1 files changed, 22 insertions, 4 deletions
diff --git a/deploy-docker.sh b/deploy-docker.sh
index 2e72954..716bb8d 100755
--- a/deploy-docker.sh
+++ b/deploy-docker.sh
@@ -57,14 +57,32 @@ cp cv/index.txt public/cv.txt
 cp -r assets/* public/
 cp -r assets/* public/assets/
 
-# nginx maps curl/wget UAs to .txt, so `curl https://jayrup.me/public_key`
-# resolves to /public_key.txt. Single source of truth stays assets/public_key;
-# browsers keep getting the suffixless /public_key.
-cp assets/public_key public/public_key.txt
+# .txt twin for curl/wget: normalize to exactly one line ending in a newline,
+# so `curl https://jayrup.me/public_key >> ~/.ssh/authorized_keys` appends a
+# clean key instead of gluing itself onto the previous line.
+KEY="$(tr -d '\r' < assets/public_key | sed -e 's/[[:space:]]*$//' | tr -d '\n')"
+[ -n "$KEY" ] || { echo "assets/public_key is empty" >&2; exit 1; }
+printf '%s\n' "$KEY" > public/public_key.txt
 
 # Deploy status marker — site-visible proof of the last successful deploy
 printf 'deployed %s commit %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHORT_SHA" > public/last-deploy.txt
 
 echo ">> pushing to $DEPLOY_HOST"
 rsync -avz --delete public/ "$DEPLOY_HOST":~/homepage/public/
+
+# nginx config is bind-mounted into the container, so it does not travel with
+# public/. Test before reloading: a bad file must not take down the running
+# workers, so restore the previous one and fail loudly instead.
+echo ">> pushing nginx.conf"
+ssh "$DEPLOY_HOST" 'cp -a ~/homepage/nginx.conf ~/homepage/nginx.conf.prev'
+rsync -avz nginx.conf "$DEPLOY_HOST":~/homepage/nginx.conf
+if ssh "$DEPLOY_HOST" 'docker exec homepage nginx -t'; then
+    ssh "$DEPLOY_HOST" 'docker exec homepage nginx -s reload'
+    echo ">> nginx reloaded"
+else
+    echo "!! nginx config failed its test - restoring previous config" >&2
+    ssh "$DEPLOY_HOST" 'mv ~/homepage/nginx.conf.prev ~/homepage/nginx.conf'
+    exit 1
+fi
+
 echo ">> deploy OK ($SHORT_SHA)"