Build with Podman and deploy as a rootless Quadlet on emily

- Makefile: podman build/push from the committed tree (git archive HEAD),
  tagged :<commit> + :latest; PLATFORM defaults to linux/arm64 for emily.
- deploy.sh: push the commit first, refuse a dirty tracked tree or
  HEAD != origin/main, then build and deploy that exact commit via
  -e image_tag (rollback = an older commit).
- ansible: target emily with no become. The register role writes hops.network
  (NetworkName=hops_net) plus the caddy.container.d drop-in; the hops role
  installs ~/podman-data/hops and hops.container under systemctl --user with a
  podman healthcheck gate; the caddy role appends the site blocks to the shared
  Caddyfile and reloads.
- Drop the Docker-era network role, community.docker requirements,
  ansible/files templates and docker-compose.yml.
- .containerignore replaces .dockerignore.
- README: Podman build, rootless Quadlet deploy on emily.

ansible/vars/default.yml

@@ -1,28 +1,84 @@
 ---
+# ---------------------------------------------------------------------------
+# Rootless Podman / Quadlet
+# ---------------------------------------------------------------------------
+# Derived from the connection: this play carries no become, so the Quadlet
+# units belong to whoever Ansible connects as. Requires gather_facts (set in
+# playbook.yml). A host that has already run caddy/playbook.yml from the
+# ansible-playbooks repo has the rootless prerequisites.
+podman_user: "{{ ansible_facts['user_id'] }}"
+podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
+quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"
+
+# ---------------------------------------------------------------------------
+# Image
+# ---------------------------------------------------------------------------
 registry: registry.tanshu.com
-username: ta-registry
-password: ff28a01f00c0f39315d94cd9dcb1e554968dba25676a8ea5f2be34e96a9a099f
+registry_username: ta-registry
+registry_password: ff28a01f00c0f39315d94cd9dcb1e554968dba25676a8ea5f2be34e96a9a099f
 
-title: hops
+image_name: "{{ registry }}/hops"
 tag: latest
+# deploy.sh passes -e image_tag=<commit>; `tag` is the fallback when running the
+# play by hand. Rollback = -e image_tag=<older-commit>.
+image: "{{ image_name }}:{{ image_tag | default(tag) }}"
 
-image_name: "{{ registry }}/hops:{{ tag }}"
-
+# ---------------------------------------------------------------------------
+# Hops n Grains
+# ---------------------------------------------------------------------------
 app_name: hops
-host_directory: "{{ app_name }}"
-host_data_path: "/var/lib/{{ host_directory }}"
 container_name: "{{ app_name }}"
-docker_network: "{{ app_name }}_net"
+unit_name: "{{ container_name }}.service"
 
-# Public host for frontend & PocketBase routing
+# The Quadlet file is <network_name>.network; roles/register pins the Podman
+# network name to <network_name>_net.
+network_name: "{{ app_name }}"
+
+host_directory: "{{ podman_data_dir }}/{{ container_name }}"
+
+# Ports inside the container. Caddy proxies to them over hops_net; nothing is
+# published on the host.
+site_port: 3000
+pb_port: 8090
+
+# Public hosts for frontend & PocketBase routing.
 host: www.hopsngrains.com
 apex_host: hopsngrains.com
 admin_host: admin.hopsngrains.com
 
-# Caddy configuration
-caddy_container: caddy
-caddy_caddyfile_path: /var/lib/caddy/conf/Caddyfile
+# ---------------------------------------------------------------------------
+# Shared Caddy unit (caddy/playbook.yml in the ansible-playbooks repo)
+# ---------------------------------------------------------------------------
+caddy_name: caddy
+caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"
 
-# PocketBase Initial Superuser Credentials
+# Appended to the shared Caddyfile by roles/caddy. The sites are served from
+# the container name over hops_net; no host ports are involved.
+snippet_block: |
+  {{ host }}{% if apex_host is defined and apex_host %}, {{ apex_host }}{% endif %} {
+      # PocketBase Admin UI and REST API
+      redir /_ /_/
+      handle /_/* {
+          reverse_proxy {{ container_name }}:{{ pb_port }}
+      }
+      handle /api/* {
+          reverse_proxy {{ container_name }}:{{ pb_port }}
+      }
+
+      # TanStack Start frontend application
+      handle {
+          reverse_proxy {{ container_name }}:{{ site_port }}
+      }
+  }
+  {% if admin_host is defined and admin_host %}
+  {{ admin_host }} {
+      redir / /_/
+      reverse_proxy {{ container_name }}:{{ pb_port }}
+  }
+  {% endif %}
+
+# ---------------------------------------------------------------------------
+# PocketBase initial superuser credentials (bootstrapped on first start)
+# ---------------------------------------------------------------------------
 pb_admin_email: admin@hopsngrains.com
 pb_admin_password: HopsPassword1234!