gateway: deploy config.yaml changes (the volume was shadowing the image)

Deploying the audio-pricing change proved the gap: the image built and the app
restarted, but /model/info still served the old prices — /app/data is a
persistent volume, so the Dockerfile's COPY config.yaml /app/data/config.yaml is
shadowed by the volume's file from the first install, and start.sh only wrote a
default when the file was missing. Config changes in this repo therefore never
reached a running gateway; the audit's byte-identical md5 check was a manual
sync.

Fix: ship a second copy at /app/code/config.yaml and have start.sh sync it over
the volume at boot whenever they differ. The repo stays the source of truth, the
legacy first-boot default remains, and the README documents the flow.

Dockerfile

@@ -19,6 +19,9 @@ RUN chmod +x /app/code/start.sh
 
 # Default config — will be overridden by Cloudron env vars at runtime
 COPY config.yaml /app/data/config.yaml
+# A second copy inside the image: start.sh syncs it over the persistent
+# /app/data volume at boot, so config changes in the repo actually deploy.
+COPY config.yaml /app/code/config.yaml
 
 # Append the co-op credit-pack hint to LiteLLM's hardcoded budget-exceeded
 # messages. Done at BUILD time — the runtime rootfs is read-only under

README.md

@@ -85,6 +85,14 @@ The following are auto-generated and should **not** be set manually:
 - `DATABASE_URL` — from Cloudron's PostgreSQL addon
 - `REDIS_HOST`, `REDIS_PORT`, `REDIS_PASSWORD` — from Cloudron's Redis addon
 
+### Config deployment
+
+`config.yaml` ships **with the image** and `start.sh` syncs it over the persistent
+`/app/data/config.yaml` at boot whenever they differ. The volume copy would
+otherwise shadow the image's file forever — which is exactly how a config change
+can be merged, built and "deployed" while the gateway keeps serving the old
+configuration. Change the repo and redeploy; never edit the volume copy directly.
+
 ### Admin access
 
 The LiteLLM admin UI and API docs are **disabled** on the public gateway (hardened by default; see `start.sh`). Administrative operations run through the [member portal](https://git.inference.coop/code/member-portal), which holds the master key server-side. If direct LiteLLM admin access is ever needed, re-enable the UI in `start.sh`, redeploy, and use the master key from `/app/data/.master_key` — then disable it again.

start.sh

@@ -150,6 +150,17 @@ YAML
     echo "Config written to $CONFIG_FILE"
 fi
 
+# --- Ship config updates with the image ---
+# /app/data is a persistent volume, so the copy the Dockerfile bakes into
+# /app/data/config.yaml is shadowed by the volume's file forever — config
+# changes in the repo would never reach a running gateway. The repo is the
+# source of truth (README: repos mirror production), so sync the shipped copy
+# over the volume whenever they differ.
+if [ -f /app/code/config.yaml ] && ! cmp -s /app/code/config.yaml "$CONFIG_FILE"; then
+    echo "Updating /app/data/config.yaml from the image (repo is the source of truth)"
+    cp /app/code/config.yaml "$CONFIG_FILE"
+fi
+
 # --- Start LiteLLM ---
 echo "Starting LiteLLM on port 4000..."