From e03cb7601778dcee9de19d9baccc48ace6378d79 Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Tue, 7 Jul 2026 16:47:27 +0100
Subject: [PATCH] fix: write BoltDB before Zoraxy starts (db not locked) +
 remove duplicate

---
 deploy.sh | 73 +++++++++++++++++++++++--------------------------------
 1 file changed, 30 insertions(+), 43 deletions(-)

diff --git a/deploy.sh b/deploy.sh
index 9fdd748..7977dc3 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -133,7 +133,34 @@ if [ "$GREENFIELD" = true ]; then
         echo "[INFO] Version: $(cat $TARGET_DIR/VERSION)"
     fi
 
-    # Deploy Zoraxy (remove old container first to avoid name conflict)
+    # Write configs before starting Zoraxy (BoltDB must not be locked)
+    echo "[*] Writing configuration files..."
+
+    # Write ACME config
+    mkdir -p "$TARGET_DIR/config/zoraxy/conf"
+    cat > "$TARGET_DIR/config/zoraxy/conf/acme_conf.json" <<EOF
+{
+  "Enabled": true,
+  "Email": "${TLS_EMAIL}",
+  "RenewAll": true,
+  "FilesToRenew": [],
+  "DNSServers": ""
+}
+EOF
+
+    # Write admin + ZorxAuth to BoltDB (Zoraxy not running, db not locked)
+    if [ -f "$TOOL_BIN" ]; then
+        # Create the data directory and an empty database
+        mkdir -p "$TARGET_DIR/data/zoraxy"
+        touch "$TARGET_DIR/data/zoraxy/sys.db"
+        "$TOOL_BIN" db --db "$TARGET_DIR/data/zoraxy/sys.db" \
+            --set "system:admin:{\"username\":\"${ADMIN_USERNAME:-master}\"}" 2>&1 || true
+        "$TOOL_BIN" db --db "$TARGET_DIR/data/zoraxy/sys.db" \
+            --set "zorxauth:options:{\"enable_auth_gateway\":true,\"sso_redirect_url\":\"https://app.${DOMAIN}/\"}" 2>&1 || true
+        echo "  [OK] Admin + ZorxAuth written to BoltDB"
+    fi
+
+    # Deploy Zoraxy
     cp compose/zoraxy.yaml "$TARGET_DIR/compose/zoraxy.yaml"
     podman rm -f zoraxy 2>/dev/null || true
     podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" up -d 2>&1 || echo "[WARN] Zoraxy deploy had issues"
@@ -254,48 +281,8 @@ apps:
     icon: "admin"
 EOF
 
-    # Configure Zoraxy via BoltDB + config files (no CSRF-prone API calls)
-    echo "[*] Configuring Zoraxy..."
-    SYS_DB="$TARGET_DIR/data/zoraxy/sys.db"
-
-    # Wait for Zoraxy to create the database (or timeout)
-    for i in $(seq 1 30); do
-        if [ -f "$SYS_DB" ]; then break; fi
-        if curl -sf "http://127.0.0.1:8000/api/auth/userCount" > /dev/null 2>&1; then
-            # Zoraxy is up, create db file if it doesn't exist yet
-            touch "$SYS_DB" 2>/dev/null || true
-            break
-        fi
-        sleep 2
-    done
-
-    # Write admin user directly to BoltDB via helper tool
-    if [ -f "$SYS_DB" ] && [ -f "$TOOL_BIN" ]; then
-        "$TOOL_BIN" db --db "$SYS_DB" \
-            --set "system:admin:{\"username\":\"${ADMIN_USERNAME:-master}\"}" 2>&1 || true
-        "$TOOL_BIN" db --db "$SYS_DB" \
-            --set "zorxauth:options:{\"enable_auth_gateway\":true,\"sso_redirect_url\":\"https://app.${DOMAIN}/\"}" 2>&1 || true
-        echo "  [OK] Admin + ZorxAuth written to BoltDB"
-    else
-        echo "  [WARN] Could not write to BoltDB (sys.db or tool missing)"
-    fi
-
-    # Write ACME config file directly
-    mkdir -p "$TARGET_DIR/config/zoraxy/conf"
-    cat > "$TARGET_DIR/config/zoraxy/conf/acme_conf.json" <<EOF
-{
-  "Enabled": true,
-  "Email": "${TLS_EMAIL}",
-  "RenewAll": true,
-  "FilesToRenew": [],
-  "DNSServers": ""
-}
-EOF
-    echo "  [OK] ACME enabled (email: ${TLS_EMAIL})"
-
-    # Restart Zoraxy to pick up configs
-    podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" restart 2>&1 || true
-    sleep 2
+    # All Zoraxy config (ACME, BoltDB) already written before Zoraxy started
+    echo "[*] Zoraxy configuration complete"
 
     # Write systemd service
     echo "[*] Writing systemd service..."