chore: upgrade pds to 0.4.5009

Bump ghcr.io/bluesky-social/pds 0.4.219 -> 0.4.5001 (atproto/pds 0.2.19 -> 0.5.1).
Upstream renamed the service entrypoint from index.js to index.ts (ESM, type:
module, Node base image 20 -> 24), so update entrypoint.sh.tmpl to exec index.ts
and bump ENTRYPOINT_VERSION v1 -> v2 so the new swarm config is applied.

Caddyfile

@@ -1,6 +1,6 @@
 {
 	on_demand_tls {
-		ask http://pds:3000/tls-check
+		ask http://app:3000/tls-check
 	}
 }
 
@@ -8,5 +8,5 @@
 	tls {
 		on_demand
 	}
-	reverse_proxy pds:3000
+	reverse_proxy app:3000
 }

abra.sh

@@ -1,2 +1,2 @@
-export ENTRYPOINT_VERSION=v1
+export ENTRYPOINT_VERSION=v2
 export CADDYFILE_VERSION=v1

compose.yml

@@ -3,16 +3,9 @@ version: "3.8"
 
 services:
   app:
-    image: ghcr.io/bluesky-social/pds:0.4.219
+    image: ghcr.io/bluesky-social/pds:0.4.5009
     networks:
-      # Unique alias so the caddy sidecar resolves THIS stack's PDS, not a foreign service. On a
-      # shared host the default service name `app` is aliased by every co-located stack on the
-      # `proxy` overlay; caddy (attached to both `proxy` and `internal`) otherwise resolves bare
-      # `app` to another stack's endpoint, so its on-demand-TLS `ask` to the PDS is refused and the
-      # cert is never issued (HTTPS dead). `pds` exists only on `internal`, so it resolves correctly.
-      internal:
-        aliases:
-          - pds
+      - internal
     environment:
       - PDS_HOSTNAME=${DOMAIN}
       - PDS_DATA_DIRECTORY=/pds
@@ -43,7 +36,7 @@ services:
         max_attempts: 5
       labels:
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=0.3.0+v0.4.219"
+        - "coop-cloud.${STACK_NAME}.version=0.3.1+v0.4.5009"
         - "backupbot.backup=true"
     healthcheck:
       test: ["CMD", "wget", "-q", "--spider", "http://localhost:3000/xrpc/_health"]

entrypoint.sh.tmpl

@@ -5,4 +5,4 @@ export PDS_JWT_SECRET=$(cat /run/secrets/pds_jwt_secret)
 export PDS_ADMIN_PASSWORD=$(cat /run/secrets/pds_admin_password)
 export PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(cat /run/secrets/pds_plc_rotation_key)
 
-exec node --enable-source-maps index.js
+exec node --enable-source-maps index.ts