docker.
+#
+# The build is `git archive HEAD`, so untracked files never reach the context
+# anyway; this is belt-and-suspenders for a working-tree build.
 
 # VCS / editor / local state
 .git
 .gitignore
 .containerignore
 .env
+.env.*
 .npm-cache
 .tmp-pb
 .podman
 .vscode
+.idea
 design
 *.zip
 
-# Node artifacts
+# Node artifacts (installed/rebuilt inside the image)
+node_modules
 **/node_modules
 app/.output
+app/.tanstack
 app/.nitro
 app/dist
 
+# PocketBase local data & scratch
+pb_data
+*.db
+*.db-shm
+*.db-wal
+
+# Logs
+*.log
+
 # Ops assets not needed inside the image
 ansible
 Makefile

ansible/roles/greatbear/tasks/main.yaml

@@ -86,6 +86,15 @@
       ansible.builtin.fail:
         msg: "The Great Bear did not start — see the diagnostics above."
 
+# The unit template notifies "Restart The Great Bear", but handlers otherwise
+# run at the very end of the play — after the healthcheck gate below. Flush them
+# here so the gate tests the container that has the current HealthCmd; without
+# this, a run that only changes the unit would check the stale container and
+# fail. On a run where nothing changed, no handler is pending and this is a
+# no-op.
+- name: Apply pending unit changes before verifying
+  ansible.builtin.meta: flush_handlers
+
 # Quadlet honours [Install] WantedBy= when it generates the unit, so
 # `systemctl --user enable` is neither needed nor possible on a generated unit.
 - name: Verify The Great Bear unit is active
@@ -97,8 +106,8 @@
 # `is-active` says the unit is running, not that both processes inside the
 # container are healthy: the entrypoint starts PocketBase, waits for
 # /api/health, upserts the superuser and seeds content before the site server
-# answers. The image ships a HEALTHCHECK covering both; `healthcheck run` forces
-# one now and reports its result instead of waiting out the interval.
+# answers. The unit's HealthCmd covers both; `healthcheck run` forces one now
+# and reports its result instead of waiting out the interval.
 - name: Wait for the container healthcheck to pass
   ansible.builtin.command: "podman healthcheck run {{ container_name }}"
   register: greatbear_health

ansible/roles/greatbear/templates/greatbear.container.j2

@@ -33,9 +33,14 @@ Volume={{ host_directory }}/pb_data:/app/pb_data
 # No PublishPort on purpose: the Docker-era deployment had none either, and
 # Caddy reaches both ports over {{ network_name }}_net.
 
-# The image's own HEALTHCHECK (PocketBase /api/health on {{ pb_port }} and the
-# site on {{ site_port }}) is used as is; the playbook gates on
-# `podman healthcheck run`.
+# podman builds an OCI image by default and drops the Dockerfile's HEALTHCHECK
+# instruction, so the same check is declared here and the play gates on it with
+# `podman healthcheck run`. curl is in the runner image.
+HealthCmd={{ health_cmd }}
+HealthInterval=15s
+HealthTimeout=3s
+HealthRetries=3
+HealthStartPeriod=5s
 
 [Service]
 Restart=always

ansible/vars/default.yml

@@ -41,6 +41,11 @@ host_directory: "{{ podman_data_dir }}/{{ container_name }}"
 site_port: 3000
 pb_port: 8090
 
+# The Dockerfile's HEALTHCHECK is dropped when podman builds an OCI image (its
+# default), so the same check is declared on the Quadlet unit and the play gates
+# on `podman healthcheck run`. curl is in the runner image.
+health_cmd: "curl -fsS http://127.0.0.1:{{ pb_port }}/api/health > /dev/null && curl -fsS http://127.0.0.1:{{ site_port }} > /dev/null"
+
 # Public hosts for frontend & PocketBase routing.
 host: www.greatbear.in
 apex_host: greatbear.in