fix: restore original services on partial deployment failure

scripts/deploy-unraid.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Run on Unraid after building both images. Never source secret values into logs.
+ROOT=/mnt/user/appdata/hope-voice
+ENV_FILE="$ROOT/runtime.env"
+test -f "$ENV_FILE"
+test -d "$ROOT/accounts"
+test -d "$ROOT/hermes"
+test -f "$ROOT/livekit.yaml"
+test -d /mnt/user/dev/hope-voice-api/certs
+STAMP=$(date -u +%Y%m%dT%H%M%SZ)
+BACKUP="$ROOT/rollback/$STAMP"
+mkdir -p "$BACKUP"
+chmod 700 "$ROOT" "$BACKUP"
+# Capture original immutable IDs before installing state-aware rollback.
+declare -A ORIGINAL
+for name in voice hope-control; do
+  ORIGINAL[$name]=$(docker inspect --format '{{.Id}}' "$name" 2>/dev/null || true)
+done
+rollback() {
+  local code=$?
+  trap - ERR
+  set +e
+  for name in voice hope-control; do
+    current=$(docker inspect --format '{{.Id}}' "$name" 2>/dev/null)
+    # Never remove an original that failed before its rename. Remove only the
+    # replacement occupying the verified fixed name, then restore the original.
+    if [ -n "$current" ] && [ "$current" != "${ORIGINAL[$name]}" ]; then
+      if [ "$(docker inspect --format '{{.Name}}' "$current")" = "/$name" ]; then
+        docker rm -f "$current" >/dev/null
+      fi
+    fi
+    if [ -n "${ORIGINAL[$name]}" ]; then
+      original_name=$(docker inspect --format '{{.Name}}' "${ORIGINAL[$name]}" 2>/dev/null)
+      if [ "$original_name" = "/$name-rollback-$STAMP" ]; then
+        docker rename "${ORIGINAL[$name]}" "$name"
+      fi
+      if [ "$(docker inspect --format '{{.Name}}' "${ORIGINAL[$name]}" 2>/dev/null)" = "/$name" ]; then
+        docker start "${ORIGINAL[$name]}" >/dev/null
+      fi
+    fi
+  done
+  exit "$code"
+}
+trap rollback ERR
+# Configuration receipts contain runtime secrets: root-only, never output them.
+for name in voice hope-control; do
+  if [ -n "${ORIGINAL[$name]}" ]; then
+    docker inspect "$name" > "$BACKUP/$name.json"
+    chmod 600 "$BACKUP/$name.json"
+    test "$(docker inspect --format '{{.Name}}' "$name")" = "/$name"
+    docker stop "$name" >/dev/null
+    docker rename "$name" "$name-rollback-$STAMP"
+  fi
+done
+
+docker run -d --name hope-control --network host --restart unless-stopped \
+  --env-file "$ENV_FILE" \
+  -e CONTROL_DB_PATH=/var/lib/hope/accounts.sqlite3 \
+  -e CONTROL_HOST=127.0.0.1 -e CONTROL_PORT=8092 \
+  -v "$ROOT/accounts:/var/lib/hope" \
+  -v "$ROOT/hermes:$ROOT/hermes" \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  --log-opt max-size=10m --log-opt max-file=3 hope-voice-control:latest >/dev/null
+for attempt in $(seq 1 30); do
+  if curl -sf http://127.0.0.1:8092/health -o /dev/null; then break; fi
+  if [ "$attempt" = 30 ]; then false; fi
+  sleep 2
+done
+
+docker run -d --name voice --network host --restart unless-stopped \
+  --env-file "$ROOT/voice.env" \
+  -v /mnt/user/dev/hope-voice-api/certs:/etc/voice/certs \
+  -v "$ROOT/livekit.yaml:/etc/livekit.yaml:ro" \
+  --health-cmd='/opt/voice-agent/.venv/bin/python /opt/voice-agent/healthcheck.py' \
+  --health-interval=15s --health-timeout=5s --health-retries=3 --health-start-period=20s \
+  --log-opt max-size=10m --log-opt max-file=3 hope-voice-api-voice:latest >/dev/null
+for attempt in $(seq 1 30); do
+  if [ "$(docker inspect --format '{{.State.Health.Status}}' voice)" = healthy ]; then break; fi
+  if [ "$attempt" = 30 ]; then false; fi
+  sleep 2
+done
+test "$(curl -sk -o /dev/null -w '%{http_code}' -X POST https://127.0.0.1:9178/token)" = 401
+trap - ERR
+printf 'Deployment healthy; rollback containers retained with suffix %s\n' "$STAMP"