chore(gateway): drop schweitz.internal, default to http://tatlock:8000

The homelab is retiring the *.schweitz.internal domain; in-network
machine-to-machine traffic uses docker container names on the
docker-dataplane network. The deployed tatlock-ui stack already overrides
DESKLOCK_TATLOCK_BASE_URL (Tatlock runs on the host), so only the
fallback default changes.

Docs follow: AGENTS.md M2M guidance now points at container names with
*.schweitz.net reserved for browsers, architecture.md drops the retired
domain (the registry name now matches what CI actually pushes since
c477019), and the README diagram loses the stale hostname.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

AGENTS.md

@@ -6,8 +6,8 @@
 ## What this project is
 
 DeskLock is the living-room visual/audio endpoint for **Tatlock**, the homelab butler
-(`/mnt/media/Projects/tatlock`, API at `http://tatlock.schweitz.internal:8000`). Two halves,
-one repo:
+(`/mnt/media/Projects/tatlock`, API at `http://tatlock:8000` on `docker-dataplane`).
+Two halves, one repo:
 
 - `firmware/` — ESP-IDF (C, LVGL 9) app for the Waveshare ESP32-P4-WIFI6-Touch-LCD-3.4C
   (3.4" round 800×800 touch display, dual mics + ES7210 AEC, ES8311 codec + speaker).
@@ -124,7 +124,8 @@ make typecheck      # mypy
 ## Homelab context
 
 - This server **is** tower-of-joy; the device, gateway, and Tatlock all share the LAN.
-- Use `tatlock.schweitz.internal:8000` (direct, no SSO) — the public
-  `tatlock.schweitz.net` route sits behind Authentik and is not for machine-to-machine
-  traffic.
+- Machine-to-machine traffic uses container names on the `docker-dataplane` network —
+  `http://tatlock:8000` (the deployed stack overrides `DESKLOCK_TATLOCK_BASE_URL` to
+  the host LAN IP while Tatlock runs on the host). Browser-facing URLs use
+  `https://<name>.schweitz.net` (NPM, Authentik SSO) — never for M2M traffic.
 - Git remote: `git.schweitz.net` (Gitea).

CHANGELOG.md

@@ -8,6 +8,13 @@ until the first tagged release.
 
 ## [Unreleased]
 
+### Changed
+
+- The gateway's default Tatlock URL is now `http://tatlock:8000` (docker
+  container name) — the retiring `tatlock.schweitz.internal` domain is gone
+  from config and docs. Deployments setting `DESKLOCK_TATLOCK_BASE_URL` are
+  unaffected.
+
 ## [0.2.1] — 2026-07-15
 
 ### Fixed

README.md

@@ -38,8 +38,8 @@ happens on this server.
                                      ▼       │  Speaches  (container, GPU) │
                      ┌────────────────────┐  │  • STT: faster-whisper      │
                      │  Tatlock (butler)  │  │  • TTS: Kokoro / Piper      │
-                     │  tatlock.schweitz. │  │  also usable by Open WebUI, │
-                     │  internal :8000    │  │  Home Assistant, …          │
+                     │  http://tatlock    │  │  also usable by Open WebUI, │
+                     │  :8000             │  │  Home Assistant, …          │
                      └────────────────────┘  └─────────────────────────────┘
 ```
 

docs/architecture.md

@@ -74,7 +74,7 @@ models — the container stays a slim pure-Python image with no CUDA/ML dependen
 2. Buffers inbound PCM until end-of-utterance (client-signalled in phase 1; VAD later).
 3. **STT**: POST to Speaches `/v1/audio/transcriptions`.
 4. **Chat**: POST the transcript to Tatlock `/v1/chat/completions`
-   (`http://tatlock.schweitz.internal:8000`, OpenAI-compatible, **streaming**),
+   (`http://tatlock:8000`, OpenAI-compatible, **streaming**),
    maintaining the conversation history so follow-ups have context.
 5. **TTS**: as Tatlock's token stream completes each sentence, POST it to Speaches
    `/v1/audio/speech` and forward the PCM immediately — see
@@ -335,7 +335,7 @@ Gitea Actions (`.gitea/workflows/build.yml`), following the tatlock/tatlock-ui p
 
 - **Every push to `main`**: lint + tests for the gateway (Python 3.12).
 - **Version tags (`v0.1.0`, …)**: tests, then build `gateway/` into
-  `git.schweitz.internal/jpmschweitzer/desklock-gateway:{latest,tag}`, push to the
+  `git.schweitz.net/jpmschweitzer/desklock-gateway:{latest,tag}`, push to the
   Gitea registry, create a release, and trigger Watchtower to roll the running
   container.
 - Required repo/org secrets: `REGISTRY_USER`, `REGISTRY_PASSWORD`,

gateway/src/desklock_gateway/config.py

@@ -4,7 +4,7 @@ from pydantic_settings import BaseSettings
 class Settings(BaseSettings):
     """Gateway configuration, overridable via DESKLOCK_* environment variables."""
 
-    tatlock_base_url: str = "http://tatlock.schweitz.internal:8000"
+    tatlock_base_url: str = "http://tatlock:8000"
     tatlock_model: str = "Tatlock"
 
     # PCM rate of the device WebSocket contract (docs/architecture.md)