Run the build on Podman and deploy as a rootless Podman Quadlet

- Makefile: podman build + push instead of docker buildx. build-production
  clones the git remote and builds from it; build-check / build-check-local
  build without pushing. Single-architecture (PLATFORM-overridable) rather
  than a multi-arch manifest.
- deploy.sh: connect as the unprivileged container user; no become.
- ansible: target emily, rootless Podman Quadlet behind the fleet's shared
  Caddy unit (caddy/playbook.yml in ansible-playbooks).
  - register role writes greatbear.network (NetworkName=greatbear_net) and
    the caddy.container.d drop-in that puts Caddy on it.
  - greatbear role: podman login/pull, ~/podman-data/greatbear + .env,
    greatbear.container (UserNS=keep-id:uid=0,gid=0, EnvironmentFile,
    Network, Volume, no published ports), systemctl --user start and a
    podman healthcheck gate, with a diagnostics rescue block.
  - caddy role appends the site blocks to the shared Caddyfile and reloads;
    handlers reload vs. recreate Caddy (a new network drop-in re-creates it).
  - drop the network role, the community.docker requirements and the
    ansible/files/ templates.
- .containerignore replaces .dockerignore (Buildah reads it natively).
- README: Podman build, rootless Quadlet deploy. No data migration step —
  there is no PocketBase state to carry over.

ansible/vars/default.yml

@@ -1,27 +1,82 @@
 ---
+# ---------------------------------------------------------------------------
+# Rootless Podman / Quadlet
+# ---------------------------------------------------------------------------
+# Derived from the connection: this play carries no become, so the Quadlet
+# units belong to whoever Ansible connects as. Requires gather_facts (set in
+# playbook.yml). A host that has already run caddy/playbook.yml from the
+# ansible-playbooks repo has the rootless prerequisites.
+podman_user: "{{ ansible_facts['user_id'] }}"
+podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
+quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"
+
+# ---------------------------------------------------------------------------
+# Image
+# ---------------------------------------------------------------------------
 registry: registry.tanshu.com
-username: ta-registry
-password: ff28a01f00c0f39315d94cd9dcb1e554968dba25676a8ea5f2be34e96a9a099f
+registry_username: ta-registry
+registry_password: ff28a01f00c0f39315d94cd9dcb1e554968dba25676a8ea5f2be34e96a9a099f
 
+image_name: "{{ registry }}/tanshu/greatbear"
 tag: latest
+image: "{{ image_name }}:{{ tag }}"
 
-image_name: "{{ registry }}/tanshu/greatbear:{{ tag }}"
-
+# ---------------------------------------------------------------------------
+# The Great Bear
+# ---------------------------------------------------------------------------
 app_name: greatbear
-host_directory: "{{ app_name }}"
-host_data_path: "/var/lib/{{ host_directory }}"
 container_name: "{{ app_name }}"
-docker_network: "{{ app_name }}_net"
+unit_name: "{{ container_name }}.service"
 
-# Public hosts for frontend & PocketBase routing
+# The Quadlet file is <network_name>.network; roles/register pins the Podman
+# network name to <network_name>_net, the name the Docker-era deployment used.
+network_name: "{{ app_name }}"
+
+host_directory: "{{ podman_data_dir }}/{{ container_name }}"
+
+# Ports inside the container. Caddy proxies to them over greatbear_net; nothing
+# is published on the host.
+site_port: 3000
+pb_port: 8090
+
+# Public hosts for frontend & PocketBase routing.
 host: www.greatbear.in
 apex_host: greatbear.in
 admin_host: admin.greatbear.in
 
-# Caddy configuration
-caddy_container: caddy
-caddy_caddyfile_path: /var/lib/caddy/conf/Caddyfile
+# ---------------------------------------------------------------------------
+# Shared Caddy unit (caddy/playbook.yml in the ansible-playbooks repo)
+# ---------------------------------------------------------------------------
+caddy_name: caddy
+caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"
 
-# PocketBase Initial Superuser Credentials
+# Appended to the shared Caddyfile by roles/caddy. The sites are served from
+# the container name over greatbear_net; no host ports are involved.
+snippet_block: |
+  {{ host }}{% if apex_host is defined and apex_host %}, {{ apex_host }}{% endif %} {
+      # PocketBase Admin UI and REST API
+      redir /_ /_/
+      handle /_/* {
+          reverse_proxy {{ container_name }}:{{ pb_port }}
+      }
+      handle /api/* {
+          reverse_proxy {{ container_name }}:{{ pb_port }}
+      }
+
+      # TanStack Start frontend application
+      handle {
+          reverse_proxy {{ container_name }}:{{ site_port }}
+      }
+  }
+  {% if admin_host is defined and admin_host %}
+  {{ admin_host }} {
+      redir / /_/
+      reverse_proxy {{ container_name }}:{{ pb_port }}
+  }
+  {% endif %}
+
+# ---------------------------------------------------------------------------
+# PocketBase initial superuser credentials (bootstrapped on first start)
+# ---------------------------------------------------------------------------
 pb_admin_email: admin@greatbear.in
 pb_admin_password: GreatBear!Admin2024