fix(routing): unique pds alias so caddy resolves THIS stack's PDS on shared proxy

The caddy sidecar uses on-demand TLS and asks http://app:3000/tls-check before issuing a cert.
On a shared host every co-located stack aliases its main service 'app' on the 'proxy' overlay;
caddy (on both proxy+internal) resolves bare 'app' to a FOREIGN stack's endpoint, so the tls-check
connection is refused, no cert is issued, and the PDS is unreachable over HTTPS (xrpc/_health=000).
Give the PDS a unique 'pds' alias on the internal network and point caddy's reverse_proxy +
on_demand_tls ask at it; 'pds' exists only on internal, so it always resolves to this stack's PDS.
Service name stays 'app' (no downstream breakage).

Caddyfile

@@ -1,6 +1,6 @@
 {
 	on_demand_tls {
-		ask http://app:3000/tls-check
+		ask http://pds:3000/tls-check
 	}
 }
 
@@ -8,5 +8,5 @@
 	tls {
 		on_demand
 	}
-	reverse_proxy app:3000
+	reverse_proxy pds:3000
 }

README.md

@@ -15,6 +15,8 @@
 
 ## Quickstart
 
+0. setup a server with [abra](https://git.coopcloud.tech/toolshed/abra) and deploy [coop-cloud/traefik](https://git.coopcloud.tech/coop-cloud/traefik)
+
 1. `abra app new bluesky-pds` (do **not** use `--secrets` yet, see below)
 2. Generate secrets:
 
@@ -61,7 +63,7 @@ Create an invite code:
 
 ```bash
 abra app run YOURAPPDOMAIN app -- \
-  goat pds admin account create-invite \
+  goat pds admin create-invites \
     --admin-password YOUR_ADMIN_PASSWORD
 ```
 
@@ -143,7 +145,7 @@ entirely via deploy labels on the Caddy service in this recipe's `compose.yml`.
 
 A [Bluesky PDS](https://github.com/bluesky-social/pds) (Personal Data Server)
 is a self-hosted server for ATProto. This is a co-op cloud recipe for a PDS 
-as implemented by bluesky, although other pds implementations exist such as [rsky-pds](https://github.com/blacksky-algorithms/rsky/tree/main/rsky-pds).
+as implemented by bluesky, although other pds implementations exist such as [cocoon](https://tangled.org/hailey.at/cocoon), [tranquil-pds](https://tangled.org/tranquil.farm/tranquil-pds), [pegasus](https://tangled.org/futur.blue/pegasus) and [rsky-pds](https://github.com/blacksky-algorithms/rsky/tree/main/rsky-pds).
 
 # ❃
 

compose.yml

@@ -3,9 +3,16 @@ version: "3.8"
 
 services:
   app:
-    image: ghcr.io/bluesky-social/pds:0.4
+    image: ghcr.io/bluesky-social/pds:0.4.219
     networks:
-      - internal
+      # Unique alias so the caddy sidecar resolves THIS stack's PDS, not a foreign service. On a
+      # shared host the default service name `app` is aliased by every co-located stack on the
+      # `proxy` overlay; caddy (attached to both `proxy` and `internal`) otherwise resolves bare
+      # `app` to another stack's endpoint, so its on-demand-TLS `ask` to the PDS is refused and the
+      # cert is never issued (HTTPS dead). `pds` exists only on `internal`, so it resolves correctly.
+      internal:
+        aliases:
+          - pds
     environment:
       - PDS_HOSTNAME=${DOMAIN}
       - PDS_DATA_DIRECTORY=/pds
@@ -36,7 +43,7 @@ services:
         max_attempts: 5
       labels:
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=0.2.0+v0.4"
+        - "coop-cloud.${STACK_NAME}.version=0.3.0+v0.4.219"
         - "backupbot.backup=true"
     healthcheck:
       test: ["CMD", "wget", "-q", "--spider", "http://localhost:3000/xrpc/_health"]