Record the phase 7 NixOS build and the deploy steps in the plan

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plan.md

@@ -681,11 +681,8 @@ server `7cc964a`, website `f5194ee3`, `9ebe84ea`, `8d540642`, all local
   `c776256497b66f7c91a74162cfcd943b0f45ee2e` is
   `sha256-4A+aVnFrKyWQjFnH2N/CwoVIlwrcgV2fYYrtaOiodo0=` for `fetchFromGitHub`.
 
-Still open for step 3: push both forks to Gitea, add the website flake as a
-nix-pleb input (nix-pleb currently has an uncommitted, staged `flake.lock`
-change that isn't ours), and give Caddy read access to the state dir
-(`StateDirectoryMode=0750` and `caddy` in group `plebleader`, phase 7). The
-vhost below is the tested version.
+Step 3 was done together with phase 7 (see there): the vhost below is in
+nix-pleb, waiting for the switch.
 
 1. In the website fork, point `BL_REPLAYS_URL` (and the "watch replay" links)
    at `/arcviewer/?replayURL=<encoded local replay url>&url=<encoded /cdn/maps/<hash>.zip>`.
@@ -843,6 +840,51 @@ the local zip.
 
 ### Phase 7: NixOS deployment on incineroar
 
+**Built 2026-11-09, not switched yet.** nix-pleb branch `plebleader`
+(`2ada4b7`, in the worktree `~/ops/nix-pleb-plebleader`, based on `main`
+`981f9e7`) adds the inputs `plebleader-server` (server `0481759`) and
+`plebleader-website` (`8d540642`), both following `nixpkgs-unstable`, plus to
+`incineroar/workstation.nix`: user and group `plebleader` (with `caddy` in
+the group), `plebleader-api`, a one-shot `plebleader-import`, ArcViewer
+`fetchFromGitHub` and the 4442 vhost. The toplevel builds, and the system's
+Caddy adapts the generated Caddyfile. The sync unit and timer and the sops
+secret wait for phase 6's `sync` command. What differs from the bullets
+below:
+
+- Server fork: the private upstream submodules (`beatleader-server-private`,
+  `bs-simulator`) are removed from `.gitmodules`, because a
+  submodule-aware fetch fails on them. The flake sets `self.submodules`; the
+  nix-pleb input uses `?ref=pleb/main&submodules=1` over SSH (the models fork's
+  scp-style URL fetches fine). The package's `version` is a fixed `0.1.0`:
+  `buildDotnetModule` hands it to MSBuild, and a git short rev made restore
+  fail with no message (`NU1105` only in `project.assets.json`). 336 NuGet
+  packages in `deps.json`. The package was tested by hand (importer and API
+  on a scratch DB, all endpoints 200, `wwwroot` included).
+- Website: the yarn v1 flake from phase 4, not `buildNpmPackage`.
+- Units: `WorkingDirectory=/var/lib/plebleader/app` (data protection keys go
+  to `../keys`), `StateDirectory` for `app`, `db`, `storage`, `maps`,
+  `StateDirectoryMode=0750` and `UMask=0027`, so Caddy reads through the group
+  and nothing is world-readable. Paths and `PublicBaseUrl` come from the
+  fork's `appsettings.Mirror.json`, so the units only set
+  `ASPNETCORE_ENVIRONMENT=Mirror`, `ASPNETCORE_URLS` and `HOME`.
+
+To deploy (the user does this):
+
+1. Merge `plebleader` into nix-pleb `main`. The main checkout has uncommitted
+   `flake.lock` changes, so commit or stash those first, or cherry-pick the
+   commit and rerun `nix flake lock` if `flake.lock` conflicts. Then
+   `sudo --preserve-env=SSH_AUTH_SOCK nixos-rebuild switch --flake .#incineroar`.
+   `plebleader-api` starts on empty databases.
+2. Move the archive in (21 GB; `/home` and `/` are separate filesystems, so
+   this is a copy):
+   `doas cp -a ~/ops/beatsaber/plebsaber.stream/.data/plebleader/archive /var/lib/plebleader/`,
+   then `doas chown -R plebleader:plebleader /var/lib/plebleader/archive` and
+   `doas chmod -R g+rX,o-rwx /var/lib/plebleader/archive`. Keep the token chain
+   (`.data/plebleader/auth`) where it is until phase 6 moves the sync.
+3. `doas systemctl start plebleader-import`, then open
+   `https://incineroar.brenise.dev:4442/u/pleb` and a replay.
+4. Afterwards, remove the worktree with `git worktree remove ../nix-pleb-plebleader`.
+
 - Packages: `buildDotnetModule` for the fork (generate `deps.json` with
   `nix build .#…passthru.fetch-deps`), `buildNpmPackage` for the website (start
   with `npmDepsHash = lib.fakeHash`, then pin the `got:` value), and