deploy: Docker compose + entrypoint (pull-loop autosync), Nix revert script, .env (gitignored) for Gitea deploy token

deploy/revert-kontra-nix.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Revert ALL Kontra additions from /etc/nixos/configuration.nix on .13.
+# Restores the untouched pre-Kontra backup, then rebuilds (removes systemd kontra + pull + caddy vhosts).
+# Run as:  sudo bash revert-kontra-nix.sh
+set -euo pipefail
+
+CFG=/etc/nixos/configuration.nix
+PRE=/etc/nixos/configuration.nix.bak-kontra-20260908-195305   # first backup = pre-Kontra (no additions)
+
+if [ ! -f "$PRE" ]; then
+  echo "!! pre-Kontra backup not found at $PRE — aborting (nothing reverted)."
+  exit 1
+fi
+
+# Safety: confirm the CURRENT file actually contains Kontra markers before overwriting
+if ! grep -q "KONTRA" "$CFG"; then
+  echo "!! Current configuration.nix has no Kontra markers. Leaving as-is."
+  exit 0
+fi
+
+echo "== restoring pre-Kontra configuration.nix"
+cp -a "$PRE" "$CFG"
+echo "   restored. Kontra markers now: $(grep -c CONTRA "$CFG" || true)"
+
+echo "== Nix syntax check"
+nix-instantiate --parse "$CFG" >/dev/null && echo "OK" || { echo "SYNTAX FAIL — no change made"; exit 1; }
+
+echo "== nixos-rebuild switch (removes kontra service + timer + caddy vhosts)"
+nixos-rebuild switch --show-trace 2>&1 | tail -20
+
+echo "== confirm removal"
+systemctl --no-pager list-units --all 2>/dev/null | grep -i kontra || echo "   no kontra units (clean)"
+echo "DONE — Kontra Nix additions reverted."