deploy.sh no longer needs a manual push before it, and no made-up tag:
- It pushes the current branch, refuses a dirty tracked tree, and requires
HEAD == origin/main before anything is built, so the image can only be
built for a commit the remote actually has. --force and --no-push skip the
guards.
- The image is tagged :<commit> as well as :latest, and ansible takes
-e image_tag=<commit>, so a deploy pins the exact revision; rollback is the
same play with an older commit.
- Makefile builds `git archive HEAD` instead of cloning the remote (the push
guard makes the local commit the remote state) and defaults PLATFORM to
linux/arm64, because emily is aarch64 — the same default mozimo uses. Drop
build-check-local; build-check already builds the committed tree.
- Makefile: podman build + push instead of docker buildx. build-production
clones the git remote and builds from it; build-check / build-check-local
build without pushing. Single-architecture (PLATFORM-overridable) rather
than a multi-arch manifest.
- deploy.sh: connect as the unprivileged container user; no become.
- ansible: target emily, rootless Podman Quadlet behind the fleet's shared
Caddy unit (caddy/playbook.yml in ansible-playbooks).
- register role writes greatbear.network (NetworkName=greatbear_net) and
the caddy.container.d drop-in that puts Caddy on it.
- greatbear role: podman login/pull, ~/podman-data/greatbear + .env,
greatbear.container (UserNS=keep-id:uid=0,gid=0, EnvironmentFile,
Network, Volume, no published ports), systemctl --user start and a
podman healthcheck gate, with a diagnostics rescue block.
- caddy role appends the site blocks to the shared Caddyfile and reloads;
handlers reload vs. recreate Caddy (a new network drop-in re-creates it).
- drop the network role, the community.docker requirements and the
ansible/files/ templates.
- .containerignore replaces .dockerignore (Buildah reads it natively).
- README: Podman build, rootless Quadlet deploy. No data migration step —
there is no PocketBase state to carry over.
tanshu