From 1be31b73927ff0fa5b4fbe6a44809a1489448a0c Mon Sep 17 00:00:00 2001
From: Nick Goodall <nbgoodall@users.noreply.github.com>
Date: Tue, 13 Jan 2026 17:10:19 +0000
Subject: [PATCH] restart on secrets update

---
 main.go | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/main.go b/main.go
index ce9818d..66ab452 100644
--- a/main.go
+++ b/main.go
@@ -1099,8 +1099,8 @@ func runDeploy() error {
 		return fmt.Errorf("failed to sync local directories: %w", err)
 	}
 
-	if err := runSSHCommand(ctx.serverIP, systemdRestartScript(ctx.serviceName)); err != nil {
-		return fmt.Errorf("systemd restart failed: %w", err)
+	if err := restartPocketBaseService(ctx); err != nil {
+		return err
 	}
 
 	fmt.Printf("\nDeployment complete; PocketBase should be reachable at https://%s\n", ctx.domain)
@@ -1240,7 +1240,11 @@ func runSecretsSet(ctx *deploymentContext, pairs []string) error {
 		return err
 	}
 
-	fmt.Printf("updated %d secrets\n", len(assignments))
+	if err := restartPocketBaseService(ctx); err != nil {
+		return err
+	}
+
+	fmt.Printf("updated %d secrets and restarted PocketBase\n", len(assignments))
 	return nil
 }
 
@@ -1267,7 +1271,11 @@ func runSecretsDelete(ctx *deploymentContext, keys []string) error {
 		return err
 	}
 
-	fmt.Printf("removed %d secrets\n", len(normalized))
+	if err := restartPocketBaseService(ctx); err != nil {
+		return err
+	}
+
+	fmt.Printf("removed %d secrets and restarted PocketBase\n", len(normalized))
 	return nil
 }
 
@@ -1589,6 +1597,13 @@ systemctl --no-block restart pb@%s
 `, serviceName)
 }
 
+func restartPocketBaseService(ctx *deploymentContext) error {
+	if err := runSSHCommand(ctx.serverIP, systemdRestartScript(ctx.serviceName)); err != nil {
+		return fmt.Errorf("systemd restart failed: %w", err)
+	}
+	return nil
+}
+
 func runSSHCommand(server, script string) error {
 	remoteCmd := fmt.Sprintf("bash --noprofile --norc -c %s", shellQuote(script))
 	cmd := exec.Command("ssh", append(sshArgs(server), remoteCmd)...)