deploy: Docker compose + entrypoint (pull-loop autosync), Nix revert script, .env (gitignored) for Gitea deploy token

deploy/patch-nix.py

@@ -0,0 +1,73 @@
+#!/usr/bin/env python3
+"""Apply Kontra additions to a copy of configuration.nix. Test on /tmp, then run on .13."""
+import sys
+
+path = sys.argv[1]
+src = open(path).read()
+
+# --- 1) Caddy extraConfig: append reverse_proxy block before closing ''; ---
+caddy_add = """
+http://kontra.lab.audasmedia.com.au:8000 {
+     reverse_proxy localhost:8600
+   }
+http://admin.kontra.lab.audasmedia.com.au:8000 {
+     reverse_proxy localhost:8600
+   }
+http://kontra.home.lab:8000 {
+     reverse_proxy localhost:8600
+   }
+"""
+needle = "\n'';"
+idx_caddy = src.index("services.caddy")
+i = src.index(needle, idx_caddy)
+src = src[:i] + caddy_add + needle + src[i + len(needle):]
+
+# --- Step 2) systemd service + timer after services.caddy closes ---
+services_add = """
+# --- KONTRA (GOTH news-opinion site) ---
+systemd.services.kontra = {
+    description = "Kontra GOTH news-opinion site";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+        Type = "simple";
+        User = "sam";
+        Group = "users";
+        WorkingDirectory = "/var/www/kontra_day";
+        Environment = [ "KONTRA_CONTENT=/var/www/kontra_day/content" "KONTRA_MEDIA=/media" "PORT=8600" ];
+        ExecStart = "/var/www/kontra_day/bin/kontra-bin";
+        Restart = "on-failure";
+        RestartSec = "3";
+        NoNewPrivileges = true;
+    };
+};
+
+systemd.services.kontra-pull = {
+    description = "Pull Kontra content from Gitea (30s timer)";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "/run/current-system/sw/bin/bash /var/www/kontra_day/deploy/kontra-pull.sh";
+    };
+};
+
+systemd.timers.kontra-pull = {
+    description = "Kontra content pull timer (30s)";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+        OnBootSec = "30s";
+        OnUnitActiveSec = "30s";
+        AccuracySec = "2s";
+    };
+};
+"""
+anchor = "services.caddy"
+idx = src.index(anchor)
+close = src.find("};", idx)  # closes services.caddy attr
+insert_at = close + 2
+src = src[:insert_at] + "\n" + services_add + src[insert_at:]
+
+open(path, "w").write(src)
+print("patched:", path)