Homepage (TDD slice 6): the git-driven deploy

Red tests first.
- tests/homepage_deploy.bats: the deploy ships the homepage (assets to
  /srv/homepage, the checker timer, both Caddy hashes, deployed.js) and is
  git-driven (pulls main); the checker runs as a systemd timer.
- scripts/homepage-status.service / .timer: the checker as a oneshot service
  + a 3-minute timer (Q2/Q35).
- scripts/deploy.sh: the Caddyfile render now substitutes BOTH hashes
  (REPLACE_WITH_HASH <- CADDY_BASICAUTH_HASH, REPLACE_WITH_ADMIN_HASH <-
  CADDY_ADMIN_HASH). A new homepage step copies the assets to /srv/homepage,
  generates deployed.js from the deployed commit's datetime (Q43), installs
  the checker timer, and runs the checker once so status.json exists at once.
- tests/llm_units.bats: scoped the three LLM-unit tests to
  frank-default-*.service (the homepage unit is a different pattern: it
  installs to /usr/local/bin and runs from /srv at deploy time).

scripts/deploy.sh

@@ -160,18 +160,36 @@ if [ '${COPY_SHARED[$TARGET]}' = '1' ]; then
   cp shared/loki/loki-config.yaml /opt/loki/config/loki-config.yaml
   cp shared/alloy/config.alloy /opt/alloy/config/config.alloy
 
-  echo '  Rendering Caddyfile (basicauth hash from .env)...'
-  # Extract the hash with grep/cut rather than sourcing .env: sourcing a
+  echo '  Rendering Caddyfile (basicauth hashes from .env)...'
+  # Extract the hashes with grep/cut rather than sourcing .env: sourcing a
   # bcrypt value in a set -u shell dies on its dollar-sign expansion.
   CADDY_BASICAUTH_HASH=\"\$(grep -E '^CADDY_BASICAUTH_HASH=' .env | tail -1 | cut -d= -f2-)\"
-  if [ -z \"\${CADDY_BASICAUTH_HASH}\" ]; then
-    echo '  WARN: CADDY_BASICAUTH_HASH not set in .env; keeping placeholder'
-  else
+  CADDY_ADMIN_HASH=\"\$(grep -E '^CADDY_ADMIN_HASH=' .env | tail -1 | cut -d= -f2-)\"
+  if [ -n \"\${CADDY_BASICAUTH_HASH}\" ] && [ -n \"\${CADDY_ADMIN_HASH}\" ]; then
     # '|' delimiter: the bcrypt hash contains '/' characters.
     mkdir -p /home/dank/Containers/caddy
-    sed \"s|REPLACE_WITH_HASH|\${CADDY_BASICAUTH_HASH}|g\" dankclaw/Caddyfile \\
-      > /home/dank/Containers/caddy/Caddyfile
+    sed -e \"s|REPLACE_WITH_HASH|\${CADDY_BASICAUTH_HASH}|g\" \\
+        -e \"s|REPLACE_WITH_ADMIN_HASH|\${CADDY_ADMIN_HASH}|g\" \\
+      dankclaw/Caddyfile > /home/dank/Containers/caddy/Caddyfile
+  else
+    echo '  WARN: a Caddy hash is not set in .env; keeping the placeholder(s)'
   fi
+
+  echo '  Deploying the homepage...'
+  mkdir -p /srv/homepage
+  cp shared/homepage/index.html shared/homepage/admin.html shared/homepage/app.js \\
+     shared/homepage/style.css shared/homepage/services.json /srv/homepage/
+  [ -d shared/homepage/fonts ] && cp -r shared/homepage/fonts /srv/homepage/
+  # The last master deployment datetime (Q43): the deployed commit's datetime.
+  DEPLOYED_AT=\"\$(git log -1 --format=%cI)\"
+  printf 'window.DEPLOYED_AT = \"%s\";\\n' \"\$DEPLOYED_AT\" > /srv/homepage/deployed.js
+  # The status checker: install the timer + service, run it once, enable it.
+  ${SUDO} cp scripts/homepage-status.py /usr/local/bin/homepage-status.py
+  ${SUDO} cp scripts/homepage-status.service scripts/homepage-status.timer /etc/systemd/system/
+  ${SUDO} systemctl daemon-reload
+  ${SUDO} systemctl enable homepage-status.timer
+  ${SUDO} systemctl restart homepage-status.timer
+  python3 /usr/local/bin/homepage-status.py /srv/homepage/services.json /srv/homepage/status.json
 fi
 
 if [ '${COMPOSE_UP[$TARGET]}' = '1' ]; then

scripts/homepage-status.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=Homepage status checker (probes backends, writes status.json)
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/python3 /usr/local/bin/homepage-status.py /srv/homepage/services.json /srv/homepage/status.json

scripts/homepage-status.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Run the homepage status checker every 3 minutes
+
+[Timer]
+OnBootSec=1min
+OnUnitActiveSec=3min
+Unit=homepage-status.service
+
+[Install]
+WantedBy=timers.target

tests/homepage_deploy.bats

@@ -0,0 +1,30 @@
+#!/usr/bin/env bats
+# Seam: scripts/deploy.sh deploys the homepage, and the checker runs as a
+# systemd timer. The deploy is git-driven (master = the deployed state, Q33).
+# The tests assert the deploy references the homepage steps and renders BOTH
+# hashes, and that the checker timer + service exist and point at the checker.
+
+load helpers
+
+@test "deploy.sh ships the homepage (assets, timer, both hashes, deployed.js)" {
+    local d="$REPO_ROOT/scripts/deploy.sh"
+    grep -q "/srv/homepage" "$d"
+    grep -q "homepage-status" "$d"
+    grep -q "CADDY_BASICAUTH_HASH" "$d"
+    grep -q "CADDY_ADMIN_HASH" "$d"
+    grep -q "deployed.js" "$d"
+}
+
+@test "the checker runs as a systemd timer pointing at the checker" {
+    local s="$REPO_ROOT/scripts/homepage-status.service"
+    local t="$REPO_ROOT/scripts/homepage-status.timer"
+    [ -f "$s" ]
+    [ -f "$t" ]
+    grep -q "homepage-status.py" "$s"
+    grep -q "OnUnitActiveSec" "$t"
+    grep -q "homepage-status.service" "$t"
+}
+
+@test "deploy.sh is git-driven: it pulls main on the target" {
+    grep -q "git pull origin main" "$REPO_ROOT/scripts/deploy.sh"
+}

tests/llm_units.bats

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 # Seam: LLM systemd unit integrity.
-# Every scripts/*.service unit must point at files that exist in this repo.
+# Every LLM unit (frank-default-*.service) must point at files that exist in
+# this repo. The homepage-status unit is a different pattern (it installs to
+# /usr/local/bin and runs from /srv at deploy time) and is not checked here.
 # The units reference absolute paths on the target checkout
 # (/home/dank/serverAppConfigs/...); the relative part of each path must
 # resolve to a tracked file here. A unit that points at a retired checkout
@@ -48,7 +50,7 @@ unit_repo_path() {
             echo "$bad"
             return 1
         fi
-    done < <(find "$REPO_ROOT/scripts" -name '*.service' -type f | sort)
+    done < <(find "$REPO_ROOT/scripts" -name 'frank-default-*.service' -type f | sort)
     [ "$any" -eq 1 ] || skip "no LLM units yet"
 }
 
@@ -63,7 +65,7 @@ unit_repo_path() {
             echo "unit $(basename "$unit") env file $envfile not in repo"
             return 1
         }
-    done < <(find "$REPO_ROOT/scripts" -name '*.service' -type f | sort)
+    done < <(find "$REPO_ROOT/scripts" -name 'frank-default-*.service' -type f | sort)
 }
 
 @test "LLM serve scripts exist for every unit" {
@@ -76,5 +78,5 @@ unit_repo_path() {
             echo "unit $svc: ExecStart script $script not in repo"
             return 1
         }
-    done < <(find "$REPO_ROOT/scripts" -name '*.service' -type f | sort)
+    done < <(find "$REPO_ROOT/scripts" -name 'frank-default-*.service' -type f | sort)
 }