deploy: Docker compose + entrypoint (pull-loop autosync), Nix revert script, .env (gitignored) for Gitea deploy token

deploy/docker/entrypoint.sh

@@ -0,0 +1,55 @@
+#!/bin/sh
+# Kontra container entrypoint.
+# - pulls content from Gitea every 30s
+# - runs the webserver; restarts on content change (binary loads content at boot)
+set -eu
+
+BIN="${1:-kontra-bin}"
+PORT="${2:-8600}"
+CONTENT="/var/www/kontra_day/content"
+GIT=/usr/bin/git
+
+# Gitea SSH key for sam (mounted into the container)
+export GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new -i /root/.ssh/id_ed25519"
+
+# git refuses repos owned by another uid (host sam=1000); trust the mounted repo.
+"$GIT" config --global --add safe.directory "$CONTENT" >/dev/null 2>&1 || true
+"$GIT" config --global user.email "kontra-bot@localhost" >/dev/null 2>&1 || true
+"$GIT" config --global user.name "kontra-bot" >/dev/null 2>&1 || true
+
+# Initial clone if the mounted dir is empty (fresh deployment).
+if [ ! -d "$CONTENT/.git" ]; then
+  echo "cloning kontra-content..."
+  "$GIT" clone git@gitea.lab.audasmedia.com.au:2222/sam/kontra-content.git "$CONTENT"
+fi
+
+"$GIT" -C "$CONTENT" rev-parse --is-inside-work-tree >/dev/null 2>&1 || true
+
+start_server() {
+  # exec: replaces THIS shell, so $! is the real binary PID; kill hits it.
+  KONTRA_CONTENT="$CONTENT" KONTRA_MEDIA="/media" PORT="$PORT" exec "$BIN"
+}
+
+# First start.
+start_server &
+SERVER_PID=$!
+
+# Pull every 30s; restart server when HEAD actually changes.
+PREV=$("$GIT" -C "$CONTENT" rev-parse HEAD 2>/dev/null || echo "")
+while true; do
+  sleep 30
+  if "$GIT" -C "$CONTENT" pull --ff-only origin main >/tmp/pull.log 2>&1; then
+    CUR=$("$GIT" -C "$CONTENT" rev-parse HEAD)
+    if [ -n "$PREV" ] && [ -n "$CUR" ] && [ "$PREV" != "$CUR" ]; then
+      echo "$(date +%T) content changed ($PREV -> $CUR); restarting server"
+      kill "$SERVER_PID" 2>/dev/null || true
+      wait "$SERVER_PID" 2>/dev/null || true
+      sleep 1
+      start_server &
+      SERVER_PID=$!
+    fi
+    PREV=$CUR
+  else
+    echo "pull failed:"; cat /tmp/pull.log
+  fi
+done