From 11348632df024e387a7a4aa8ca85d3588cc091f1 Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Sun, 27 Sep 2026 23:21:43 +0000
Subject: [PATCH] Update from source b03c8d4b

---
 deployment/cloud/README.md |  2 +-
 deployment/cloud/entry.sh  | 25 +++++++++++++++++++++----
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/deployment/cloud/README.md b/deployment/cloud/README.md
index 31a1ec61..e70e43fd 100644
--- a/deployment/cloud/README.md
+++ b/deployment/cloud/README.md
@@ -68,7 +68,7 @@ there. Only then does it swap the new build in.
 | `PUBLIC_API_BASE` | the public API URL written into the build's `runtime-config.js` (e.g. `https://<host>/api-prod`) |
 | `BUILD_MAX_OLD_SPACE_MB` | Node heap cap for a build (default `1536`) |
 | `RUDDER_ENGINE` | `1` runs Rudder's voice-to-text engine here, fed by the browser's microphone (about 1 GB more; its runtime and model, ~742 MB, are baked into the image at `/opt/rudder`, and `/data/rudder` wins when it holds a model). The site serves at once; Rudder shows "starting" until its engine is built, then the dev server restarts once to start it. Give the container at least 2 vCPUs, or transcription falls behind speech |
-| `RUDDER_ALLOW_HOST` | the public host the engine accepts (it refuses others); defaults to the host in `OIDC_REDIRECT_URL` |
+| `RUDDER_ALLOW_HOST` | every public host the engine accepts, comma-separated (it refuses others, so list each domain the container answers on); defaults to Coolify's `COOLIFY_FQDN`, else the host in `OIDC_REDIRECT_URL` |
 
 Mount a persistent volume at **`/data`** (PocketBase data and published builds). Memory measured on
 the running container: about 0.45 GB idle, up to about 1.5 GB more during a build, so give it
diff --git a/deployment/cloud/entry.sh b/deployment/cloud/entry.sh
index 986e86dd..fb415af3 100755
--- a/deployment/cloud/entry.sh
+++ b/deployment/cloud/entry.sh
@@ -18,13 +18,24 @@ bun install --frozen-lockfile || bun install
         CHANGED=$(git diff --name-only "$OLD" "$NEW" 2>/dev/null)
         git reset -q --hard FETCH_HEAD
         echo "$(date -u +%FT%TZ) PULLED ${OLD:0:8} -> ${NEW:0:8}" >> /tmp/pull.log
-        # the engine binary is untracked, so rebuild it when its source changed (next start picks it up)
+        # the engine binary is untracked, so rebuild it when its source changed
         if [ "${RUDDER_ENGINE:-0}" = 1 ] && echo "$CHANGED" | grep -q '^backend/rudder-engine/'; then
           (cd backend/rudder-engine && go build -o ../bin/rudder-engine .) >> /tmp/pull.log 2>&1 \
-            && echo "$(date -u +%FT%TZ) rudder-engine rebuilt" >> /tmp/pull.log
+            && echo "$(date -u +%FT%TZ) rudder-engine rebuilt" >> /tmp/pull.log && ENGINE_STALE=1
         fi
       fi
     fi
+    # Swap in a rebuilt engine once nobody is dictating: stop the old one by its own PID (never a process
+    # group: inside a container that can be PID 1) and the dev server restarts it on the new binary.
+    if [ "${ENGINE_STALE:-0}" = 1 ] && curl -s --max-time 3 http://127.0.0.1:5193/api/rudder/status | grep -q '"inUse":false'; then
+      for p in /proc/[0-9]*; do
+        case "$(readlink "$p/exe" 2>/dev/null)" in
+          "/app/repo/backend/bin/rudder-engine (deleted)") kill -TERM "${p#/proc/}" \
+            && echo "$(date -u +%FT%TZ) rudder-engine ${p#/proc/} stopped for the new build" >> /tmp/pull.log ;;
+        esac
+      done
+      ENGINE_STALE=0
+    fi
   done
 ) &
 
@@ -41,11 +52,17 @@ if [ "${RUDDER_ENGINE:-0}" = 1 ]; then
     if ls /data/rudder/models/*.gguf >/dev/null 2>&1; then RUDDER_HOME=/data/rudder; else RUDDER_HOME=/opt/rudder; fi
   fi
   export RUDDER_HOME RUDDER_AUDIO=browser
-  # The engine refuses a non-loopback Host header, and Vite's proxy passes the public host through:
-  # allow the public host, defaulting to the one in OIDC_REDIRECT_URL.
+  # The engine refuses a non-loopback Host header, and Vite's proxy passes the public host through, so
+  # EVERY host the container answers on must be listed (an unlisted one leaves Rudder "offline" there).
+  # An explicit list, never a wildcard: RUDDER_ALLOW_HOST if set, else the hosts Coolify gives the
+  # container (COOLIFY_FQDN, comma-separated), else the host in OIDC_REDIRECT_URL.
+  if [ -z "${RUDDER_ALLOW_HOST:-}" ] && [ -n "${COOLIFY_FQDN:-}" ]; then
+    RUDDER_ALLOW_HOST=$(printf '%s' "$COOLIFY_FQDN" | sed -E 's#[a-z]+://##g; s#[/:][^,]*##g')
+  fi
   if [ -z "${RUDDER_ALLOW_HOST:-}" ] && [ -n "${OIDC_REDIRECT_URL:-}" ]; then
     RUDDER_ALLOW_HOST=$(printf '%s' "$OIDC_REDIRECT_URL" | sed -E 's#^[a-z]+://([^/:]+).*#\1#')
   fi
+  echo "[rudder] allowed hosts: ${RUDDER_ALLOW_HOST:-loopback only}"
   export RUDDER_ALLOW_HOST="${RUDDER_ALLOW_HOST:-}"
   # The state file is read by vite.cloud.config.mjs: running -> done | failed.
   echo running > /tmp/rudder-setup.state