From c484109f1ce62ca45af2aae337cb5303994aa61c Mon Sep 17 00:00:00 2001
From: Timothy Kim <timothykim@fastmail.fm>
Date: Fri, 13 Mar 2026 17:08:19 -0400
Subject: [PATCH] merge dispatch and deploy into a single deploy.sh

deploy.sh reads SSH_ORIGINAL_COMMAND directly, validates it, and
runs the deploy. No more dispatch indirection.
---
 README.md                  |  9 ++++-----
 scripts/deploy-dispatch.sh |  9 ---------
 scripts/deploy.sh          | 10 +++++++++-
 setup.sh                   |  2 +-
 4 files changed, 14 insertions(+), 16 deletions(-)
 delete mode 100755 scripts/deploy-dispatch.sh

diff --git a/README.md b/README.md
index 8aa873f..902e839 100644
--- a/README.md
+++ b/README.md
@@ -11,8 +11,7 @@ docker/              # One directory per app, each with a compose.yml
   nginx/             # Nginx Proxy Manager (reverse proxy + TLS)
   timothykim.net/    # timothykim.net static site
 scripts/
-  deploy-dispatch.sh # SSH command dispatcher (validates and routes deploy commands)
-  deploy.sh          # Generic deploy script (git pull + docker compose up)
+  deploy.sh          # Deploy script (validates command, git pull, docker compose up)
   new-app.sh         # Scaffolding script to add a new app
 setup.sh             # One-time server provisioning script
 .gitea/workflows/    # Per-app deploy workflows triggered by path changes
@@ -47,10 +46,10 @@ Each app has two components:
 1. **Gitea Actions workflow** (`.gitea/workflows/deploy-<app>.yml`) -- triggers
    on pushes to `main` when files under `docker/<app>/` change. SSHes into the
    server as the `deploy` user to trigger the deploy.
-2. **SSH dispatcher** (`scripts/deploy-dispatch.sh`) -- the `deploy` user's
+2. **Deploy script** (`scripts/deploy.sh`) -- the `deploy` user's
    `authorized_keys` is locked to this script via a `command=` directive. It
-   validates the command and runs `scripts/deploy.sh`, which pulls the latest
-   repo changes and runs `docker compose pull && up -d` for that app.
+   validates the command, pulls the latest repo changes, and runs
+   `docker compose pull && up -d` for that app.
 
 This means:
 
diff --git a/scripts/deploy-dispatch.sh b/scripts/deploy-dispatch.sh
deleted file mode 100755
index 7df1edc..0000000
--- a/scripts/deploy-dispatch.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-if [[ "$SSH_ORIGINAL_COMMAND" =~ ^deploy-[a-zA-Z0-9._-]+$ ]]; then
-    sudo /opt/hantim/scripts/deploy.sh "$SSH_ORIGINAL_COMMAND"
-else
-    echo "Unknown command: $SSH_ORIGINAL_COMMAND"
-    exit 1
-fi
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index d461155..af1de28 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -1,6 +1,14 @@
 #!/bin/bash
 set -euo pipefail
-APP="${1#deploy-}"
+
+CMD="${SSH_ORIGINAL_COMMAND:-${1:-}}"
+
+if ! [[ "$CMD" =~ ^deploy-[a-zA-Z0-9._-]+$ ]]; then
+    echo "Unknown command: $CMD"
+    exit 1
+fi
+
+APP="${CMD#deploy-}"
 cd /opt/hantim
 git pull
 cd "docker/$APP"
diff --git a/setup.sh b/setup.sh
index bb7e9d3..ef256d1 100755
--- a/setup.sh
+++ b/setup.sh
@@ -84,7 +84,7 @@ mkdir -p /home/deploy/.ssh
 chmod 700 /home/deploy/.ssh
 if [ ! -f /home/deploy/.ssh/authorized_keys ]; then
     echo "WARNING: Add the CI public key manually:"
-    echo '  command="/opt/hantim/scripts/deploy-dispatch.sh",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty ssh-ed25519 <KEY>'
+    echo '  command="sudo /opt/hantim/scripts/deploy.sh",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty ssh-ed25519 <KEY>'
     echo "  into /home/deploy/.ssh/authorized_keys"
 fi
 chown -R deploy:deploy /home/deploy/.ssh