deploy: Docker compose + entrypoint (pull-loop autosync), Nix revert script, .env (gitignored) for Gitea deploy token

deploy/docker/Dockerfile

@@ -0,0 +1,27 @@
+# Kontra — GOTH news-opinion site. Self-contained container.
+# Build context = /home/sam/Docker/Containers/kontra (has src/{go.mod,go.sum,src/...})
+FROM golang:1.26-bookworm AS build
+# templ CLI for codegen (generates *_templ.go before build)
+RUN go install github.com/a-h/templ/cmd/templ@v0.3.1020
+ENV PATH="/root/go/bin:${PATH}"
+WORKDIR /src
+COPY src/go.mod src/go.sum ./
+RUN go mod download
+COPY src/src/ ./src/
+WORKDIR /src/src
+RUN templ generate
+RUN go build -trimpath -ldflags="-s -w" -o /kontra-bin .
+
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates git openssh-client bash \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY --from=build /kontra-bin /usr/local/bin/kontra-bin
+
+# entrypoint (pull loop + webserver) from runtime mount
+COPY entrypoint.sh /usr/local/bin/kontra-entrypoint
+RUN chmod +x /usr/local/bin/kontra-entrypoint
+
+EXPOSE 8600
+ENTRYPOINT ["/usr/local/bin/kontra-entrypoint", "kontra-bin", "8600"]

deploy/docker/docker-compose.yml

@@ -0,0 +1,18 @@
+services:
+  kontra:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: kontra
+    restart: unless-stopped
+    ports:
+      - "8600:8600"
+    volumes:
+      - /var/www/kontra_day/content:/var/www/kontra_day/content
+      - /home/sam/.ssh/id_ed25519:/root/.ssh/id_ed25519:ro
+    environment:
+      - PORT=8600
+      - KONTRA_CONTENT=/var/www/kontra_day/content
+      - KONTRA_MEDIA=/media
+    extra_hosts:
+      - "gitea.lab.audasmedia.com.au:192.168.20.35"

deploy/docker/entrypoint.sh

@@ -0,0 +1,55 @@
+#!/bin/sh
+# Kontra container entrypoint.
+# - pulls content from Gitea every 30s
+# - runs the webserver; restarts on content change (binary loads content at boot)
+set -eu
+
+BIN="${1:-kontra-bin}"
+PORT="${2:-8600}"
+CONTENT="/var/www/kontra_day/content"
+GIT=/usr/bin/git
+
+# Gitea SSH key for sam (mounted into the container)
+export GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new -i /root/.ssh/id_ed25519"
+
+# git refuses repos owned by another uid (host sam=1000); trust the mounted repo.
+"$GIT" config --global --add safe.directory "$CONTENT" >/dev/null 2>&1 || true
+"$GIT" config --global user.email "kontra-bot@localhost" >/dev/null 2>&1 || true
+"$GIT" config --global user.name "kontra-bot" >/dev/null 2>&1 || true
+
+# Initial clone if the mounted dir is empty (fresh deployment).
+if [ ! -d "$CONTENT/.git" ]; then
+  echo "cloning kontra-content..."
+  "$GIT" clone git@gitea.lab.audasmedia.com.au:2222/sam/kontra-content.git "$CONTENT"
+fi
+
+"$GIT" -C "$CONTENT" rev-parse --is-inside-work-tree >/dev/null 2>&1 || true
+
+start_server() {
+  # exec: replaces THIS shell, so $! is the real binary PID; kill hits it.
+  KONTRA_CONTENT="$CONTENT" KONTRA_MEDIA="/media" PORT="$PORT" exec "$BIN"
+}
+
+# First start.
+start_server &
+SERVER_PID=$!
+
+# Pull every 30s; restart server when HEAD actually changes.
+PREV=$("$GIT" -C "$CONTENT" rev-parse HEAD 2>/dev/null || echo "")
+while true; do
+  sleep 30
+  if "$GIT" -C "$CONTENT" pull --ff-only origin main >/tmp/pull.log 2>&1; then
+    CUR=$("$GIT" -C "$CONTENT" rev-parse HEAD)
+    if [ -n "$PREV" ] && [ -n "$CUR" ] && [ "$PREV" != "$CUR" ]; then
+      echo "$(date +%T) content changed ($PREV -> $CUR); restarting server"
+      kill "$SERVER_PID" 2>/dev/null || true
+      wait "$SERVER_PID" 2>/dev/null || true
+      sleep 1
+      start_server &
+      SERVER_PID=$!
+    fi
+    PREV=$CUR
+  else
+    echo "pull failed:"; cat /tmp/pull.log
+  fi
+done