run the dev server as a system-wide systemd unit (boots without login/linger)

deploy/dvorakmortonxd-dev.system.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=dvorakmortonxd.dev dev server (custom Next.js dev wrapper)
+Documentation=file:///home/martin/dvorakmortonxd.dev/README.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=martin
+Group=martin
+WorkingDirectory=/home/martin/dvorakmortonxd.dev
+# A system service does not inherit a login environment, so set HOME/PATH
+# explicitly (Next.js wants a writable HOME for its cache).
+Environment=HOME=/home/martin
+Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+# Bind all interfaces so the Cloudflare tunnel host can reach :3000. The dev
+# server reads process.env.HOSTNAME, so pin it rather than inheriting it.
+Environment=HOSTNAME=0.0.0.0
+Environment=PORT=3000
+# A reboot can leave a stale dev lock behind; clear it before starting.
+ExecStartPre=/bin/rm -f /home/martin/dvorakmortonxd.dev/.next/dev/lock
+ExecStart=/bin/node /home/martin/dvorakmortonxd.dev/scripts/dev-server.mjs
+Restart=always
+RestartSec=3
+# Give Next.js a moment to shut down cleanly.
+TimeoutStopSec=15
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

deploy/install-system-service.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Install the dvorakmortonxd.dev dev server as a SYSTEM systemd unit so it
+# starts at boot for the whole machine (no login / no linger needed).
+#
+# Run it with root, e.g.:
+#     doas bash deploy/install-system-service.sh
+#
+# It also retires the per-user unit, so the two don't fight over :3000 and
+# .next/dev/lock.
+set -euo pipefail
+
+if [ "$(id -u)" -ne 0 ]; then
+  echo "root required — run: doas bash \"$0\"" >&2
+  exit 1
+fi
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+unit_src="$here/dvorakmortonxd-dev.system.service"
+unit_dst="/etc/systemd/system/dvorakmortonxd-dev.service"
+user_unit="/home/martin/.config/systemd/user/dvorakmortonxd-dev.service"
+
+install -m 0644 "$unit_src" "$unit_dst"
+systemctl daemon-reload
+
+# Retire the per-user copy if it exists (installed earlier as martin).
+if [ -e "$user_unit" ] || [ -e "/home/martin/.config/systemd/user/default.target.wants/dvorakmortonxd-dev.service" ]; then
+  if command -v runuser >/dev/null 2>&1; then
+    runuser -u martin -- env XDG_RUNTIME_DIR=/run/user/1000 \
+      DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus \
+      systemctl --user disable --now dvorakmortonxd-dev.service || true
+  else
+    # runuser is unavailable (minimal container). The caller should have run
+    # `systemctl --user stop dvorakmortonxd-dev` first; we still remove the files
+    # so the two units can't fight over :3000 on the next boot.
+    echo "note: runuser not found — stop the per-user unit manually if it is still running" >&2
+  fi
+  rm -f "$user_unit" \
+        /home/martin/.config/systemd/user/default.target.wants/dvorakmortonxd-dev.service
+fi
+
+systemctl enable --now dvorakmortonxd-dev.service
+systemctl --no-pager --full status dvorakmortonxd-dev.service || true
+
+echo
+echo "Installed. Manage it with:"
+echo "  systemctl status|restart|stop dvorakmortonxd-dev"
+echo "  journalctl -u dvorakmortonxd-dev -f"