ON_OFF Phase 0-3: service-controller (.13:8443, token-gated, containers+systemd-user, audit log) + portal toggle cards (live status, per-user who, failed token, RAM) — full E2E verified

docker-compose.yml

@@ -87,6 +87,15 @@ services:
       ADMIN_PASSWORD: ${ADMIN_PASSWORD}
       ADMIN_FULLNAME: ${ADMIN_FULLNAME}
       PI_DASHBOARD_DIR: /pi-dashboard
+      # ON/OFF control — host-side service-controller (.13:8443, firewall-allowed).
+      # SC_TOKEN is injected by the deploy script from 10-secrets.conf (not committed).
+      SC_URL: http://host.docker.internal:8443
+      SC_TOKEN: ${SC_TOKEN:-}
+    extra_hosts:
+      # host-gateway resolves to docker0 (172.17.0.1, DOWN) on this box — pin
+      # host.docker.internal to the fhl-net bridge gateway where the
+      # service-controller actually listens (192.168.144.1). LAN-unreachable.
+      - "host.docker.internal:192.168.144.1"
     volumes:
       - /mnt/data/family-home-lab/pi-dashboard:/pi-dashboard:ro
       - /mnt/data/family-home-lab/shared-media:/shared-media:rw