rewrite

deploy/catcrafts-deploy.path

@@ -0,0 +1,28 @@
+# Watches for a deploy marker and restarts the backend.
+#
+# Why this exists: the Forgejo runner executes inside a container. It can write
+# to the bind-mounted deploy directories but it cannot talk to the host's
+# systemd, and the alternatives are worse — handing the runner host root, or a
+# polkit rule, both of which give CI far more authority than "restart one
+# service" needs.
+#
+# So CI touches /srv/catcrafts-app/.deploy-stamp as its last step, and the host
+# reacts. The runner never gains any privilege it did not already have, and the
+# restart policy stays entirely on the host side where it belongs.
+#
+# Install:
+#   cp catcrafts-deploy.{path,service} /etc/systemd/system/
+#   systemctl daemon-reload && systemctl enable --now catcrafts-deploy.path
+
+[Unit]
+Description=Watch for a catcrafts.net deploy marker
+Documentation=https://forgejo.catcrafts.net/Catcrafts/catcrafts.net
+
+[Path]
+# PathModified rather than PathChanged: `touch` on an existing file only updates
+# mtime, which PathChanged does not consider a change.
+PathModified=/srv/catcrafts-app/.deploy-stamp
+Unit=catcrafts-deploy.service
+
+[Install]
+WantedBy=multi-user.target