Add SELinux override file and Podman/SELinux instructions

[florisie]

Summary

Adds a selinux-override.yml compose override and a "Podman / SELinux notes" section to the README so Fedora/SELinux users can run the stack with podman-compose without editing the base docker-compose.yml.

Background

The base docker-compose.yml targets Docker, where bind mounts work without SELinux relabel flags. On SELinux-enforcing systems (Fedora, RHEL), bind-mounted host directories keep the user_home_t label, which container processes (container_t) cannot read — the mounts fail silently or with permission errors. Podman's :z flag relabels the source to container_file_t to fix this.

Changes

• selinux-override.yml (new) — adds the :z flag to all 28 bind mounts across postgres, netbox, netbox-worker, and orchestrator. Named volumes (db-data, netbox-media-files, netbox-redis-cache-data) are deliberately excluded: Podman creates them already labeled container_file_t, so :z is unnecessary there. Applied with:
podman-compose -f docker-compose.yml -f selinux-override.yml up
• README.md — new "Podman / SELinux notes" subsection under "Start application" covering three issues Podman users hit:

1. Host port 80 — rootless Podman cannot bind ports below 1024 (kernel-reserved for root); remap nginx to e.g. 8082:80 or run as root.
2. depends_on with required: false — podman-compose does not honour the flag, so the absent embeddings container (gated behind the embeddings profile) silently leaves orchestrator and downstream services in Created. Workaround: enable the profile (COMPOSE_PROFILES=embeddings) or drop the dependency via an override.
3. SELinux :z flags — bind mounts need relabeling to container_file_t; named volumes do not.

What this does not change

docker-compose.yml is untouched. Docker users see no behavior change; the override is opt-in for Podman/SELinux environments

[Mark90]

Nice, thanks!