update docs, fix deploy to not restart unchanged services

- deploy.sh: use compose up instead of down+up, fetch secrets individually
- configure.sh: delegate all service deployment to deploy.sh
- docs: add garage cluster init, .env.keys mechanism, update configure.sh description
- remove 2>/dev/null from bws calls

README.md

@@ -16,7 +16,9 @@ docker/
     compose.yml
   garage/              # Garage S3-compatible object storage
     compose.yml
-    garage.toml.template
+    Dockerfile
+    garage.toml
+    .env.keys
 scripts/
   bootstrap.sh         # First-time server setup (manual, uses Bitwarden)
   configure.sh         # Idempotent server config (CI-safe)
@@ -51,8 +53,11 @@ bash /opt/hantim/scripts/bootstrap.sh
 `configure.sh` is idempotent and CI-safe. It:
 
 1. Opens firewall ports (HTTP, HTTPS, Garage RPC)
-2. Sets up certbot and issues SSL certificates for all configured domains
-3. Starts all services (nginx first, then all apps)
+2. Sets up certbot renewal hooks and timer
+3. Deploys all services via `deploy.sh` (nginx first, then all apps)
+   - Generates `.env` files from bws for services with `.env.keys`
+   - Issues SSL certs for new domains (nginx only)
+   - Builds or pulls images, starts containers
 
 **Prerequisites**:
 - DNS for all configured domains must point to the server
@@ -95,6 +100,25 @@ git add . && git commit -m "initial content" && git push
 - `deploy.sh` pulls the latest code and runs `docker compose up -d`
 - For nginx deploys, the config is tested before applying to prevent downtime
 
+## Garage cluster initialization
+
+After provisioning a fresh server, Garage starts and connects to argento
+automatically via `bootstrap_peers`. However, the cluster layout must be
+assigned manually (node IDs change on fresh installs):
+
+```bash
+# Check both nodes are connected
+docker exec garage /garage status
+
+# Assign roles (use the node IDs from status output)
+docker exec garage /garage layout assign <hantim-node-id> -z hantim -c 1G
+docker exec garage /garage layout assign <argento-node-id> -z argento -c 1G
+docker exec garage /garage layout apply --version 1
+```
+
+This only needs to be done once. If only hantim is reprovisioned, argento
+retains the layout and hantim reconnects automatically.
+
 ## Restoring from backup
 
 Run the same three commands as provisioning. `bootstrap.sh` is idempotent:
@@ -113,9 +137,18 @@ Bitwarden Secrets Manager (project: `hantim`, fetched via `bws` CLI on the serve
 | `hantim-deploy-ssh-private-key` | Deploy user's SSH private key | `new-app.sh` |
 | `hantim-new-app-script` | Gitea API token for creating repos | `new-app.sh` |
 | `hantim-vultr-api-key` | Vultr API key for DNS management | `new-app.sh` |
+| `hantim-garage-rpc-secret` | Garage cluster RPC secret | `deploy.sh` |
+| `hantim-garage-argento-node-id` | Argento's Garage node ID + address | `deploy.sh` |
 
 Machine accounts: `hantim-server` (token at `/etc/bws-token`), `hantim-ci` (reserved).
 
+### Service secrets (`.env.keys`)
+
+Services that need secrets declare them in a `.env.keys` file (format:
+`ENV_VAR=bws-secret-name`, one per line). `deploy.sh` reads this file,
+fetches each secret from bws, and generates a `.env` file before starting
+the service. See `docker/garage/.env.keys` for an example.
+
 Gitea org-level (`hantim`) secrets/variables:
 
 | Name | Type | Purpose |