From 58a94d1e9afb86745b61b6cc2f4a366b2af5d5d1 Mon Sep 17 00:00:00 2001
From: boban <boban@git.bave.dev>
Date: Mon, 22 Jun 2026 23:28:27 +0200
Subject: [PATCH] feat(release): systemd watcher units + dev run-mount +
 flag-gated install

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 docker-compose.yml                            |  1 +
 docker/release/clusev-release-request.path    | 11 +++++++++++
 docker/release/clusev-release-request.service | 11 +++++++++++
 install.sh                                    | 13 +++++++++++++
 4 files changed, 36 insertions(+)
 create mode 100644 docker/release/clusev-release-request.path
 create mode 100644 docker/release/clusev-release-request.service

diff --git a/docker-compose.yml b/docker-compose.yml
index 5e08d4e..dcfb913 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -14,6 +14,7 @@ x-app: &app
   restart: unless-stopped
   volumes:
     - .:/var/www/html
+    - ./run:/var/www/html/storage/app/restart-signal
   networks:
     - clusev
 
diff --git a/docker/release/clusev-release-request.path b/docker/release/clusev-release-request.path
new file mode 100644
index 0000000..68c22e6
--- /dev/null
+++ b/docker/release/clusev-release-request.path
@@ -0,0 +1,11 @@
+[Unit]
+Description=Clusev release write-request — watch for a dashboard request
+After=docker.service
+Wants=docker.service
+
+[Path]
+PathExists=/home/nexxo/clusev/run/release-request.json
+Unit=clusev-release-request.service
+
+[Install]
+WantedBy=multi-user.target
diff --git a/docker/release/clusev-release-request.service b/docker/release/clusev-release-request.service
new file mode 100644
index 0000000..1be9bbb
--- /dev/null
+++ b/docker/release/clusev-release-request.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Clusev release write-request handler
+After=docker.service
+
+[Service]
+Type=oneshot
+User=nexxo
+UMask=0077
+Environment=CLUSEV_DIR=/home/nexxo/clusev
+WorkingDirectory=/home/nexxo/clusev
+ExecStart=/home/nexxo/clusev/docker/release/clusev-release.sh serve-request
diff --git a/install.sh b/install.sh
index ef9f8ad..720495c 100755
--- a/install.sh
+++ b/install.sh
@@ -325,6 +325,19 @@ install_host_watchers() {
     warn "Host-Watcher konnten nicht installiert werden — siehe ${src}/README.md."
   fi
   rm -f "$tmp_path" "$tmp_svc" "$tmp_upath" "$tmp_usvc" "$tmp_gate" "$tmp_csvc" "$tmp_ctimer" "$tmp_rsvc" "$tmp_rpath"
+
+  # Release bridge units — DEV ONLY. Installed only when CLUSEV_RELEASE_CONTROLS=true is set in .env,
+  # so customer/staging installs never get release controls or a host git-push watcher.
+  if grep -qE '^CLUSEV_RELEASE_CONTROLS=true$' "${proj}/.env" 2>/dev/null; then
+    local tmp_relsvc tmp_relpath; tmp_relsvc="$(mktemp)"; tmp_relpath="$(mktemp)"
+    sed "s#/home/nexxo/clusev#${proj}#g" "docker/release/clusev-release-request.service" > "$tmp_relsvc"
+    sed "s#/home/nexxo/clusev#${proj}#g" "docker/release/clusev-release-request.path"    > "$tmp_relpath"
+    install -m 0644 "$tmp_relsvc"  "${dst}/clusev-release-request.service"
+    install -m 0644 "$tmp_relpath" "${dst}/clusev-release-request.path"
+    rm -f "$tmp_relsvc" "$tmp_relpath"
+    systemctl daemon-reload
+    systemctl enable --now clusev-release-request.path
+  fi
 }
 install_host_watchers