Migrate Gitea proxy to canonical Caddy

scripts/deploy-plan.py

@@ -27,7 +27,6 @@ SERVICE_ORDER = (
     "open-webui",
     "gitea-postgres",
     "gitea-server",
-    "gitea-caddy",
     "comfyui",
     "hermes",
     "hermes-dashboard",
@@ -66,7 +65,6 @@ DANKCLAW_SERVICES = {
     "open-webui",
     "gitea-postgres",
     "gitea-server",
-    "gitea-caddy",
     "comfyui",
     "hermes",
     "hermes-dashboard",
@@ -276,9 +274,12 @@ def services_for_path(path: str, target: str) -> set[str]:
                 elif name == "gitea-server.container":
                     _add(services, "gitea-server")
                 elif name == "gitea-caddy.container":
-                    _add(services, "gitea-caddy")
+                    # Removing the old split proxy requires the canonical
+                    # Caddy handler to retire its installed unit/container
+                    # before it claims ports 80/443.
+                    _add(services, "caddy")
                 elif name == "gitea.network":
-                    _add(services, "gitea-postgres", "gitea-server", "gitea-caddy")
+                    _add(services, "gitea-postgres", "gitea-server")
             return services
         return services
 

scripts/deploy-remote.sh

@@ -84,7 +84,7 @@ service_is_allowed() {
     case "$TARGET:$service" in
         dankclaw:gluetun|dankclaw:searxng-valkey|dankclaw:searxng|dankclaw:pihole|\
         dankclaw:open-webui|dankclaw:gitea-postgres|dankclaw:gitea-server|\
-        dankclaw:gitea-caddy|dankclaw:comfyui|dankclaw:hermes|\
+        dankclaw:comfyui|dankclaw:hermes|\
         dankclaw:hermes-dashboard|dankclaw:prometheus|dankclaw:grafana|\
         dankclaw:loki|dankclaw:alloy|dankclaw:node-exporter|\
         dankclaw:authentik-postgres|dankclaw:authentik-server|\
@@ -248,6 +248,33 @@ deploy_homepage() {
     run_privileged python3 /usr/local/bin/homepage-status.py /srv/homepage/services.json /srv/homepage/status.json
 }
 
+retire_legacy_gitea_caddy() {
+    # The old split proxy owns ports 80/443 on hosts upgraded in place. Stop
+    # and disable its generated unit before the canonical Caddy is started.
+    if systemctl --user is-active --quiet gitea-caddy.service 2>/dev/null; then
+        systemctl --user stop gitea-caddy.service
+    fi
+    if systemctl --user is-enabled --quiet gitea-caddy.service 2>/dev/null; then
+        systemctl --user disable gitea-caddy.service
+    fi
+    local unit_dir="$HOME/.config/containers/systemd"
+    local legacy_trash="$HOME/.AGENTTRASH/$(date +%Y%m%d)-gitea-caddy"
+    # Podman generators scan the unit directory recursively on this host, so
+    # leaving the retired file in systemd/.AGENTTRASH would regenerate it.
+    # Stage it outside the unit tree in the dated home trash instead.
+    for unit_file in "$unit_dir/gitea-caddy.container" \
+        "$unit_dir/.AGENTTRASH/gitea-caddy.container"; do
+        if [[ -e "$unit_file" ]]; then
+            mkdir -p "$legacy_trash"
+            mv -- "$unit_file" "$legacy_trash/"
+        fi
+    done
+    systemctl --user daemon-reload
+    if podman container exists gitea-caddy; then
+        podman rm --force gitea-caddy
+    fi
+}
+
 deploy_caddy() {
     if [[ "$TARGET" != dankclaw ]]; then
         echo "caddy is owned by dankclaw; refusing to deploy it on $TARGET" >&2
@@ -263,22 +290,9 @@ deploy_caddy() {
         podman build --no-cache --label "cfhash=$cfhash" -t "$image:latest" \
             -f dankclaw/caddy/Containerfile .
     fi
-    # The canonical reverse proxy may be gitea-caddy on a host with the old
-    # split deployment. Never stop or replace it implicitly. Refuse the Caddy
-    # deployment until the operator has explicitly migrated port ownership.
-    if podman container exists gitea-caddy && ! podman container exists caddy; then
-        echo "FAIL: gitea-caddy owns the reverse-proxy deployment; refusing to replace it with caddy." >&2
-        return 1
-    fi
-    if podman container exists gitea-caddy && podman container exists caddy; then
-        local gitea_state caddy_state
-        gitea_state="$(podman inspect gitea-caddy --format '{{.State.Status}}' 2>/dev/null || true)"
-        caddy_state="$(podman inspect caddy --format '{{.State.Status}}' 2>/dev/null || true)"
-        if [[ "$gitea_state" == running && "$caddy_state" != running ]]; then
-            echo "FAIL: gitea-caddy currently owns ports 80/443; refusing to start caddy." >&2
-            return 1
-        fi
-    fi
+    # Retire the old split proxy before claiming ports 80/443. This is
+    # idempotent and leaves the old unit recoverable in the target trash.
+    retire_legacy_gitea_caddy
     if podman container exists caddy; then
         podman-compose -f dankclaw/compose.yaml up -d --no-deps caddy
         local reloaded=0
@@ -482,7 +496,6 @@ deploy_service() {
         pihole) deploy_pihole ;;
         gitea-postgres) deploy_gitea_unit gitea-postgres gitea-postgres ;;
         gitea-server) deploy_gitea_unit gitea-server gitea-server ;;
-        gitea-caddy) deploy_gitea_unit gitea-caddy gitea-caddy ;;
         frank-default-large) deploy_llm_large ;;
         frank-default-small) deploy_llm_small ;;
         frank-default-npu) deploy_llm_npu ;;

scripts/deploy.sh

@@ -115,7 +115,7 @@ valid_service() {
     case "$TARGET:$service" in
         dankclaw:gluetun|dankclaw:searxng-network|dankclaw:searxng-valkey|dankclaw:searxng|\
         dankclaw:pihole|dankclaw:open-webui|dankclaw:gitea-postgres|dankclaw:gitea-server|\
-        dankclaw:gitea-caddy|dankclaw:comfyui|dankclaw:hermes|dankclaw:hermes-dashboard|\
+        dankclaw:comfyui|dankclaw:hermes|dankclaw:hermes-dashboard|\
         dankclaw:prometheus|dankclaw:grafana|dankclaw:loki|dankclaw:alloy|\
         dankclaw:node-exporter|dankclaw:authentik-postgres|dankclaw:authentik-server|\
         dankclaw:authentik-worker|dankclaw:caddy|dankclaw:homepage|\