From 79d43ec1990339b7ce49916f12343bb198c5b9f7 Mon Sep 17 00:00:00 2001
From: Jeroen Schweitzer <jpmschweitzer@gmail.com>
Date: Tue, 14 Jul 2026 19:08:50 +0200
Subject: [PATCH] Deployment home is the tatlock-ui Portainer stack, not a
 standalone file

The gateway service now lives in system-admin-toj/containers/stacks/
tatlock-ui.yml (shared docker-dataplane network: speaches by service
name, host-run Tatlock by LAN IP). Drop deploy/desklock-gateway.yml.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 AGENTS.md                   |  9 +++++----
 deploy/desklock-gateway.yml | 21 ---------------------
 docs/architecture.md        |  7 ++++---
 3 files changed, 9 insertions(+), 28 deletions(-)
 delete mode 100644 deploy/desklock-gateway.yml

diff --git a/AGENTS.md b/AGENTS.md
index 1f13ddf..d577298 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -93,10 +93,11 @@ make typecheck      # mypy
 - Deployment is CI-driven: pushing a `v*` tag makes Gitea Actions test, build, and push
   `desklock-gateway:{latest,tag}` to the registry and trigger Watchtower
   (`.gitea/workflows/build.yml`; needs `REGISTRY_USER`/`REGISTRY_PASSWORD`/
-  `WATCHTOWER_TOKEN` secrets). Plain pushes to `main` run lint + tests only. The stack
-  file is `deploy/desklock-gateway.yml` — copy into
-  `system-admin-toj/containers/stacks/` and register the service + port 8600 in
-  `CONTAINERS.md` on first deploy.
+  `WATCHTOWER_TOKEN` secrets). Plain pushes to `main` run lint + tests only. The
+  gateway deploys as part of the **`tatlock-ui` Portainer stack** —
+  `system-admin-toj/containers/stacks/tatlock-ui.yml` (registered in `CONTAINERS.md`,
+  port 8600). Stack updates go through the Portainer API on :8001 (JWT auth; recipe in
+  `system-admin-toj/containers/setup-new-host.md`), not by editing files on disk.
 - Verify speech changes against the live Speaches container with a real round trip
   (TTS → STT of a known phrase, expect the transcript back); warm timings to expect:
   STT ~0.3 s, TTS ~2 s per sentence.
diff --git a/deploy/desklock-gateway.yml b/deploy/desklock-gateway.yml
deleted file mode 100644
index d5333cb..0000000
--- a/deploy/desklock-gateway.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-# DeskLock gateway stack.
-# To deploy: copy into system-admin-toj/containers/stacks/ (Portainer) and
-# register the service + port 8600 in CONTAINERS.md.
-#
-# Image is built and pushed by .gitea/workflows/build.yml on version tags;
-# Watchtower picks up :latest afterwards.
-services:
-  desklock-gateway:
-    image: git.schweitz.internal/jpmschweitzer/desklock-gateway:latest
-    container_name: desklock-gateway
-    restart: unless-stopped
-    ports:
-      - "8600:8600"
-    environment:
-      # LAN IP of tower-of-joy: *.schweitz.internal resolves to localhost on the
-      # host, which is wrong inside a container. Switch to http://speaches:8000
-      # (and the tatlock service name) if this stack joins their docker networks.
-      - DESKLOCK_TATLOCK_BASE_URL=http://192.168.86.149:8000
-      - DESKLOCK_SPEACHES_BASE_URL=http://192.168.86.149:8601
-    labels:
-      - com.centurylinklabs.watchtower.enable=true
diff --git a/docs/architecture.md b/docs/architecture.md
index d4ccf39..fd1e527 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -258,9 +258,10 @@ Gitea Actions (`.gitea/workflows/build.yml`), following the tatlock/tatlock-ui p
   container.
 - Required repo/org secrets: `REGISTRY_USER`, `REGISTRY_PASSWORD`,
   `WATCHTOWER_TOKEN` (same trio tatlock uses).
-- The runtime stack definition lives in `deploy/desklock-gateway.yml`; copy it into
-  `system-admin-toj/containers/stacks/` to deploy, and register port 8600 in
-  `CONTAINERS.md`.
+- The gateway is a service in the **`tatlock-ui` Portainer stack**
+  (`system-admin-toj/containers/stacks/tatlock-ui.yml`, registered in
+  `CONTAINERS.md`): it shares `docker-dataplane` with Speaches (service-name URL
+  `http://speaches:8000`) and reaches the host-run Tatlock via LAN IP.
 
 Firmware is not containerized: it's flashed over USB (`idf.py flash`), with OTA planned
 for phase 5.