fix(ci): restart Caddy after web deploy to fix stale bind mount

[FSM1]

Summary

• The scp-action with rm: true deletes and recreates /opt/cipherbox/web, changing the directory inode
• Caddy's bind mount still references the old inode, causing it to serve 404s for the entire web app
• Adding docker compose restart caddy after up -d ensures it picks up the new mount

Test plan

• Push a v*-staging* tag and verify the web app loads after deploy
• Confirm Caddy container sees files in /srv/web without manual intervention

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated staging deployment workflow to improve service initialization reliability.

[coderabbitai]

Walkthrough

A new step is added to the staging deployment workflow to restart the Caddy container after starting Docker services, with comments explaining the purpose of refreshing the bind mount host directory and preventing inode breakage.

Changes

Cohort / File(s)	Summary
Staging Deployment Workflow .github/workflows/deploy-staging.yml	Added a Docker Compose step to restart the Caddy container after service startup, with explanatory comments about bind mount inode preservation.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly relates to the main change: restarting Caddy after deployment to fix a stale bind mount issue caused by inode changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/staging-caddy-bind-mount

---

No actionable comments were generated in the recent review. 🎉

🧹 Recent nitpick comments

.github/workflows/deploy-staging.yml (1)

181-190: Consider whether the root cause (inode breakage) can be prevented upstream.

The rm: true on the SCP action (Line 190) is the root cause of the bind-mount breakage. An alternative approach would be to clear the contents of the directory rather than deleting and recreating it, which would preserve the inode:

# Before SCP, on the VPS:
rm -rf /opt/cipherbox/web/*

Then use scp-action without rm: true. This would eliminate the need for the Caddy restart entirely. That said, the current fix is pragmatic and works — just flagging this as a potential future improvement.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR updates the staging deployment workflow to restart the caddy service after redeploying the web app files, preventing stale bind mounts when the target directory is deleted/recreated by scp-action (rm: true).

Changes:

• Restart caddy after docker compose up -d during staging deploys to ensure /opt/cipherbox/web bind mount reflects the refreshed directory inode.