From 036db767738bb9e773282b0cafdb67be9c0a8342 Mon Sep 17 00:00:00 2001
From: Dorian <z00york@mac.com>
Date: Sun, 19 Apr 2026 10:37:00 -0400
Subject: [PATCH] fix(iso): escape $svc in mask-loop heredoc (was expanding to
 empty)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previous build's STEP 47/50 log showed:
  RUN for svc in nostr-vpn archipelago-wg archipelago-wg-address; do
    rm -f /etc/systemd/system/.service
    ln -sf /dev/null /etc/systemd/system/.service
  done

The Dockerfile is generated via <<DOCKERFILE heredoc in the build
script, so unescaped $svc resolved in the outer bash BEFORE Docker
ever saw it, leaving nostr-vpn/wg masks as a hidden `.service` file
with no effect. nostr-vpn still tries to start on boot → [FAILED].

Fixed with \$svc so the literal lands in the Dockerfile for Docker's
shell to expand per iteration.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 image-recipe/build-auto-installer-iso.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/image-recipe/build-auto-installer-iso.sh b/image-recipe/build-auto-installer-iso.sh
index f028bd50..becd3b5d 100755
--- a/image-recipe/build-auto-installer-iso.sh
+++ b/image-recipe/build-auto-installer-iso.sh
@@ -474,8 +474,8 @@ RUN systemctl mask archipelago-fips.service || true
 # removes the symlink and drops in a configured service when env
 # files are in place.
 RUN for svc in nostr-vpn archipelago-wg archipelago-wg-address; do \\
-      rm -f /etc/systemd/system/$svc.service; \\
-      ln -sf /dev/null /etc/systemd/system/$svc.service; \\
+      rm -f /etc/systemd/system/\$svc.service; \\
+      ln -sf /dev/null /etc/systemd/system/\$svc.service; \\
     done
 
 # Remove policy-rc.d so services can start on first boot