caddy: drop the systemctl enable; the quadlet generator already enables it

podman's quadlet generator creates the default.target.wants symlink from
the unit's [Install] section at every user-manager start (is-enabled
reports 'generated' for all healthy quadlets, pihole included). An
explicit 'systemctl --user enable caddy.service' fails with 'transient or
generated' and aborted the deploy after the unit was already installed.

docs/Infrastructure/Caddy.md

@@ -28,7 +28,8 @@ Caddy left `compose.yaml` on 2026-08-26. A reboot exposed that the bare compose
 - **Env file:** `/home/dank/Containers/caddy/env` (`PORKBUN_API_KEY`, `PORKBUN_API_SECRET_KEY`) — the deploy writes it from the checkout's `.env`; secrets never enter the repo (placeholders in `dankclaw/caddy/env.example`)
 - **Restart:** `Restart=always`, `RestartSec=5`; the health check probes the bare-IP catch-all (302) inside the container
 - **Image policy:** `Pull=never` — the image is built on-host and exists nowhere else; a boot must not stall on a registry
-- **Deploy:** `./scripts/deploy.sh dankclaw --service caddy` — renders the Caddyfile, rebuilds the image if the Containerfile changed, retires the legacy split proxy, writes the env file, removes the old bare container (all state is in host volumes), then installs, enables, and starts the unit
+- **Enable state:** `systemctl --user is-enabled caddy` reports `generated` — that is the healthy state for a quadlet. The podman generator creates the `default.target.wants` symlink from the unit's `[Install]` section at every user-manager start (linger covers boot); an explicit `systemctl enable` fails on generated units, so the deploy does not run it
+- **Deploy:** `./scripts/deploy.sh dankclaw --service caddy` — renders the Caddyfile, rebuilds the image if the Containerfile changed, retires the legacy split proxy, writes the env file, removes the old bare container (all state is in host volumes), then installs and starts the unit
 
 ## The porkbun image
 

docs/log.md

@@ -34,6 +34,6 @@ timestamp: 2026-09-14
 - `/AGENTS.md` — new MANDATORY section "Boot Persistence & Self-Healing": every deployed, proven-working container must have a self-healing, boot-persistent quadlet unit (`WantedBy=default.target` + enabled + linger, `Restart=always`, repo-provenance `.container`), verified before a service is declared deployed.
 - `/dankclaw/caddy/quadlet/caddy.container`, `/dankclaw/caddy/env.example` — Caddy is now a boot-persistent quadlet (`caddy.service`): joins `dankclaw_default` so container-name upstreams keep resolving, `Pull=never` (local-only image), Porkbun credentials via `/home/dank/Containers/caddy/env` (deploy writes it from `.env`), bare-IP-catch-all health check. The caddy service was removed from `/dankclaw/compose.yaml`.
 - `/dankclaw/pihole/sysctl/99-dnsmasq.conf` — repo source of truth for `ip_unprivileged_port_start=53`; `deploy_pihole` installs it to `/etc/sysctl.d/`, stages conflicting drop-ins (value > 53) in the home trash, comments out a stale `/etc/sysctl.conf` line (applied after all of sysctl.d), and applies `sysctl --system` (the boot code path).
-- `/scripts/deploy-remote.sh` — `deploy_caddy` installs/enables/starts the quadlet (retiring the bare container; all state is in host volumes); `deploy_pihole` enforces the sysctl prerequisite.
+- `/scripts/deploy-remote.sh` — `deploy_caddy` installs/starts the quadlet (retiring the bare container; all state is in host volumes). Boot persistence comes from podman's quadlet generator, which creates the `default.target.wants` symlink from the unit's `[Install]` section at every user-manager start — `is-enabled` reports `generated` for all healthy quadlets, and an explicit `systemctl enable` fails on generated units (learned live during the deploy). `deploy_pihole` enforces the sysctl prerequisites.
 - `/tests/caddy_quadlet.bats` (new seam), `/tests/caddyfile.bats`, `/tests/deployment_flow.bats`, `/tests/pihole.bats` — quadlet boot-persistence, self-healing, network, env, and sysctl coverage; compose assertions repointed from the removed caddy service to the quadlet.
 - `/docs/Infrastructure/Caddy.md`, `/docs/Infrastructure/Pi-hole.md`, `/docs/Dankclaw/Dankclaw Stack.md` — quadlet runtime facts, the 2026-08-26 incident, and the sysctl-conflict failure mode.

scripts/deploy-remote.sh

@@ -322,8 +322,13 @@ deploy_caddy() {
     # lives in host volumes, so removing the container loses nothing.
     podman stop caddy >/dev/null 2>&1 || true
     podman rm caddy >/dev/null 2>&1 || true
+    # install_quadlet runs daemon-reload, which re-runs podman's quadlet
+    # generator: it creates caddy.service AND the default.target.wants symlink
+    # from the unit's [Install] section (is-enabled reports "generated" —
+    # that is the healthy state for a quadlet; an explicit systemctl enable
+    # fails on generated units). Boot persistence comes from the generator,
+    # same as pihole/gitea/searxng/open-webui.
     install_quadlet caddy dankclaw/caddy/quadlet caddy
-    systemctl --user enable caddy.service
     systemctl --user restart caddy.service
     if podman container exists caddy; then
         local reloaded=0

tests/deployment_flow.bats

@@ -56,10 +56,13 @@ load helpers
 
 @test "canonical Caddy deployment installs its boot-persistent quadlet" {
     # 2026-08-26: a bare compose container never came back after reboot.
-    # deploy_caddy must install, enable, and start the quadlet unit instead
-    # of `podman-compose up`.
+    # deploy_caddy must install and start the quadlet unit instead of
+    # `podman-compose up`. Boot persistence comes from the quadlet generator's
+    # default.target.wants symlink (is-enabled reports "generated"), so there
+    # is no explicit systemctl enable — it fails on generated units.
     grep -q 'install_quadlet caddy dankclaw/caddy/quadlet caddy' "$REPO_ROOT/scripts/deploy-remote.sh"
-    grep -q 'systemctl --user enable caddy.service' "$REPO_ROOT/scripts/deploy-remote.sh"
+    grep -q 'systemctl --user restart caddy.service' "$REPO_ROOT/scripts/deploy-remote.sh"
+    ! grep -q 'systemctl --user enable caddy.service' "$REPO_ROOT/scripts/deploy-remote.sh"
     ! grep -q 'podman-compose -f dankclaw/compose.yaml up -d --no-deps caddy' "$REPO_ROOT/scripts/deploy-remote.sh"
     ! grep -q 'no proxy was stopped or replaced' "$REPO_ROOT/scripts/deploy-remote.sh"
 }