feat: distribute HALOS_DOMAIN via EnvironmentFile; stop hardcoding .local in generated prestarts

[mairas]

What

Units 2 & 3 of #206 — centralize HALOS_DOMAIN so it's resolved once and distributed, instead of being independently resolved (and .local-hardcoded) in every generated prestart.

The producer (halos-resolve-domain.service, shipped in halos-core-containers 0.5.0 via #195) resolves the canonical hostname from hostnames.conf once and publishes /run/halos/domain.env. This change makes the generator consume it.

How

For routed/web_ui apps (predicate _has_routing = routing: present or web_ui.enabled):

• service.j2 — add After=/Wants=halos-resolve-domain.service and EnvironmentFile=-/run/halos/domain.env, loaded last so it overrides any stale HALOS_DOMAIN a legacy runtime.env still carries. This is the only layer that reaches custom-prestart apps, since the unit is always generated even when prestart.sh is supplied verbatim.
• control — inject Depends: halos-core-containers (>= 0.5.0).
• prestart.py — stop resolving HALOS_DOMAIN and stop hardcoding ${HOSTNAME}.local; inherit HALOS_DOMAIN from the unit environment and build HOMARR_URL from it. No consumer writes HALOS_DOMAIN back to a file that's later re-read, so the runtime.env-as-EnvironmentFile feedback loop is structurally gone (R3). The vestigial top-level traefik metadata read is dropped.

A single _has_routing(metadata) predicate drives the unit wiring (service.j2's has_routing) and the control dependency (_compute_producer_depends), so the two can't drift — same discipline as registry.emits_path_only_url.

Requirements covered: R1, R2, R3, R4. (R5 rollout / R6 marine cleanup are Units 4–5 in other repos.)

Depends vs Breaks

Depends (not Breaks) is deliberate, and consistent with the Breaks-over-Depends policy: Breaks is for optional peers. halos-core-containers is part of the minimum install on every device that ships routed/web_ui apps (Traefik/Authelia/Homarr are the web-management layer they route through), so the peer is always present — line 53 of that policy endorses Depends for an always-present peer. The producer-absent failure mode (empty HALOS_DOMAIN → broken OIDC) is not graceful, so the constraint is kept rather than dropped under the skip-pins policy. Rationale recorded in AGENTS.md.

Rollout ordering (gates Units 4–5)

>= 0.5.0 is correct, but halos-core-containers 0.5.0 is not yet a published stable release (latest stable is v0.4.4+1). Downstream container repos that regenerate against this must not be promoted to stable until core 0.5.0 stable lands in apt, or their rebuilt .debs become uninstallable. Tracked under #206's risk table and Unit 5.

Testing

uv run pytest -m "not install" → 586 passed / 1 skipped. Lint, format clean; ty clean except 2 pre-existing diagnostics in untouched routing.py. New tests cover: web_ui app wiring, OIDC app (both Authelia + producer ordering), the routing-present/no-web_ui branch, domain.env as the last EnvironmentFile, and the non-routed app staying independent of the producer.

Refs #206

🤖 Generated with Claude Code