Switch deploy pipeline to Gitea polling; fix env-parsing and volume-isolation bugs

- Replace the bare-repo post-receive hook with deploy/poll-deploy.sh: Gitea
  and the Docker hosts are separate machines, so each box polls its branch
  via host crontab instead of needing an exposed webhook receiver.
- Add Blocksy theme + Blocksy Companion auto-install to deploy.sh (free
  tier; the paid Book Store starter site still needs a manual license step).
- Fix deploy.sh/backup.sh/restore.sh sourcing .env files as bash: a bcrypt
  hash's `$2a$14$...` shape breaks under `set -u`. Replaced with
  deploy/lib/env.sh, a literal (non-executing) KEY=VALUE reader.
- Fix docker compose itself mangling the same kind of value: both
  `environment: ${VAR}` and `env_file:` run values through Compose's
  interpolation, which silently blanks `$identifier`-shaped substrings.
  The staging basic-auth hash is now rendered directly into the Caddyfile
  by deploy.sh, bypassing Compose's variable system entirely.
- Fix dev/staging/production silently sharing one Compose project (and
  therefore one db_data volume) by pinning an explicit -p per environment.
- cron and wordpress now share one environment anchor so they can't drift
  apart again (cron was silently missing WORDPRESS_CONFIG_EXTRA before).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/backup.sh

@@ -8,16 +8,17 @@ REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$REPO_ROOT"
 
 ENV_FILE=".env.${ENVIRONMENT}"
-set -a
-# shellcheck disable=SC1090
-source "$ENV_FILE"
-set +a
+# shellcheck source=lib/env.sh
+source "$REPO_ROOT/deploy/lib/env.sh"
 
 TIMESTAMP="$(date +%Y%m%d-%H%M%S)"
+BACKUP_DIR="$(env_get "$ENV_FILE" BACKUP_DIR)"
+BACKUP_REMOTE="$(env_get "$ENV_FILE" BACKUP_REMOTE)"
+BACKUP_RETENTION_DAYS="$(env_get "$ENV_FILE" BACKUP_RETENTION_DAYS)"
 BACKUP_DIR="${BACKUP_DIR:-./backups}/${ENVIRONMENT}"
 mkdir -p "$BACKUP_DIR"
 
-COMPOSE="docker compose -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${ENV_FILE}"
+COMPOSE="docker compose -p bookstore-${ENVIRONMENT} -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${ENV_FILE}"
 
 echo "==> dumping database"
 $COMPOSE exec -T db sh -c "exec mysqldump -u\"\$MARIADB_USER\" -p\"\$MARIADB_PASSWORD\" \"\$MARIADB_DATABASE\"" \

deploy/deploy.sh

@@ -18,12 +18,32 @@ if [[ ! -f "$ENV_FILE" ]]; then
   echo "missing $ENV_FILE — copy .env.example to $ENV_FILE and fill it in" >&2
   exit 1
 fi
-set -a
-# shellcheck disable=SC1090
-source "$ENV_FILE"
-set +a
+# shellcheck source=lib/env.sh
+source "$REPO_ROOT/deploy/lib/env.sh"
 
-COMPOSE="docker compose -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${ENV_FILE}"
+SITE_URL="$(env_get "$ENV_FILE" SITE_URL)"
+SITE_TITLE="$(env_get "$ENV_FILE" SITE_TITLE)"
+WP_ADMIN_USER="$(env_get "$ENV_FILE" WP_ADMIN_USER)"
+WP_ADMIN_PASSWORD="$(env_get "$ENV_FILE" WP_ADMIN_PASSWORD)"
+WP_ADMIN_EMAIL="$(env_get "$ENV_FILE" WP_ADMIN_EMAIL)"
+
+# -p pins the Compose project name to the environment (default is the
+# directory name, which every environment shares — that made staging quietly
+# reuse dev's db_data volume/credentials the first time this ran).
+COMPOSE="docker compose -p bookstore-${ENVIRONMENT} -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${ENV_FILE}"
+
+if [[ "$ENVIRONMENT" == "staging" ]]; then
+  echo "==> rendering Caddyfile.staging (basic-auth hash bypasses compose entirely)"
+  mkdir -p docker/caddy/.generated
+  AUTH_USER="$(env_get "$ENV_FILE" STAGING_BASIC_AUTH_USER)"
+  AUTH_HASH="$(env_get "$ENV_FILE" STAGING_BASIC_AUTH_HASH)"
+  : "${AUTH_USER:?set STAGING_BASIC_AUTH_USER in ${ENV_FILE}}"
+  : "${AUTH_HASH:?set STAGING_BASIC_AUTH_HASH in ${ENV_FILE} — see .env.example for how to generate it}"
+  TEMPLATE="$(cat docker/caddy/Caddyfile.staging)"
+  TEMPLATE="${TEMPLATE//__STAGING_BASIC_AUTH_USER__/$AUTH_USER}"
+  TEMPLATE="${TEMPLATE//__STAGING_BASIC_AUTH_HASH__/$AUTH_HASH}"
+  printf '%s\n' "$TEMPLATE" > docker/caddy/.generated/Caddyfile.staging
+fi
 
 echo "==> building and starting ${ENVIRONMENT}"
 $COMPOSE up -d --build

deploy/hooks/post-receive

@@ -1,26 +0,0 @@
-#!/usr/bin/env bash
-# Install this at <bare-repo>.git/hooks/post-receive on your own Git server
-# (chmod +x it) and adjust DEPLOY_ROOT below. Pushing to `staging` deploys
-# to the staging checkout; pushing to `main` deploys to production.
-#
-#   git remote add origin <you>@<git-server>:/srv/git/bookstore.git
-#   git push origin staging
-#
-set -euo pipefail
-
-DEPLOY_ROOT="/srv/bookstore"
-
-while read -r oldrev newrev refname; do
-  branch="${refname#refs/heads/}"
-
-  case "$branch" in
-    staging)   target="$DEPLOY_ROOT/staging";    env="staging" ;;
-    main)      target="$DEPLOY_ROOT/production"; env="production" ;;
-    *)         echo "post-receive: ignoring push to $branch"; continue ;;
-  esac
-
-  echo "post-receive: deploying $branch -> $env ($target)"
-  mkdir -p "$target"
-  git --work-tree="$target" --git-dir="$(pwd)" checkout -f "$branch"
-  ( cd "$target" && ./deploy/deploy.sh "$env" )
-done

deploy/lib/env.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Reads one KEY=VALUE out of a .env-style file WITHOUT ever executing the
+# file as shell. `source`-ing a .env file breaks the moment a value contains
+# characters bash treats specially — e.g. a Caddy bcrypt hash
+# ($2a$14$...) looks like positional-parameter expansions ($2, $14, ...) to
+# bash and blows up under `set -u`. docker compose's own --env-file parser
+# already treats these files as literal key=value data; this matches that.
+env_get() {
+  local file="$1" key="$2" line val
+  line="$(grep -m1 -E "^${key}=" "$file" 2>/dev/null || true)"
+  val="${line#*=}"
+  if [[ "$val" == \"*\" && "$val" == *\" ]]; then
+    val="${val#\"}"; val="${val%\"}"
+  elif [[ "$val" == \'*\' && "$val" == *\' ]]; then
+    val="${val#\'}"; val="${val%\'}"
+  fi
+  printf '%s' "$val"
+}

deploy/poll-deploy.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Meant to run via the HOST's system crontab on each environment's box (not
+# inside a container) — Gitea lives on a separate machine, so rather than
+# exposing an inbound webhook receiver on staging/production, each box just
+# polls its branch and redeploys when it moves. Silent when there's nothing
+# new, so it's safe to run every couple of minutes from cron.
+#
+# Example crontab line (staging box):
+#   */2 * * * * /srv/bookstore/deploy/poll-deploy.sh staging >> /var/log/bookstore-deploy.log 2>&1
+set -euo pipefail
+
+ENVIRONMENT="${1:?Usage: poll-deploy.sh <staging|production>}"
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+case "$ENVIRONMENT" in
+  staging)    BRANCH=staging ;;
+  production) BRANCH=main ;;
+  *) echo "environment must be 'staging' or 'production'" >&2; exit 1 ;;
+esac
+
+BEFORE="$(git rev-parse HEAD)"
+git fetch origin "$BRANCH" --quiet
+AFTER="$(git rev-parse "origin/${BRANCH}")"
+
+if [[ "$BEFORE" == "$AFTER" ]]; then
+  exit 0
+fi
+
+echo "$(date -Is) deploying ${ENVIRONMENT} (${BRANCH}): ${BEFORE:0:7} -> ${AFTER:0:7}"
+git checkout -f "$BRANCH"
+git reset --hard "origin/${BRANCH}"
+"$REPO_ROOT/deploy/deploy.sh" "$ENVIRONMENT"

deploy/restore.sh

@@ -10,12 +10,8 @@ REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$REPO_ROOT"
 
 ENV_FILE=".env.staging"
-set -a
-# shellcheck disable=SC1090
-source "$ENV_FILE"
-set +a
 
-COMPOSE="docker compose -f docker-compose.yml -f docker-compose.staging.yml --env-file ${ENV_FILE}"
+COMPOSE="docker compose -p bookstore-staging -f docker-compose.yml -f docker-compose.staging.yml --env-file ${ENV_FILE}"
 
 echo "!! this OVERWRITES the staging database and uploads !!"
 read -r -p "type 'restore' to continue: " confirm