Sync compose with VPS deployment and trigger Watchtower on image push

The deployed compose (SELinux :Z, TZ, healthcheck, watchtower label) now
lives in the repo as the source of truth, and CI asks the VPS Watchtower
API to deploy immediately after pushing instead of waiting for the
nightly sweep.

.gitea/workflows/build.yml

@@ -33,3 +33,11 @@ jobs:
           docker tag agentchat:latest git.gbrown.org/gib/agentchat:latest
           docker push git.gbrown.org/gib/agentchat:${{ gitea.sha }}
           docker push git.gbrown.org/gib/agentchat:latest
+
+      # Watchtower on the VPS updates labelled containers nightly at 04:30; this
+      # asks it to do so immediately. Non-fatal: the sweep still catches it.
+      - name: Trigger immediate deploy via Watchtower API
+        run: |
+          curl -fsS -X POST -H "Authorization: Bearer ${{ secrets.WATCHTOWER_TOKEN }}" \
+            http://192.168.2.2:8080/v1/update \
+            || echo "::warning::watchtower trigger failed; nightly sweep will deploy instead"

README.md

@@ -43,17 +43,9 @@ Or containerized: `podman compose -f docker/compose.local.yml up --build`
 
 ## Deployment
 
-Gitea CI (`.gitea/workflows/build.yml`) typechecks, tests, then builds and pushes `git.gbrown.org/gib/agentchat:{latest,<sha>}` on pushes to `main`. Requires `REGISTRY_USER` / `REGISTRY_PASSWORD` repo secrets.
+Gitea CI (`.gitea/workflows/build.yml`) typechecks, tests, builds and pushes `git.gbrown.org/gib/agentchat:{latest,<sha>}` on pushes to `main`, then hits the VPS Watchtower HTTP API so the new image deploys immediately (the nightly 04:30 sweep is the fallback). Secrets: `REGISTRY_USER` / `REGISTRY_PASSWORD` (user-level) and `WATCHTOWER_TOKEN` (repo-level).
 
-On the VPS:
+The live deployment is on the VPS (`junior.gib`) at `~/Server/Agentchat/` — `docker/compose.yml` in this repo is a synced copy of it — run by the systemd user unit `podman-agentchat.service` (rootless podman, see the VPS `~/Server/AGENTS.md`). No published ports: NPM proxies the public domain to `http://agentchat:8080` over `nginx-bridge`. SQLite persists in `./data`.
-
-```sh
-mkdir agentchat && cd agentchat
-curl -fsSLO https://git.gbrown.org/gib/agentchat/raw/branch/main/docker/compose.yml
-podman compose up -d
-```
-
-The compose file joins the external `nginx-bridge` network with no published ports — point the reverse proxy for `agentchat.gbrown.org` at `agentchat:8080`. SQLite persists in `./data`.
 
 ## Notes
 

docker/compose.yml

@@ -1,18 +1,20 @@
+# Deployed copy lives at junior.gib:~/Server/Agentchat/compose.yml — keep in sync.
 networks:
   nginx-bridge:
-    external: true
+    external: true            # ALWAYS external; see the VPS ~/Server/AGENTS.md §5
 
 services:
   agentchat:
-    image: git.gbrown.org/gib/agentchat:${TAG:-latest}
+    image: git.gbrown.org/gib/agentchat:latest
-    container_name: ${CONTAINER_NAME:-agentchat}
+    container_name: agentchat
-    hostname: ${CONTAINER_NAME:-agentchat}
+    hostname: agentchat
-    domainname: ${DOMAIN:-agentchat.gbrown.org}
+    domainname: agentchat.gbrown.org
-    networks: ['${NETWORK:-nginx-bridge}']
+    networks: ['nginx-bridge']
-    #ports: ['${PORT:-8080}:8080']
     environment:
+      - TZ=America/New_York
       - AGENTCHAT_DB=/data/agentchat.db
-    volumes: ['./data:/data']
+    volumes:
+      - ./data:/data:Z        # :Z mandatory under SELinux Enforcing; see AGENTS.md §6
     labels: ['com.centurylinklabs.watchtower.enable=true']
     restart: unless-stopped
     healthcheck: