The caddy sidecar uses on-demand TLS and asks http://app:3000/tls-check before issuing a cert. On a
multi-tenant host every co-located stack aliases its main service 'app' on the shared 'proxy' overlay;
caddy (on proxy+internal) resolves bare 'app' to a FOREIGN stack's endpoint, the tls-check is refused,
no cert is issued, and HTTPS is dead (xrpc/_health=000). Renaming the service to 'pds' gives a unique
swarm DNS name that only this stack publishes, so caddy's reverse_proxy/on_demand_tls always resolve
this PDS. (A network alias would be cleaner but abra drops compose network aliases on deploy; the
service name is always applied.)
cc @trav @notplants
Pin an exact released image tag. The previous pin :0.4 is a moving tag
that upstream now republishes with main-branch builds (currently
@atproto/pds 0.5.1 on Node 24, where the service entrypoint moved from
/app/index.js to /app/index.ts), so the recipe's entrypoint.sh
(exec node --enable-source-maps index.js) crash-loops MODULE_NOT_FOUND.
ghcr.io/bluesky-social/pds:0.4.219 is the newest released exact tag and
keeps the layout this recipe's entrypoint expects (Node 20.20,
/app/index.js, dumb-init).
