Push-to-deploy (OFF by default): vanguard-deploy applies only changed parts with a live-stream guard for MediaMTX, rollback, pending timer; dumpd /deploy webhook gated by DEPLOY_AUTO; configure --apply; switchToClone.sh; draft CI workflow; committed plugin zip

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

switchToClone.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# One-time: turn ~/vanguard-stream (an scp copy) into a git clone of the Gitea repo, keeping the generated files.
+#   ./switchToClone.sh key     -> creates a deploy key and prints the public half (add it in Gitea: repo → Settings → Deploy keys, read-only)
+#   ./switchToClone.sh clone   -> clones over ssh (port 2222), moves .env + generated files + plugin zips into it
+set -euo pipefail
+REPO_SSH="${REPO_SSH:-ssh://git@git.dumpstervigilantes.rip:2222/techy/Media-Server-Setup.git}"
+DIR="$HOME/vanguard-stream"; KEY="$HOME/.ssh/vanguard-deploy"
+case "${1:-}" in
+  key)
+    [[ -f $KEY ]] || ssh-keygen -t ed25519 -N "" -C "vanguard-deploy@$(hostname)" -f "$KEY" >/dev/null
+    cat > "$HOME/.ssh/config.vanguard" <<CFG
+Host git.dumpstervigilantes.rip
+  Port 2222
+  User git
+  IdentityFile $KEY
+  IdentitiesOnly yes
+CFG
+    grep -q 'config.vanguard' "$HOME/.ssh/config" 2>/dev/null || { echo "Include config.vanguard" | cat - "$HOME/.ssh/config" 2>/dev/null > "$HOME/.ssh/config.new" || echo "Include config.vanguard" > "$HOME/.ssh/config.new"; mv "$HOME/.ssh/config.new" "$HOME/.ssh/config"; chmod 600 "$HOME/.ssh/config"; }
+    echo "Add this as a READ-ONLY deploy key on the repo (Gitea → repo → Settings → Deploy Keys):"; echo; cat "$KEY.pub" ;;
+  clone)
+    [[ -d $DIR/.git ]] && { echo "$DIR is already a clone"; exit 0; }
+    ssh -o StrictHostKeyChecking=accept-new -p 2222 git@git.dumpstervigilantes.rip 2>&1 | grep -qi "successfully authenticated\|Hi there" || { echo "deploy key not accepted yet — run './switchToClone.sh key' and add it in Gitea"; exit 1; }
+    mv "$DIR" "$DIR.old"
+    git clone --quiet "$REPO_SSH" "$DIR"
+    for f in .env Caddyfile mediamtx.yml copyparty.conf stream-token.secret deploy.env; do [[ -f $DIR.old/$f ]] && cp -a "$DIR.old/$f" "$DIR/$f"; done
+    mkdir -p "$DIR/jellyfin-plugin-vanguard/dist"; cp -a "$DIR.old"/jellyfin-plugin-vanguard/dist/*.zip "$DIR/jellyfin-plugin-vanguard/dist/" 2>/dev/null || true
+    [[ -d $DIR.old/bot/app ]] && cp -a "$DIR.old/bot/app/." "$DIR/bot/app/" 2>/dev/null || true
+    ( cd "$DIR" && sudo -n true 2>/dev/null && sudo install -m 0600 -o root -g root .env /dev/null >/dev/null 2>&1 || true )
+    echo "cloned. kept: .env, generated configs, plugin zips, bot/app. Old copy at $DIR.old (delete when happy)."
+    echo "next: cd $DIR && ./configure.py --apply   (records nothing new; just confirms generation works from the clone)"
+    echo "      then: sudo vanguard-deploy status" ;;
+  *) sed -n '2,5p' "$0"; exit 2 ;;
+esac