From 5caa2178c31013065d228515a1fe911819928779 Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Sat, 22 Aug 2026 02:51:13 -0700
Subject: [PATCH] deploy.sh: extract CADDY_BASICAUTH_HASH via grep/cut, not by
 sourcing .env

Sourcing the .env in a set -u shell dies on the bcrypt hash's $2
expansion. grep/cut pulls the value without any shell interpretation.
---
 scripts/deploy.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 9cdcd9d..6fa5c25 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -124,8 +124,10 @@ if [ '${COPY_SHARED[$TARGET]}' = '1' ]; then
   cp shared/alloy/config.alloy /opt/alloy/config/config.alloy
 
   echo '  Rendering Caddyfile (basicauth hash from .env)...'
-  set -a; . ./.env; set +a
-  if [ -z \"\${CADDY_BASICAUTH_HASH:-}\" ]; then
+  # Extract the hash with grep/cut rather than sourcing .env: sourcing a
+  # bcrypt value in a set -u shell dies on its dollar-sign expansion.
+  CADDY_BASICAUTH_HASH=\"\$(grep -E '^CADDY_BASICAUTH_HASH=' .env | tail -1 | cut -d= -f2-)\"
+  if [ -z \"\${CADDY_BASICAUTH_HASH}\" ]; then
     echo '  WARN: CADDY_BASICAUTH_HASH not set in .env; keeping placeholder'
   else
     # '|' delimiter: the bcrypt hash contains '/' characters.