Retargets the build and the playbook off rootful Docker on monoco, following the
conventions already in place on emily's other services: Quadlet units in
~/.config/containers/systemd, per-service data in ~/podman-data, and a shared
Caddy that every service registers itself with — a network drop-in plus a
marked block in its Caddyfile. Nothing is published on the host; Caddy reaches
the containers by name over mozimo_net.
- Makefile: podman build + push instead of docker buildx, PLATFORMS=linux/arm64
(both hosts are aarch64). podman has no built-in QEMU the way buildx's builder
image does, so a foreign-platform failure now points at qemu-user-static.
- deploy.sh: pass COMMIT= to make, which the Makefile actually reads; it was
passing TAG=, so the tag silently came from `git rev-parse` instead.
- ansible: hosts emily, become false, XDG_RUNTIME_DIR for rootless podman and
systemctl --user. Docker modules become Quadlet templates with user-service
handlers, and the network role now ships mozimo.network plus the Caddy drop-in
rather than calling docker_network.
- UserNS=keep-id maps the container's uid 1000 (node) and root (vince) onto the
host user, so PocketBase and Vince write host-owned files instead of
subuid-owned ones; the play asserts the pinned uid still matches the host.
- ansible/README.md: the unit layout, the service-registration convention, and
the monoco -> emily migration (PocketBase 23 MB + Vince 119 MB, DNS cutover,
rollback).
Verified by a check-mode rehearsal against emily (13 ok / 8 changed / 0 failed)
and a disposable Quadlet unit on that host proving the uid mapping, the
EnvironmentFile and the isolated network. The real build and cutover have not
been run.
- www host: /_* and /api/* proxy to pocketbase :8090, everything else to
the TanStack app; redir /_ /_/ for the admin path
- cms host unchanged: redir / -> /_/
- migration: legacy per-host marker blocks are removed before the new
combined block is installed
- cms.ts: PB file urls are now same-origin relative (/api/files/...) —
browsers could never load the old 127.0.0.1:8090 urls; validated the
rendered Caddyfile with caddy:2
- Makefile builds from 'git archive HEAD' (stale-remote-HEAD impossible):
tags registry.tanshu.com/mozimo:<short-commit> + :main; build-check target
verifies both architectures without pushing
- deploy.sh: refuses dirty tracked tree / HEAD != origin/main (--force to
bypass), ff-only pull, passes the commit as image_tag to ansible,
--prune flag for opt-in image cleanup
- ansible: docker_image uses image_tag extra-var (falls back to tag),
prune task keeps the 3 newest mozimo images, mozimo-repo only
tanshu