# Podman quadlet: the holger console behind nginx, rootless.
#
# Install: cp deploy/holger-console.container ~/.config/containers/systemd/
# systemctl --user daemon-reload
# systemctl --user start holger-console
# Logs: journalctl --user -u holger-console
#
# %h = the user's home. The unit serves the PUBLISHED release copy under
# %h/.local/share/holger-console — never the repo's dist/, because the dev
# loop (`trunk serve`) rewrites that directory on every rebuild: a debug
# build and umask-0007 modes would silently replace the release. Publish:
#
# cargo xtask publish
#
# `cargo xtask publish` is the only supported path: it generates nginx.conf with a CSP
# whose script hash matches the build it just made. A hand-copied
# deploy/nginx.conf still has the CSP marker as a comment — no CSP is sent.
#
# Host networking so nginx reaches holger's loopback gRPC port (50051) and
# the console lands on loopback :8480 — TLS/exposure is the outer layer's
# decision (e.g. `tailscale serve --bg http://127.0.0.1:8480`).
[Unit]
Description=holger console (nginx, static SPA + gRPC-web proxy)
Wants=network-online.target
After=network-online.target
[Container]
Image=docker.io/library/nginx:1.27-alpine
Network=host
Volume=%h/.local/share/holger-console/dist:/usr/share/nginx/html:ro,Z
Volume=%h/.local/share/holger-console/nginx.conf:/etc/nginx/conf.d/default.conf:ro,Z
[Service]
Restart=on-failure
[Install]
WantedBy=default.target