Retargets the build and the playbook off rootful Docker on monoco, following the
conventions already in place on emily's other services: Quadlet units in
~/.config/containers/systemd, per-service data in ~/podman-data, and a shared
Caddy that every service registers itself with — a network drop-in plus a
marked block in its Caddyfile. Nothing is published on the host; Caddy reaches
the containers by name over mozimo_net.
- Makefile: podman build + push instead of docker buildx, PLATFORMS=linux/arm64
(both hosts are aarch64). podman has no built-in QEMU the way buildx's builder
image does, so a foreign-platform failure now points at qemu-user-static.
- deploy.sh: pass COMMIT= to make, which the Makefile actually reads; it was
passing TAG=, so the tag silently came from `git rev-parse` instead.
- ansible: hosts emily, become false, XDG_RUNTIME_DIR for rootless podman and
systemctl --user. Docker modules become Quadlet templates with user-service
handlers, and the network role now ships mozimo.network plus the Caddy drop-in
rather than calling docker_network.
- UserNS=keep-id maps the container's uid 1000 (node) and root (vince) onto the
host user, so PocketBase and Vince write host-owned files instead of
subuid-owned ones; the play asserts the pinned uid still matches the host.
- ansible/README.md: the unit layout, the service-registration convention, and
the monoco -> emily migration (PocketBase 23 MB + Vince 119 MB, DNS cutover,
rollback).
Verified by a check-mode rehearsal against emily (13 ok / 8 changed / 0 failed)
and a disposable Quadlet unit on that host proving the uid mapping, the
EnvironmentFile and the isolated network. The real build and cutover have not
been run.
- www host: /_* and /api/* proxy to pocketbase :8090, everything else to
the TanStack app; redir /_ /_/ for the admin path
- cms host unchanged: redir / -> /_/
- migration: legacy per-host marker blocks are removed before the new
combined block is installed
- cms.ts: PB file urls are now same-origin relative (/api/files/...) —
browsers could never load the old 127.0.0.1:8090 urls; validated the
rendered Caddyfile with caddy:2
- snippet generation moved to a j2 template; per-host pb_root flag
- cms.mozimo.in emits 'redir / /_/' before reverse_proxy (pattern from
overlord's Caddyfile); other hosts unchanged
- snippets now update in place (blockinfile idempotency) instead of
skipping when the desired block changed
tanshu