deploy-scp.yaml: download, back up the production database before
touching anything, upload into a timestamped release, symlink the
persistent website in, switch current and restart, verify /health
with retries, prune old releases only once that check passes. No
sudo, no container actions, one shared interface U5 will call next.
Infrastructure design for U6: single Pi split by directory not port,
systemd --user services instead of sudo, a releases/current/shared
layout that keeps the customer website outside every atomic switch,
and a health check through the existing reverse proxy before pruning
anything. Flags that user-level systemd needs enable-linger or the
service dies the moment the deploy SSH session closes.
Sluijsens