Rebuild: a proper deployment for voyager 2

Dockerfile with two targets: app (compiled AdonisJS, production
dependencies, Node 24.16 as in CI) and edge (the Rust worker, cargo
caches as build mounts). deploy/compose.yaml, project usenet-rebuild:
postgres (data on the HDD, catalog tablespace on the NVMe), migrate,
web, coordinator, edge; edge-ts and ace behind profiles.
deploy/deploy.sh (~/bin/deploy-usenet-rebuild on homelab): fetches the
commit (must be on rebuild), builds, migrates, recreates web,
coordinator and edge (the worker stopped first), never postgres.

CI deploys a push to rebuild that passes: the deploy key's forced
command passes "deploy-rebuild <sha>" on. A push to master no longer
deploys from this branch's workflow. deploy/README.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/deploy.sh

@@ -0,0 +1,52 @@
+#!/bin/sh
+# Deploys voyager 2 (branch rebuild) on homelab at one commit. Installed as
+# ~/bin/deploy-usenet-rebuild (by hand: it doesn't update itself). Gitea CI
+# runs it through the forced SSH command of the deploy key, as
+# "deploy-rebuild <sha>" (~/bin/deploy-usenet-indexer passes that on); by
+# hand: deploy-usenet-rebuild <sha>. The code comes from the Gitea repo, not
+# from the CI job.
+set -eu
+
+REPO=https://gitea.exp.sforum.nl/daan/usenet-indexer.git
+BRANCH=rebuild
+ROOT=/mnt/bulk/usenet-rebuild
+CACHE="$ROOT/.cache"
+GIT="$CACHE/repo.git"
+
+SHA="${1:-}"
+case "$SHA" in
+  *[!0-9a-f]* | "") echo "usage: deploy-usenet-rebuild <40-character commit sha>" >&2; exit 2 ;;
+esac
+[ "${#SHA}" -eq 40 ] || { echo "usage: deploy-usenet-rebuild <40-character commit sha>" >&2; exit 2; }
+
+mkdir -p "$CACHE"
+# One deploy at a time; a second one waits.
+exec 9>"$CACHE/deploy.lock"
+flock 9
+
+echo "== fetching $SHA"
+[ -d "$GIT" ] || git clone --quiet --bare "$REPO" "$GIT"
+git -C "$GIT" fetch --quiet --prune "$REPO" '+refs/heads/*:refs/heads/*'
+git -C "$GIT" cat-file -e "$SHA^{commit}"
+git -C "$GIT" merge-base --is-ancestor "$SHA" "refs/heads/$BRANCH" || { echo "$SHA is not on $BRANCH" >&2; exit 2; }
+
+STAGE=$(mktemp -d)
+trap 'rm -rf "$STAGE"' EXIT
+git -C "$GIT" archive "$SHA" | tar -x -C "$STAGE"
+rsync -a --delete "$STAGE"/ "$ROOT/src/"
+install -m 644 "$ROOT/src/deploy/compose.yaml" "$ROOT/compose.yaml"
+
+cd "$ROOT"
+echo "== building images"
+docker compose build migrate edge
+echo "== running migrations"
+docker compose run --rm --no-deps migrate
+# Only the app services, never postgres. The worker first: one holding a
+# stream keeps the web server from exiting.
+echo "== recreating app services"
+docker compose stop edge
+docker compose up -d --no-deps web coordinator
+docker compose up -d --no-deps edge
+echo "$SHA $(date -Is)" >> "$ROOT/deployed.log"
+docker compose ps --format '{{.Service}} {{.Status}}' web coordinator edge
+echo "== deployed $SHA"