fix clean deployment nginx configuration

manage.sh

@@ -65,6 +65,29 @@ compose_stack() {
 	docker compose "${COMPOSE_FILES[@]}" "$@"
 }
 
+require_regular_file() {
+	local path="$1"
+
+	if [[ -f "$path" ]]; then
+		return 0
+	fi
+	if [[ -d "$path" ]]; then
+		fail "${path} is a directory; remove it and restore the missing repository file"
+	fi
+	fail "required deployment file is missing: ${path}"
+}
+
+require_stack_files() {
+	require_regular_file compose.yaml
+	if [[ "$SSL_MODE" == "none" ]]; then
+		require_regular_file compose.http.yaml
+		require_regular_file deploy/nginx/templates/http.conf.template
+	else
+		require_regular_file compose.tls.yaml
+		require_regular_file deploy/nginx/templates/tls.conf.template
+	fi
+}
+
 broker_config_ready() {
 	local key
 	local value
@@ -157,6 +180,7 @@ require_env() {
 	esac
 	export GITEA_PUBLIC_URL SSL_CERTIFICATE_DIR SSL_CERTIFICATE_FILE SSL_CERTIFICATE_KEY_FILE
 	select_compose_stack
+	require_stack_files
 }
 
 prepare() {
@@ -284,6 +308,18 @@ configure-broker)
 	printf 'Broker credentials saved to .env with mode 0600.\n'
 	printf 'Start the complete stack with ./manage.sh start\n'
 	;;
+rotate-cookie-secret)
+	require_env
+	command -v openssl >/dev/null 2>&1 ||
+		fail "openssl is required to generate the cookie secret"
+	set_env_setting TAPM_COOKIE_SECRET "$(openssl rand -base64 48)"
+	printf 'TAPM_COOKIE_SECRET was rotated in .env.\n'
+	if compose_stack ps -q broker | grep -q .; then
+		printf 'Recreating the broker to apply it...\n'
+		compose_stack up -d --force-recreate broker
+		printf 'Existing technician browser sessions are now invalid.\n'
+	fi
+	;;
 set-ssl)
 	require_env
 	target_mode="${2:-}"
@@ -349,6 +385,20 @@ status)
 	require_env
 	compose_stack ps
 	;;
+diagnostics)
+	require_env
+	printf '%s\n' 'Compose services:'
+	compose_stack config --services
+	printf '\n%s\n' 'Container status:'
+	compose_stack ps
+	printf '\n%s\n' 'Recent Nginx logs:'
+	compose_stack logs --tail=100 nginx
+	printf '\n%s\n' 'Published Nginx ports:'
+	compose_stack port nginx 80 || true
+	if [[ "$SSL_MODE" != "none" ]]; then
+		compose_stack port nginx 443 || true
+	fi
+	;;
 broker-container-id)
 	require_env
 	compose_stack ps -q broker
@@ -358,7 +408,7 @@ broker-logs)
 	compose_stack logs --tail=100 broker
 	;;
 *)
-	printf 'Usage: %s {prepare|bootstrap|configure-broker|set-ssl|start|start-direct|create-admin|renew|backup|status}\n' "$0"
+	printf 'Usage: %s {prepare|bootstrap|configure-broker|rotate-cookie-secret|set-ssl|start|start-direct|create-admin|renew|backup|status|diagnostics}\n' "$0"
 	exit 2
 	;;
 esac