deploy: Docker compose + entrypoint (pull-loop autosync), Nix revert script, .env (gitignored) for Gitea deploy token

deploy/fix-pull2.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Fix kontra-pull.sh: use runuser (not su) + point service at sam-writable deploy path.
+set -euo pipefail
+CFG=/etc/nixos/configuration.nix
+BAK=$CFG.bak-kontra-fix2-$(date +%Y%m%d-%H%M%S)
+cp -a "$CFG" "$BAK"
+echo "backup: $BAK"
+
+# Replace the ExecStart path in the Nix config (pull service -> deploy/ copy)
+python3 - "$CFG" <<'PYEOF'
+import sys
+p = sys.argv[1]
+src = open(p).read()
+old = 'ExecStart = "/run/current-system/sw/bin/bash /var/www/kontra_day/bin/kontra-pull.sh";'
+new = 'ExecStart = "/run/current-system/sw/bin/bash /var/www/kontra_day/deploy/kontra-pull.sh";'
+if old in src:
+    src = src.replace(old, new)
+else:
+    print("WARN: old ExecStart not found; check manually")
+open(p,'w').write(src)
+PYEOF
+grep -n "kontra-pull.sh" "$CFG"
+
+# Install fixed script into deploy/ (sam-writable)
+cat > /var/www/kontra_day/deploy/kontra-pull.sh <<'SH'
+#!/bin/sh
+set -e
+CONTENT=/var/www/kontra_day/content
+GIT=/run/current-system/sw/bin/git
+RUNUSER=/run/current-system/sw/bin/runuser
+BEFORE=$("$RUNUSER" -u sam -- "$GIT" -C "$CONTENT" rev-parse HEAD)
+"$RUNUSER" -u sam -- "$GIT" -C "$CONTENT" pull --ff-only origin main >/tmp/kontra-pull.log 2>&1 || { echo "pull failed:"; cat /tmp/kontra-pull.log; exit 1; }
+AFTER=$("$RUNUSER" -u sam -- "$GIT" -C "$CONTENT" rev-parse HEAD)
+if [ -n "$BEFORE" ] && [ -n "$AFTER" ] && [ "$BEFORE" != "$AFTER" ]; then
+  echo "content changed: $BEFORE -> $AFTER; restarting kontra"
+  /run/current-system/sw/bin/systemctl restart kontra.service
+fi
+exit 0
+SH
+chmod 0755 /var/www/kontra_day/deploy/kontra-pull.sh
+
+# syntax check
+nix-instantiate --parse "$CFG" >/dev/null && echo "Nix syntax OK" || { echo "SYNTAX FAIL"; cp -a "$BAK" "$CFG"; exit 1; }
+
+echo "== nixos-rebuild switch =="
+nixos-rebuild switch --show-trace 2>&1 | tail -20
+echo "== force a run + status =="
+systemctl start kontra-pull.service 2>&1 | head -2
+sleep 3
+systemctl --no-pager status kontra-pull.service 2>/dev/null | head -8
+echo "== content head =="
+cd /var/www/kontra_day/content && git log --oneline -1
+echo "DONE"