Update host dir and release process

configs/nginx-nixos.nix

@@ -17,6 +17,13 @@
 #      /assets/, /sw.js and /manifest.json unresolvable once they needed their
 #      own location blocks.
 #
+#      It also no longer points into the repo. deploy.sh publishes the built
+#      client to /var/www/ss/releases/<timestamp> and atomically repoints the
+#      /var/www/ss/current symlink at it. Pointing nginx at that stable path
+#      means a deploy is one rename -- nginx resolves the symlink per request,
+#      so no reload is needed and no request sees a half-copied directory.
+#      Rollback is the same rename pointing at an older release.
+#
 #   3. proxyWebsockets on /socket. recommendedProxySettings does NOT add the
 #      Upgrade/Connection headers, so Socket.IO has been silently falling back
 #      to long-polling -- that's the live note-sync path running degraded.
@@ -45,7 +52,8 @@ services.nginx = {
   virtualHosts."192.168.1.7" = {
     # serverAliases = [ "notes.example.com" ];   # if the tunnel forwards the public host
 
-    root = "REPO_PATH/client/dist";
+    # Published by deploy.sh; a symlink to the live release. Not in the repo.
+    root = "/var/www/ss/current";
 
     locations."/" = {
       tryFiles = "$uri $uri/ /index.html";
@@ -84,7 +92,12 @@ services.nginx = {
   };
 };
 
-# Note on file access: nginx runs as its own user, so REPO_PATH/client/dist must
-# be readable by it -- every parent directory needs +x. If the repo lives under
-# /home/mab this usually means loosening the home directory's permissions, or
-# putting the clone somewhere like /srv instead.
+# Note on file access: nginx runs as its own user and needs read access to the
+# web root, with +x on every parent directory. Serving from /var/www/ss is what
+# makes that a non-issue -- the one-time `chmod 755 /var/www /var/www/ss` in
+# deploy.sh is the whole of it. This is the reason the root is not the repo
+# clone: a clone under /home/mab would require loosening the permissions on the
+# home directory itself.
+#
+# Uploads are NOT here. Express serves them from REPO_PATH/staticFiles at
+# /api/static via the proxy below, so they are untouched by deploys.