Zero-downtime deploys, with instant rollback

This site has no CI/CD and no application server to restart, it’s served as-is by Caddy. That doesn’t mean deployment should be ad hoc: bin/deploy.sh builds the site locally, uploads the result into a fresh, timestamped release directory on the server, sanity-checks that the upload is complete, and only then repoints the current symlink if everything checks out. Live traffic is never touched until that last step, and that step itself is a single rename(2) call, so it’s atomic: there’s no instant where the URL would resolve to a broken path.

Because the last three releases are kept on the server, bin/rollback.sh can instantly repoint current to the previous one, no rebuild, no re-upload.

The trickiest part wasn’t the release mechanism itself but SSH authentication: the dev machine’s default SSH agent carries about half a dozen keys for other projects, and this server drops the connection with “too many authentication failures” if all of them get offered before the right one. Both scripts explicitly load the expected key and pin it with IdentitiesOnly=yes on every ssh/rsync call, rather than letting the agent negotiate.