fix(pocket-id): apply BASE_DOMAIN passed to a re-run, not just the first run

The Caddyfile is reassembled every run, but the WebFinger decision reads
BASE_DOMAIN/REDIRECT_URL from .env, and .env was written only on the first
run. So enabling WebFinger on a re-run was a silent no-op: the operator
answers the apex prompt, and the script prints the green
"[+] No BASE_DOMAIN -- pocket-id only" -- contradicting what they just
typed -- then pulls, restarts and prints DEPLOYED with exit 0.

The failure is invisible at the far end too. Caddy has no site block for the
apex, so it never gets a cert for it and discovery fails with a TLS or
connection error rather than a 404. Nothing warns; the one contradicting
line is a green [+] among docker pull output.

Moving the apex had the squid shape: compose reads the shell environment
first, so the new value served for that run only, and the documented later
`docker compose up -d` fell back to stale .env and reverted it.

Record which of the two keys arrived in the environment BEFORE the ":="
defaults, then write those through with a set_env upsert. Only keys actually
passed are touched: automations.sh drops a blank optional answer, so "blank"
cannot be told apart from "not supplied" and must not be read as "disable".
Since that means the prompt cannot retire WebFinger, the enabled path now
says so and points at the .env edit that can.

Verified: enabling on a re-run lands in .env and appends the block; changing
the apex lands and is logged; passing nothing touches nothing; BASE_DOMAIN
without REDIRECT_URL still dies rather than half-enabling.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deployments/pocket-id/deploy.sh

@@ -40,6 +40,15 @@ set -euo pipefail
 [[ "$SKIP_PROMPTS" == "1" ]] && FORCE=1
 : "${POCKETID_DOMAIN:=}"
 : "${ACME_EMAIL:=}"
+# Whether the WebFinger keys actually arrived in this script's ENVIRONMENT has to
+# be recorded BEFORE the ":=" defaults below, which make an unset variable look
+# like an empty one. The .env is what decides whether the WebFinger block is
+# served, so a value passed to a re-run has to be written through to it.
+WF_KEYS_FROM_ENV=()
+for _k in BASE_DOMAIN REDIRECT_URL; do
+    if [[ -n "${!_k+x}" ]]; then WF_KEYS_FROM_ENV+=("$_k"); fi
+done
+
 : "${BASE_DOMAIN:=}"            # optional: enables the WebFinger block (set with REDIRECT_URL)
 : "${REDIRECT_URL:=}"          # optional: where the base domain 301s non-webfinger traffic
 
@@ -171,6 +180,17 @@ install -m 0640 "$SCRIPT_DIR/docker-compose.yml" "$STACK_DIR/docker-compose.yml"
 # can be appended when BASE_DOMAIN is set.)
 
 ENV_FILE="$STACK_DIR/.env"
+set_env() {  # <KEY> <value>: update KEY in .env, or append if absent
+    local key="$1" val="$2" esc
+    esc=${val//\/\\}; esc=${esc//|/\|}; esc=${esc//&/\&}
+    if grep -qE "^${key}=" "$ENV_FILE"; then
+        sed -i -e "s|^${key}=.*|${key}=${esc}|" "$ENV_FILE"
+    else
+        printf '%s=%s
+' "$key" "$val" >> "$ENV_FILE"
+    fi
+}
+
 if [[ ! -f "$ENV_FILE" ]]; then
     log "Seeding $ENV_FILE with generated secrets..."
     install -m 0600 "$SCRIPT_DIR/.env.example" "$ENV_FILE"
@@ -183,7 +203,18 @@ if [[ ! -f "$ENV_FILE" ]]; then
         -e "s|^REDIRECT_URL=.*|REDIRECT_URL=${REDIRECT_URL}|" \
         "$ENV_FILE"
 else
-    log ".env exists; leaving secrets alone."
+    log ".env exists; keeping it (secrets and values not passed are left alone)."
+    # The WebFinger decision below is read from .env, so a BASE_DOMAIN passed to a
+    # re-run has to land there -- otherwise enabling WebFinger is a silent no-op
+    # that still reports DEPLOYED. Only keys actually passed this run are touched:
+    # automations.sh drops a blank optional answer, so "blank" is indistinguishable
+    # from "not supplied" and must not be treated as "disable".
+    for _k in ${WF_KEYS_FROM_ENV[@]+"${WF_KEYS_FROM_ENV[@]}"}; do
+        _cur=$(sed -n "s/^${_k}=//p" "$ENV_FILE" | tail -n1)
+        if [[ "$_cur" == "${!_k}" ]]; then continue; fi
+        set_env "$_k" "${!_k}"
+        log "  ${_k}: ${_cur:-<unset>} -> ${!_k:-<empty>}"
+    done
 fi
 
 # Validate required values are present.
@@ -202,6 +233,8 @@ ru="$(sed -n 's/^REDIRECT_URL=//p' "$ENV_FILE")"
 if [[ -n "$bd" ]]; then
     [[ -n "$ru" ]] || die "BASE_DOMAIN is set but REDIRECT_URL is empty in $ENV_FILE; set both or neither."
     log "WebFinger enabled -- serving /.well-known/webfinger at ${bd}."
+    log "  (to retire it, clear BASE_DOMAIN + REDIRECT_URL in $ENV_FILE and re-run --"
+    log "   leaving the prompt blank cannot disable it, as a blank answer is dropped)"
     cat "$SCRIPT_DIR/Caddyfile.webfinger" >> "$STACK_DIR/Caddyfile"
 else
     log "No BASE_DOMAIN -- pocket-id only (use the webfinger deployment for OIDC discovery)."