DokPloy's redeploy process rm -rf's the host code dir and recreates it.
The cron container is `restart: unless-stopped` so docker-compose
doesn't recreate it when only scripts/* change — but its bind mount on
./scripts:/app/scripts then points at orphaned inodes inside the
running container, leaving /app/scripts empty until someone manually
`docker restart`s it.
Bake the scripts into the image instead. A scripts/* change now forces
a Dockerfile rebuild → docker-compose recreates the cron service →
fresh /app/scripts inside, no manual restart required. content/ and
.git/ stay bind-mounted because the export job needs to write commits
the host can see.
Also adds .dockerignore so the host's scripts/node_modules (potentially
darwin-specific) doesn't get COPY'd into the alpine image and shadow
the deps installed by `npm install` at build time.
The cron has been silently failing every day since 2026-03-28. Four
independent bugs were stacked:
1. cron/entrypoint.sh: env dump used `sed` to wrap each line in
`export `, but values with spaces (e.g. GIT_SSH_COMMAND, OIDC_SCOPES)
produced lines like `export GIT_SSH_COMMAND=ssh -o UserKnownHosts...`
which `export` parses as a flag and aborts. busybox ash treats the
builtin error as fatal, so `. /etc/environment.sh; script.sh` never
reaches the script. Now single-quote each value with proper escaping.
2. cron/Dockerfile: NODE_PATH only works for CommonJS `require()`, not
ESM `import`. The export script is `"type": "module"` and failed with
"Cannot find package 'gray-matter'". Install deps at /app/node_modules
instead — Node ESM walks up from /app/scripts and finds it there.
3. docker-compose.yml: `~/.ssh:/root/.ssh:ro` — DokPloy does NOT expand
`~`, so it created a literal `~` directory inside the deployment dir
and mounted that empty dir. The container had no SSH key. Use the
absolute host path `/root/.ssh` instead.
4. cron/entrypoint.sh: even with the SSH key, `git push` would fail
because the git remote is HTTPS and the host's git server runs on
port 2222 (set in /root/.ssh/config). Add a `pushInsteadOf` rewrite
so push uses SSH while DokPloy can keep fetching via HTTPS, and stop
re-running ssh-keyscan against the wrong port — copy the host's
known_hosts (which already has the :2222 entry) instead.
- nginx: deny all requests to hidden files (/.git/config was publicly readable)
- nginx: remove CSS injection and /custom/ static file serving
- cron: install script deps at build time into /opt to avoid ro mount conflict
- docker-compose: widen cron build context for package.json COPY
- Delete unused theme/ghost-guild.css
Alpine crond doesn't inherit the container environment, so
OUTLINE_API_TOKEN and other vars were missing. Dump env at
startup and source it in each cron entry.
- Add cron service to docker-compose with backup (3 AM) and export (4 AM) schedules
- Remove redundant content/articles/ and content/curriculum/ (now in Outline, exported to content/wiki/)
- Fix env var mismatch: support both OUTLINE_API_KEY and OUTLINE_API_TOKEN
- Drop updatedAt from export frontmatter to reduce noisy commits
- Add backups/ to gitignore
