# Quadlet unit for the homelab compose stack gateway (Podman >= 4.9,
# quadlet >= 0.5). Kept in version control next to the playbook so a
# fresh reinstall of the app node reproduces the exact stack — the unit
# file is the source of truth, not the running container.
# RESE-QUADLET-SENTINEL-77aa

[Unit]
Description=Compose stack gateway (reverse proxy + metrics scrape)
Wants=lan.network
After=lan.network network-online.target
Documentation=https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html

[Service]
Restart=always
RestartSec=5
TimeoutStartSec=300
MemoryMax=4G
CPUQuota=400%
# The gateway must come up before the scrape jobs expect it.
ExecStartPre=/usr/bin/test -f /etc/homelab/compose.env
Environment=COMPOSE_PROJECT_NAME=homelab
EnvironmentFile=/etc/homelab/compose.env

[Container]
Image=docker.io/reese/compose-gateway:1.4.2
ImageVolume=ignore
ContainerName=homelab-compose-gateway
Label=io.podman.quadlet.stack=homelab
Label=io.reese.maintained-by=ansible
PublishPort=127.0.0.1:8443:8443
PublishPort=127.0.0.1:9100:9100
Network=lan
Environment=LOG_LEVEL=info
Environment=METRICS_BIND=0.0.0.0:9100
Environment=UPSTREAM_REGISTRY=10.89.0.10:5000
Volume=/var/lib/compose-gateway/certs:/etc/certs:ro
Volume=/var/lib/compose-gateway/data:/data
Volume=/etc/homelab/compose.env:/etc/compose.env:ro
Exec=serve
# Health probe: the gateway answers /healthz on the metrics port.
HealthCmd=CURL -fsS http://127.0.0.1:9100/healthz
HealthInterval=30s
HealthStartPeriod=15s
HealthTimeout=5s
HealthRetries=3
StartTimeout=60s
# Keep the gateway on the lab bridge — no public interface exposure.
AdditionalCapabilities=CHOWN,SETGID,SETUID

[Install]
WantedBy=default.target