Move the gateway to junior.gib: CI deploy, compose copy, renewal script, docs

deploy/compose.yml

@@ -1,27 +1,36 @@
-# The gateway on server-gib, at ~/Server/Wristcode/compose.yml. Nginx Proxy Manager serves
-# wristcode.gbrown.org and forwards to wristcode-gateway:8080 over the nginx-bridge network.
-# CI deploys new images through ~/Server/ci-deploy.sh. Watchtower's nightly pull is the fallback.
+# A copy of the stack on junior.gib (the VPS). The live file is server/vps/Wristcode/compose.yml in
+# gib/Panama, symlinked into ~/Server/Wristcode/, beside podman-wristcode.service.
 #
-# .env beside this file (mode 600) holds the APNs settings:
-#   APNS_KEY_ID=...        the key's ID from the Apple Developer portal
+# WristCode gateway: the backend for the WristCode Apple Watch app (git.gbrown.org/gib/wristcode).
+# It holds a WebSocket to every T3 Code server, serves the watch's HTTPS API, and sends APNs pushes.
+# NPM serves wristcode.gbrown.org and forwards to wristcode-gateway:8080 over nginx-bridge.
+#
+# .env beside this file (mode 600):
+#   APNS_KEY_ID=...                the APNs key's ID
 #   APNS_TEAM_ID=GQJNM5YK2M
-#   APNS_KEY_PATH=/data/apns.p8   the .p8 file, placed in ./data
-name: wristcode
-
+#   APNS_KEY_PATH=/data/apns.p8    the .p8 file, in ./data
+#
+# Operator CLI: podman exec -it wristcode-gateway wristcode <host add|pair|device list|...>
 networks:
   nginx-bridge:
-    external: true
+    external: true            # ALWAYS external; see AGENTS.md §5
 
 services:
   wristcode-gateway:
     image: git.gbrown.org/gib/wristcode-gateway:latest
     container_name: wristcode-gateway
     hostname: wristcode-gateway
+    domainname: wristcode.gbrown.org
     networks: ['nginx-bridge']
     env_file: [.env]
     environment:
       - TZ=America/New_York
+    # The image runs as `bun` (uid 1000). keep-id maps it to gib, so ./data stays gib-owned (AGENTS.md §3.2).
+    userns_mode: "keep-id:uid=1000,gid=1000"
     volumes:
-      - ./data:/data
-    labels: ['com.centurylinklabs.watchtower.enable=true']
+      - ./data:/data:z        # lowercase :z survives update-containers recreates, as in Agentchat
     restart: unless-stopped
+    healthcheck:
+      test: wget -qO- http://127.0.0.1:8080/v1/health || exit 1
+      interval: 30s
+      start_period: 10s