package update

.gitea/workflows/build-publish.yml

@@ -66,16 +66,20 @@ jobs:
                        "${pkg_dir}/usr/lib" \
                        "${pkg_dir}/usr/nginx_lua" \
                        "${pkg_dir}/usr/share/twiy/defaults/nginx" \
-                       "${pkg_dir}/usr/share/twiy/defaults/hostdata"
+                       "${pkg_dir}/nginx/live" "${pkg_dir}/nginx/conf.d" \
+                       "${pkg_dir}/nginx/config" "${pkg_dir}/nginx/modsec" \
+                       "${pkg_dir}/nginx/modules"
 
               cp /usr/sbin/nginx "${pkg_dir}/usr/sbin/"
-              # Pristine configs + default site go into a defaults stash, NOT the
-              # live /nginx and /hostdata trees. postinst seeds them from here
-              # without clobbering local edits (writes <file>.new when a target
-              # already exists). The live files stay untracked by dpkg, so an
-              # upgrade never overwrites a customised config.
-              cp -R /nginx/.          "${pkg_dir}/usr/share/twiy/defaults/nginx/"    || true
-              cp -R /hostdata/default "${pkg_dir}/usr/share/twiy/defaults/hostdata/" || true
+              # /nginx ships as an EMPTY, dpkg-owned skeleton (above): the dirs
+              # are tracked so upgrades from the old layout don't warn about
+              # "unable to delete old directory /nginx", but NO config file under
+              # it is tracked. The pristine configs go into a defaults stash;
+              # postinst places them into /nginx only when missing and never
+              # overwrites an admin-edited file (drops <file>.new instead).
+              # /hostdata is intentionally NOT packaged or seeded — postinst only
+              # ensures the directory exists and never removes it.
+              cp -R /nginx/. "${pkg_dir}/usr/share/twiy/defaults/nginx/" || true
               cp "${unit_src}"  "${pkg_dir}/etc/systemd/system/nginx.service"
               cp -R /usr/nginx_lua "${pkg_dir}/usr/" || true
 
@@ -95,10 +99,14 @@ jobs:
                   "${pkg_name}" "${VERSION}" "${ARCH}" "${conflicts}" "${conflicts}" "${pkg_name}" "${TARGET}" \
                   > "${deb_dir}/control"
 
-              # Shared maintainer script: seeds /nginx + /hostdata from the
-              # defaults stash without overwriting files the admin already has.
+              # Shared maintainer scripts:
+              #   preinst  — backs up /nginx before an upgrade unpacks (so admin
+              #              configs survive the migration off dpkg tracking).
+              #   postinst — restores that backup, then seeds /nginx defaults
+              #              without overwriting any file already there.
+              cp "${REPO_ROOT}/build/deb/preinst"  "${deb_dir}/preinst"
               cp "${REPO_ROOT}/build/deb/postinst" "${deb_dir}/postinst"
-              chmod 755 "${deb_dir}/postinst"
+              chmod 755 "${deb_dir}/preinst" "${deb_dir}/postinst"
 
               dpkg-deb --build "${pkg_dir}"
           }