Merge remote-tracking branch 'origin/master'

deploy/deploy.sh

@@ -89,6 +89,24 @@ ensure_ui_permissions() {
   find "$ui_root" -type f -exec chmod 644 {} \;
 }
 
+ensure_ui_readable_by_nginx() {
+  ui_index="$APP_DIR/ui/dist/spa/index.html"
+
+  if [[ ! -f "$ui_index" ]]; then
+    echo "ERROR: UI index not found at $ui_index"
+    return 1
+  fi
+
+  # Verify nginx user can read index.html and traverse parent directories.
+  if id -u www-data >/dev/null 2>&1; then
+    if ! su -s /bin/sh -c "test -r '$ui_index'" www-data; then
+      echo "ERROR: www-data cannot read $ui_index"
+      namei -l "$ui_index" || true
+      return 1
+    fi
+  fi
+}
+
 build_api_binary() {
   if ! command -v go >/dev/null 2>&1; then
     echo "go command not found; cannot build backend binary."
@@ -146,6 +164,7 @@ run_deploy() {
 
   echo "== ENSURE UI PERMISSIONS =="
   ensure_ui_permissions
+  ensure_ui_readable_by_nginx
 
   echo "== BUILD API =="
   build_api_binary
@@ -156,8 +175,22 @@ run_deploy() {
   echo "== ENSURE PDF FONTS =="
   ensure_pdf_fonts
 
-  echo "== RESTART SERVICE =="
+  echo "== RESTART SERVICES =="
   systemctl restart bssapp
+  if systemctl cat nginx >/dev/null 2>&1; then
+    systemctl restart nginx
+    if ! systemctl is-active --quiet nginx; then
+      echo "ERROR: nginx service failed to start"
+      return 1
+    fi
+  else
+    echo "WARN: nginx service not found; frontend may be unreachable."
+  fi
+
+  if ! systemctl is-active --quiet bssapp; then
+    echo "ERROR: bssapp service failed to start"
+    return 1
+  fi
 
   echo "[DEPLOY FINISHED] $(date '+%F %T')"
 }