Some theoretical installation instructions, for me to verify

deploy/nginx/nginx-quadlet.conf

@@ -0,0 +1,61 @@
+worker_processes auto;
+error_log /var/log/nginx/error.log warn;
+
+events {
+    worker_connections 4096;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    access_log /var/log/nginx/access.log;
+    sendfile on;
+    keepalive_timeout 65;
+
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+    ssl_session_cache shared:SSL:10m;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+
+    server {
+        listen 80;
+        listen [::]:80;
+        server_name _;
+
+        location /.well-known/acme-challenge/ {
+            root /var/www/acme;
+        }
+
+        location / {
+            return 301 https://$host$request_uri;
+        }
+    }
+
+    server {
+        listen 443 ssl http2;
+        listen [::]:443 ssl http2;
+        server_name _;
+
+        ssl_certificate /etc/nginx/certs/fullchain.pem;
+        ssl_certificate_key /etc/nginx/certs/privkey.pem;
+        client_max_body_size 100M;
+
+        location / {
+            proxy_pass http://127.0.0.1:3000;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_read_timeout 86400;
+            proxy_send_timeout 86400;
+            proxy_buffering off;
+        }
+    }
+}

deploy/quadlets/bspds-app.container

@@ -0,0 +1,28 @@
+[Unit]
+Description=BSPDS AT Protocol PDS
+After=bspds-db.service bspds-minio.service bspds-valkey.service
+
+[Container]
+ContainerName=bspds-app
+Image=localhost/bspds:latest
+Pod=bspds.pod
+EnvironmentFile=/srv/bspds/config/bspds.env
+Environment=SERVER_HOST=0.0.0.0
+Environment=SERVER_PORT=3000
+Environment=S3_ENDPOINT=http://localhost:9000
+Environment=AWS_REGION=us-east-1
+Environment=S3_BUCKET=pds-blobs
+Environment=VALKEY_URL=redis://localhost:6379
+Environment=FRONTEND_DIR=/app/frontend/dist
+HealthCmd=wget -q --spider http://localhost:3000/xrpc/_health
+HealthInterval=30s
+HealthTimeout=10s
+HealthRetries=3
+HealthStartPeriod=15s
+
+[Service]
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=default.target

deploy/quadlets/bspds-db.container

@@ -0,0 +1,23 @@
+[Unit]
+Description=BSPDS postgres database
+
+[Container]
+ContainerName=bspds-db
+Image=docker.io/library/postgres:18-alpine
+Pod=bspds.pod
+Environment=POSTGRES_USER=bspds
+Environment=POSTGRES_DB=pds
+Secret=bspds-db-password,type=env,target=POSTGRES_PASSWORD
+Volume=/srv/bspds/postgres:/var/lib/postgresql/data:Z
+HealthCmd=pg_isready -U bspds -d pds
+HealthInterval=10s
+HealthTimeout=5s
+HealthRetries=5
+HealthStartPeriod=10s
+
+[Service]
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=default.target

deploy/quadlets/bspds-minio.container

@@ -0,0 +1,23 @@
+[Unit]
+Description=BSPDS minio object storage
+
+[Container]
+ContainerName=bspds-minio
+Image=docker.io/minio/minio:RELEASE.2025-10-15T17-29-55Z
+Pod=bspds.pod
+Environment=MINIO_ROOT_USER=minioadmin
+Secret=bspds-minio-password,type=env,target=MINIO_ROOT_PASSWORD
+Volume=/srv/bspds/minio:/data:Z
+Exec=server /data --console-address :9001
+HealthCmd=curl -f http://localhost:9000/minio/health/live || exit 1
+HealthInterval=30s
+HealthTimeout=10s
+HealthRetries=3
+HealthStartPeriod=10s
+
+[Service]
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=default.target

deploy/quadlets/bspds-nginx.container

@@ -0,0 +1,18 @@
+[Unit]
+Description=BSPDS nginx reverse proxy
+After=bspds-app.service
+
+[Container]
+ContainerName=bspds-nginx
+Image=docker.io/library/nginx:1.28-alpine
+Pod=bspds.pod
+Volume=/srv/bspds/config/nginx.conf:/etc/nginx/nginx.conf:ro,Z
+Volume=/srv/bspds/certs:/etc/nginx/certs:ro,Z
+Volume=/srv/bspds/acme:/var/www/acme:ro,Z
+
+[Service]
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=default.target

deploy/quadlets/bspds-valkey.container

@@ -0,0 +1,21 @@
+[Unit]
+Description=BSPDS valkey cache
+
+[Container]
+ContainerName=bspds-valkey
+Image=docker.io/valkey/valkey:9-alpine
+Pod=bspds.pod
+Volume=/srv/bspds/valkey:/data:Z
+Exec=valkey-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
+HealthCmd=valkey-cli ping
+HealthInterval=10s
+HealthTimeout=5s
+HealthRetries=3
+HealthStartPeriod=5s
+
+[Service]
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=default.target

deploy/quadlets/bspds.pod

@@ -0,0 +1,7 @@
+[Pod]
+PodName=bspds
+PublishPort=80:80
+PublishPort=443:443
+
+[Install]
+WantedBy=default.target