no-mistakes(review): guard missing include, non-fatal pending reload, chmod stash

scripts/capture-dsh-token.sh

@@ -53,6 +53,22 @@ exec 9>"$LOCK_FILE"
 flock -n 9 || { log "another capture-dsh-token run holds $LOCK_FILE; exiting"; exit 0; }
 mkdir -p "$(dirname "$PENDING_FILE")"
 
+# ── 0b. Guarantee the generated include exists before any `nginx -t` ──────
+# The :80 site includes /etc/dsh-web/nginx-login.conf by literal path, so a
+# missing include makes every `nginx -t` fail and can wedge recovery. Seed it
+# from the last known token (or a placeholder); step 4 replaces it.
+if [ ! -f "$INCLUDE_FILE" ]; then
+  SEED="placeholder"
+  if [ -f "$TOKEN_FILE" ]; then
+    SEED="$(cat "$TOKEN_FILE" 2>/dev/null || true)"
+    [ -n "$SEED" ] || SEED="placeholder"
+  fi
+  printf '%s' "$SEED" | grep -qE '^[A-Za-z0-9._~+/=:@-]+$' || SEED="placeholder"
+  printf 'proxy_pass %s/?token=%s;\n' "$LOGIN_UPSTREAM" "$SEED" > "$INCLUDE_FILE"
+  chmod 600 "$INCLUDE_FILE"
+  log "created missing $INCLUDE_FILE"
+fi
+
 # ── 1. Remove the legacy unauthenticated :8081 endpoint, if present ─────────
 # It bypassed Authentik entirely (listened on 0.0.0.0:8081 with no auth_request)
 # and must never come back. Stash it rather than delete so it is auditable.
@@ -60,6 +76,7 @@ if [ -e "$LEGACY_8081" ] || [ -L "$LEGACY_8081" ]; then
   TS="$(date -u +%Y%m%dT%H%M%SZ)"
   STASHED="$STASH_DIR/dsh.token.disabled-$TS"
   mv "$LEGACY_8081" "$STASHED"
+  chmod 600 "$STASHED" 2>/dev/null || true
   touch "$PENDING_FILE"
   if ! nginx -t >/dev/null 2>&1; then
     die "nginx config test failed after disabling $LEGACY_8081 (kept disabled at $STASHED); a pending reload is recorded so running nginx is reloaded once the config is fixed. The legacy :8081 endpoint will NOT be restored."
@@ -77,13 +94,13 @@ fi
 # answering. Reconcile it before the token wait.
 if [ -e "$PENDING_FILE" ]; then
   if ! nginx -t >/dev/null 2>&1; then
-    die "pending nginx reload recorded but 'nginx -t' fails; fix the config and rerun"
+    log "WARNING: pending nginx reload recorded but 'nginx -t' fails; continuing so the include can be regenerated; will retry next run"
+  elif ! nginx -s reload; then
+    log "WARNING: pending nginx reload recorded but 'nginx -s reload' failed; will retry next run"
+  else
+    rm -f "$PENDING_FILE"
+    log "completed pending nginx reload"
   fi
-  if ! nginx -s reload; then
-    die "pending nginx reload recorded but 'nginx -s reload' failed; will retry next run"
-  fi
-  rm -f "$PENDING_FILE"
-  log "completed pending nginx reload"
 fi
 
 # ── 2. Select the token the RUNNING service actually accepts ────────────────
@@ -118,6 +135,7 @@ done
 
 if [ -z "$TOKEN" ]; then
   log "no dsh-web launch token accepted within ${TOKEN_WAIT}s; leaving the include untouched for the next run"
+  [ -e "$PENDING_FILE" ] && die "pending nginx reload could not be completed; will retry next run"
   exit 0
 fi