From 0eea672450447fc678f8073307a2e9139dd85616 Mon Sep 17 00:00:00 2001
From: Void Agent <void@jayrup.hermes>
Date: Thu, 22 Oct 2026 23:13:43 +0100
Subject: deploy: detect a detached nginx.conf bind mount instead of trusting
 reload

The single-file mount pins the inode present when the container started. A
rename-based write leaves the container serving stale bytes while nginx -t
validates them, which is exactly how the previous deploy reported success
with an unchanged config. Compare the host and in-container checksums after
the reload and restart the container to re-resolve the path on mismatch.
---
 deploy-docker.sh | 14 ++++++++++++++
 deploy.sh        | 14 ++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/deploy-docker.sh b/deploy-docker.sh
index 12d4a54..0d1100d 100755
--- a/deploy-docker.sh
+++ b/deploy-docker.sh
@@ -89,4 +89,18 @@ else
     exit 1
 fi
 
+# A single-file bind mount pins whatever inode existed when the container
+# started. If the host file was ever replaced by rename (an older deploy, an
+# editor, `cp`), the container keeps serving the old bytes while `nginx -t`
+# validates them happily. Compare what the container actually sees and restart
+# to re-resolve the path if it has drifted.
+HOST_MD5="$(ssh "$DEPLOY_HOST" 'md5sum ~/homepage/nginx.conf' | cut -d' ' -f1)"
+CTR_MD5="$(ssh "$DEPLOY_HOST" 'docker exec homepage md5sum /etc/nginx/conf.d/default.conf' | cut -d' ' -f1)"
+if [ "$HOST_MD5" != "$CTR_MD5" ]; then
+    echo "!! container is serving a stale nginx.conf (bind mount detached) - restarting" >&2
+    ssh "$DEPLOY_HOST" 'docker restart homepage'
+    CTR_MD5="$(ssh "$DEPLOY_HOST" 'docker exec homepage md5sum /etc/nginx/conf.d/default.conf' | cut -d' ' -f1)"
+    [ "$HOST_MD5" = "$CTR_MD5" ] || { echo "!! nginx.conf still not mounted - aborting" >&2; exit 1; }
+fi
+
 echo ">> deploy OK ($SHORT_SHA)"
diff --git a/deploy.sh b/deploy.sh
index e68ee92..1849e64 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -81,3 +81,17 @@ else
     ssh "$DEPLOY_HOST" 'cat ~/homepage/nginx.conf.prev > ~/homepage/nginx.conf'
     exit 1
 fi
+
+# A single-file bind mount pins whatever inode existed when the container
+# started. If the host file was ever replaced by rename (an older deploy, an
+# editor, `cp`), the container keeps serving the old bytes while `nginx -t`
+# validates them happily. Compare what the container actually sees and restart
+# to re-resolve the path if it has drifted.
+HOST_MD5="$(ssh "$DEPLOY_HOST" 'md5sum ~/homepage/nginx.conf' | cut -d' ' -f1)"
+CTR_MD5="$(ssh "$DEPLOY_HOST" 'docker exec homepage md5sum /etc/nginx/conf.d/default.conf' | cut -d' ' -f1)"
+if [ "$HOST_MD5" != "$CTR_MD5" ]; then
+    echo "!! container is serving a stale nginx.conf (bind mount detached) - restarting" >&2
+    ssh "$DEPLOY_HOST" 'docker restart homepage'
+    CTR_MD5="$(ssh "$DEPLOY_HOST" 'docker exec homepage md5sum /etc/nginx/conf.d/default.conf' | cut -d' ' -f1)"
+    [ "$HOST_MD5" = "$CTR_MD5" ] || { echo "!! nginx.conf still not mounted - aborting" >&2; exit 1; }
+fi
-- 
cgit v1.2.3