Model the build on mozimo and target emily

- Makefile: PLATFORMS, tags :<commit> and :main, build-check with --pull.
- deploy.sh: push, guards, git pull --ff-only, optional --prune, image_tag.
- Replace .containerignore with .dockerignore.
- Add the opt-in image prune to the hops role.
- Tag the Caddyfile task so --skip-tags caddy works before DNS cutover.
- Trim comments and rewrite build and deploy text in plain prose.

ansible/vars/default.yml

@@ -1,67 +1,47 @@
 ---
-# ---------------------------------------------------------------------------
-# Rootless Podman / Quadlet
-# ---------------------------------------------------------------------------
-# Derived from the connection: this play carries no become, so the Quadlet
-# units belong to whoever Ansible connects as. Requires gather_facts (set in
-# playbook.yml). A host that has already run caddy/playbook.yml from the
-# ansible-playbooks repo has the rootless prerequisites.
+# Rootless Podman and Quadlet on emily. The play runs as the connecting user,
+# so these paths follow that user's home.
 podman_user: "{{ ansible_facts['user_id'] }}"
 podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
 quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"
 
-# ---------------------------------------------------------------------------
-# Image
-# ---------------------------------------------------------------------------
 registry: registry.tanshu.com
 registry_username: ta-registry
 registry_password: ff28a01f00c0f39315d94cd9dcb1e554968dba25676a8ea5f2be34e96a9a099f
 
 image_name: "{{ registry }}/hops"
-tag: latest
-# deploy.sh passes -e image_tag=<commit>; `tag` is the fallback when running the
-# play by hand. Rollback = -e image_tag=<older-commit>.
+# deploy.sh passes image_tag=<commit>. Rollback uses an older commit.
+tag: main
 image: "{{ image_name }}:{{ image_tag | default(tag) }}"
 
-# ---------------------------------------------------------------------------
-# Hops n Grains
-# ---------------------------------------------------------------------------
 app_name: hops
 container_name: "{{ app_name }}"
 unit_name: "{{ container_name }}.service"
 
-# The Quadlet file is <network_name>.network; roles/register pins the Podman
-# network name to <network_name>_net.
+# The register role pins NetworkName to hops_net.
 network_name: "{{ app_name }}"
 
 host_directory: "{{ podman_data_dir }}/{{ container_name }}"
 
-# Ports inside the container. Caddy proxies to them over hops_net; nothing is
-# published on the host.
+# Caddy reaches both ports over hops_net. Nothing is published on the host.
 site_port: 3000
 pb_port: 8090
 
-# The Dockerfile's HEALTHCHECK is dropped when podman builds an OCI image (its
-# default), so the same check is declared on the Quadlet unit and the play gates
-# on `podman healthcheck run`. curl is in the runner image.
+# podman builds OCI images by default and drops the Dockerfile HEALTHCHECK,
+# so the unit declares the check and the play gates on it.
 health_cmd: "curl -fsS http://127.0.0.1:{{ pb_port }}/api/health > /dev/null && curl -fsS http://127.0.0.1:{{ site_port }} > /dev/null"
 
-# Public hosts for frontend & PocketBase routing.
 host: www.hopsngrains.com
 apex_host: hopsngrains.com
 admin_host: admin.hopsngrains.com
 
-# ---------------------------------------------------------------------------
-# Shared Caddy unit (caddy/playbook.yml in the ansible-playbooks repo)
-# ---------------------------------------------------------------------------
 caddy_name: caddy
 caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"
 
-# Appended to the shared Caddyfile by roles/caddy. The sites are served from
-# the container name over hops_net; no host ports are involved.
+# Appended to the shared Caddyfile by roles/caddy.
 snippet_block: |
   {{ host }}{% if apex_host is defined and apex_host %}, {{ apex_host }}{% endif %} {
-      # PocketBase Admin UI and REST API
+      # PocketBase admin UI and REST API
       redir /_ /_/
       handle /_/* {
           reverse_proxy {{ container_name }}:{{ pb_port }}
@@ -70,7 +50,7 @@ snippet_block: |
           reverse_proxy {{ container_name }}:{{ pb_port }}
       }
 
-      # TanStack Start frontend application
+      # TanStack Start frontend
       handle {
           reverse_proxy {{ container_name }}:{{ site_port }}
       }
@@ -82,8 +62,6 @@ snippet_block: |
   }
   {% endif %}
 
-# ---------------------------------------------------------------------------
-# PocketBase initial superuser credentials (bootstrapped on first start)
-# ---------------------------------------------------------------------------
+# Bootstrapped on first start.
 pb_admin_email: admin@hopsngrains.com
 pb_admin_password: HopsPassword1234!