- www host: /_* and /api/* proxy to pocketbase :8090, everything else to
the TanStack app; redir /_ /_/ for the admin path
- cms host unchanged: redir / -> /_/
- migration: legacy per-host marker blocks are removed before the new
combined block is installed
- cms.ts: PB file urls are now same-origin relative (/api/files/...) —
browsers could never load the old 127.0.0.1:8090 urls; validated the
rendered Caddyfile with caddy:2
- snippet generation moved to a j2 template; per-host pb_root flag
- cms.mozimo.in emits 'redir / /_/' before reverse_proxy (pattern from
overlord's Caddyfile); other hosts unchanged
- snippets now update in place (blockinfile idempotency) instead of
skipping when the desired block changed
- Makefile builds from 'git archive HEAD' (stale-remote-HEAD impossible):
tags registry.tanshu.com/mozimo:<short-commit> + :main; build-check target
verifies both architectures without pushing
- deploy.sh: refuses dirty tracked tree / HEAD != origin/main (--force to
bypass), ff-only pull, passes the commit as image_tag to ansible,
--prune flag for opt-in image cleanup
- ansible: docker_image uses image_tag extra-var (falls back to tag),
prune task keeps the 3 newest mozimo images, mozimo-repo only
tanshu