From facf01d578d8f100bb349a85194b20a794976e37 Mon Sep 17 00:00:00 2001
From: Ubuntu <ubuntu@ov-0f018e.infomaniak.ch>
Date: Mon, 26 Oct 2026 21:17:41 +0000
Subject: [PATCH] gateway: deploy config.yaml changes (the volume was shadowing
 the image)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Deploying the audio-pricing change proved the gap: the image built and the app
restarted, but /model/info still served the old prices — /app/data is a
persistent volume, so the Dockerfile's COPY config.yaml /app/data/config.yaml is
shadowed by the volume's file from the first install, and start.sh only wrote a
default when the file was missing. Config changes in this repo therefore never
reached a running gateway; the audit's byte-identical md5 check was a manual
sync.

Fix: ship a second copy at /app/code/config.yaml and have start.sh sync it over
the volume at boot whenever they differ. The repo stays the source of truth, the
legacy first-boot default remains, and the README documents the flow.
---
 Dockerfile |  3 +++
 README.md  |  8 ++++++++
 start.sh   | 11 +++++++++++
 3 files changed, 22 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index e3a2877..d74fef7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,6 +19,9 @@ RUN chmod +x /app/code/start.sh
 
 # Default config — will be overridden by Cloudron env vars at runtime
 COPY config.yaml /app/data/config.yaml
+# A second copy inside the image: start.sh syncs it over the persistent
+# /app/data volume at boot, so config changes in the repo actually deploy.
+COPY config.yaml /app/code/config.yaml
 
 # Append the co-op credit-pack hint to LiteLLM's hardcoded budget-exceeded
 # messages. Done at BUILD time — the runtime rootfs is read-only under
diff --git a/README.md b/README.md
index 96bcb2b..13fff76 100644
--- a/README.md
+++ b/README.md
@@ -85,6 +85,14 @@ The following are auto-generated and should **not** be set manually:
 - `DATABASE_URL` — from Cloudron's PostgreSQL addon
 - `REDIS_HOST`, `REDIS_PORT`, `REDIS_PASSWORD` — from Cloudron's Redis addon
 
+### Config deployment
+
+`config.yaml` ships **with the image** and `start.sh` syncs it over the persistent
+`/app/data/config.yaml` at boot whenever they differ. The volume copy would
+otherwise shadow the image's file forever — which is exactly how a config change
+can be merged, built and "deployed" while the gateway keeps serving the old
+configuration. Change the repo and redeploy; never edit the volume copy directly.
+
 ### Admin access
 
 The LiteLLM admin UI and API docs are **disabled** on the public gateway (hardened by default; see `start.sh`). Administrative operations run through the [member portal](https://git.inference.coop/code/member-portal), which holds the master key server-side. If direct LiteLLM admin access is ever needed, re-enable the UI in `start.sh`, redeploy, and use the master key from `/app/data/.master_key` — then disable it again.
diff --git a/start.sh b/start.sh
index 2583ce6..0414d38 100644
--- a/start.sh
+++ b/start.sh
@@ -150,6 +150,17 @@ YAML
     echo "Config written to $CONFIG_FILE"
 fi
 
+# --- Ship config updates with the image ---
+# /app/data is a persistent volume, so the copy the Dockerfile bakes into
+# /app/data/config.yaml is shadowed by the volume's file forever — config
+# changes in the repo would never reach a running gateway. The repo is the
+# source of truth (README: repos mirror production), so sync the shipped copy
+# over the volume whenever they differ.
+if [ -f /app/code/config.yaml ] && ! cmp -s /app/code/config.yaml "$CONFIG_FILE"; then
+    echo "Updating /app/data/config.yaml from the image (repo is the source of truth)"
+    cp /app/code/config.yaml "$CONFIG_FILE"
+fi
+
 # --- Start LiteLLM ---
 echo "Starting LiteLLM on port 4000..."