feat: pds operator

templates/Caddyfile.j2

@@ -15,3 +15,12 @@
   }
   reverse_proxy http://localhost:3000
 }
+{% if pds_operator_enabled is defined and pds_operator_enabled | bool %}
+operator.{{ pds_hostname }} {
+  log {
+    output stdout
+    format json
+  }
+  reverse_proxy http://localhost:8787
+}
+{% endif %}

templates/pds-operator-compose.yaml.j2

@@ -0,0 +1,26 @@
+name: pds-operator
+
+# Admin dashboard for the PDS — deployed by Ansible to
+# {{ pds_data_dir }}/operator/compose.yaml
+
+services:
+  app:
+    build: .
+    env_file: .env
+    environment:
+      - HOST=0.0.0.0 # required for reverse proxy to reach
+      - DB_PATH=/data/data.sqlite
+      - AUDIT_LOG_PATH=/data/audit.log
+    ports:
+      - "127.0.0.1:8787:8787"
+    volumes:
+      # bind mount keeps data under /pds — captured by the backup tarball
+      - ./data:/data
+    # runs unprivileged; ./data must be owned by uid 1000 (node)
+    user: node
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    restart: unless-stopped

templates/pds-operator.env.j2

@@ -0,0 +1,8 @@
+PDS_HOSTNAME={{ pds_hostname }}
+PDS_ADMIN_PASSWORD={{ pds_admin_password }}
+PDS_ADMIN_IDENTIFIER=
+RELAY_HOSTNAME=bsky.network
+SESSION_SECRET={{ pds_operator_session_secret }}
+PORT=8787
+APPVIEW_URL=https://bsky.app
+DASHBOARD_URL=https://operator.{{ pds_hostname }}