Summary

Two regressions in generate_container_serve_quadlet caught on the first real deployment of the generator output:

1. Container crashed on startup with Config file not found: /etc/psi/config.yaml because the quadlet did not set SecurityLabelType. Without container_runtime_t the container runs as container_t and cannot read /etc/psi (labeled etc_t) via a :ro mount. Using :Z would relabel the host config dir, which we never want.
2. Even after fixing Pluggable provider architecture with Nitrokey HSM support #1 the unit would have sat in activating forever, because quadlet emits Type=notify by default and expects sd_notify(READY=1). psi serve does not call sd_notify itself.

Why

First real use of psi systemd install --mode container on the test server exposed both gaps. generate_container_provider_setup_quadlet already sets SecurityLabelType=container_runtime_t; the serve generator was inconsistent. The Butane-managed quadlet that had been running previously had both SecurityLabelType and Notify=healthy + HealthCmd; the generator dropped them.

What changes

psi/unitgen.py

• SecurityLabelType=container_runtime_t
• Notify=healthy
• HealthCmd=curl -sf --unix-socket <sock> http://localhost/healthz
• HealthInterval=30s, HealthRetries=10, HealthStartPeriod=60s, HealthTimeout=5s

HealthStartPeriod=60s gives HSM login plus encrypted cache decrypt enough headroom before the first probe — Nitrokey HSM startup alone can take 25 seconds.

tests/test_unitgen.py

• test_serve_quadlet_has_security_label_type — asserts the label is emitted
• test_serve_quadlet_has_notify_healthy — asserts Notify=healthy and a HealthCmd pointing at /healthz with a start period long enough for HSM startup

Test plan

• uv run ruff check psi/ tests/ — clean
• uv run ruff format --check psi/ tests/ — clean
• uv run ty check — clean
• uv run pytest -q — 296 passed (2 new)
• On the test server: pull the new image, regenerate quadlets, daemon-reload, restart psi-secrets.service, confirm the unit goes active within HealthStartPeriod of starting and that podman exec psi-secrets psi cache status works