Fix 5 deployment bugs found during WIT bootstrap

- Add cron package to apt-get (needed for crontab)
- Copy SSH keys from sudo caller to deploy user instead of empty touch
- Move SSH hardening after deploy user setup to prevent lockout
- Fix postgres/redis data dir ownership (UID 999, not deploy)
- Add CREATE DATABASE to create-app-credentials.sh
- Add Caddyfile container-name substitution in deploy-blue-green.sh

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: baijum

infrastructure/bootstrap-server.sh

@@ -48,7 +48,7 @@ echo
 
 echo "Installing system packages..."
 apt-get update -qq
-apt-get install -y -qq git curl ufw vnstat unattended-upgrades apt-listchanges fail2ban > /dev/null
+apt-get install -y -qq git curl ufw vnstat unattended-upgrades apt-listchanges fail2ban cron > /dev/null
 info "System packages installed (git, curl, ufw, vnstat, unattended-upgrades, fail2ban)"
 
 # --- Firewall ---
@@ -93,23 +93,6 @@ EOF
   info "fail2ban configured (SSH jail: maxretry=5, bantime=3600s, findtime=600s)"
 fi
 
-# --- SSH Hardening ---
-
-SSHD_HARDENING="/etc/ssh/sshd_config.d/99-towlion-hardening.conf"
-if [[ -f "$SSHD_HARDENING" ]]; then
-  info "SSH hardening config already exists"
-else
-  cat > "$SSHD_HARDENING" <<'EOF'
-PermitRootLogin no
-PasswordAuthentication no
-MaxAuthTries 3
-X11Forwarding no
-EOF
-
-  systemctl restart sshd
-  info "SSH hardened (no root login, no password auth, MaxAuthTries=3, no X11)"
-fi
-
 # --- Unattended Upgrades ---
 
 UA_CONFIG="/etc/apt/apt.conf.d/50unattended-upgrades"
@@ -185,7 +168,16 @@ fi
 DEPLOY_SSH_DIR="/home/deploy/.ssh"
 if [[ ! -d "$DEPLOY_SSH_DIR" ]]; then
   mkdir -p "$DEPLOY_SSH_DIR"
-  touch "$DEPLOY_SSH_DIR/authorized_keys"
+  if [[ -n "${SUDO_USER:-}" ]] && [[ -f "/home/${SUDO_USER}/.ssh/authorized_keys" ]]; then
+    cp "/home/${SUDO_USER}/.ssh/authorized_keys" "$DEPLOY_SSH_DIR/authorized_keys"
+    info "Copied SSH keys from ${SUDO_USER} to deploy user"
+  elif [[ -f /root/.ssh/authorized_keys ]]; then
+    cp /root/.ssh/authorized_keys "$DEPLOY_SSH_DIR/authorized_keys"
+    info "Copied SSH keys from root to deploy user"
+  else
+    touch "$DEPLOY_SSH_DIR/authorized_keys"
+    warn "No SSH keys found to copy — add keys to /home/deploy/.ssh/authorized_keys manually"
+  fi
   chmod 700 "$DEPLOY_SSH_DIR"
   chmod 600 "$DEPLOY_SSH_DIR/authorized_keys"
   chown -R deploy:deploy "$DEPLOY_SSH_DIR"
@@ -194,6 +186,23 @@ else
   info "SSH directory already exists for deploy user"
 fi
 
+# --- SSH Hardening ---
+
+SSHD_HARDENING="/etc/ssh/sshd_config.d/99-towlion-hardening.conf"
+if [[ -f "$SSHD_HARDENING" ]]; then
+  info "SSH hardening config already exists"
+else
+  cat > "$SSHD_HARDENING" <<'EOF'
+PermitRootLogin no
+PasswordAuthentication no
+MaxAuthTries 3
+X11Forwarding no
+EOF
+
+  systemctl restart sshd
+  info "SSH hardened (no root login, no password auth, MaxAuthTries=3, no X11)"
+fi
+
 # --- Directories ---
 
 for dir in \
@@ -212,6 +221,9 @@ chown -R 472:472 /data/grafana
 chown -R 10001:10001 /data/loki
 # Prometheus runs as nobody (UID 65534) inside its container
 chown -R 65534:65534 /data/prometheus
+# Postgres and Redis run as UID 999 inside their containers
+chown -R 999:999 /data/postgres
+chown -R 999:999 /data/redis
 info "Directory structure created (/data/*, /opt/apps, /opt/platform)"
 
 # --- Docker Network ---

infrastructure/create-app-credentials.sh

@@ -47,6 +47,18 @@ DB_PASSWORD=$(openssl rand -base64 24)
 S3_PASSWORD=$(openssl rand -base64 24)
 JWT_SECRET=$(openssl rand -base64 32)
 
+# PostgreSQL database creation (idempotent)
+info "Checking PostgreSQL database..."
+if docker compose -f /opt/platform/docker-compose.yml exec -T postgres \
+  psql -U postgres -tc "SELECT 1 FROM pg_database WHERE datname = '${APP_DB}'" | grep -q 1; then
+  warn "PostgreSQL database '${APP_DB}' already exists, skipping creation"
+else
+  info "Creating PostgreSQL database '${APP_DB}'..."
+  docker compose -f /opt/platform/docker-compose.yml exec -T postgres \
+    psql -U postgres -c "CREATE DATABASE ${APP_DB}"
+  info "PostgreSQL database created"
+fi
+
 # PostgreSQL user creation (idempotent)
 info "Checking PostgreSQL user..."
 if docker compose -f /opt/platform/docker-compose.yml exec -T postgres psql -U postgres -tc "SELECT 1 FROM pg_roles WHERE rolname = '${APP_USER}'" | grep -q 1; then

infrastructure/deploy-blue-green.sh

@@ -190,7 +190,12 @@ fi
 
 # Step 10: Write Caddyfile and reload Caddy
 info "Step 8/8: Swapping traffic to new slot..."
-echo "$CADDYFILE_CONTENT" > "/opt/platform/caddy-apps/${APP_NAME}.caddy"
+echo "$CADDYFILE_CONTENT" \
+  | sed "s/${APP_NAME}-\([a-z]*\)-1/${APP_NAME}-${NEXT_SLOT}-\1-1/g" \
+  | sed "s/\bapp:/${APP_NAME}-${NEXT_SLOT}-app-1:/g" \
+  | sed "s/\bfrontend:/${APP_NAME}-${NEXT_SLOT}-frontend-1:/g" \
+  | sed "s/{\\\$APP_DOMAIN}/${APP_DOMAIN}/g" \
+  > "/opt/platform/caddy-apps/${APP_NAME}.caddy"
 docker compose -f "$PLATFORM_COMPOSE" exec -T caddy caddy reload --config /etc/caddy/Caddyfile
 
 # Step 11: Verify external health