fix(ci): sync observability configs to host before docker compose up (#598)

DooD runner only shares /var/run/docker.sock — no workspace directory is
mapped to the host daemon. Relative bind mounts in
docker-compose.observability.yml resolved to paths that didn't exist on
the host; Docker auto-created directories in their place, causing
'not a directory' mount failures for all five config files.

Fix:
- docker-compose.observability.yml: replace hardcoded ./infra/observability/
  prefix with ${OBS_CONFIG_DIR:-./infra/observability} so the path is
  configurable while remaining backwards-compatible for local use.
- nightly.yml / release.yml: add a 'Sync observability configs to host'
  step that finds the job container's overlay2 MergedDir (the container's
  full filesystem as seen from the host mount namespace), then uses the
  existing nsenter/alpine pattern to cp the config tree into a stable host
  path (/srv/familienarchiv-{staging,production}/obs-configs).
  OBS_CONFIG_DIR is injected into the env file so Compose picks it up.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/nightly.yml

@@ -85,6 +85,7 @@ jobs:
           GLITCHTIP_SECRET_KEY=${{ secrets.GLITCHTIP_SECRET_KEY }}
           GLITCHTIP_DOMAIN=https://glitchtip.archiv.raddatz.cloud
           SENTRY_DSN=${{ secrets.SENTRY_DSN }}
+          OBS_CONFIG_DIR=/srv/familienarchiv-staging/obs-configs
           EOF
 
       - name: Verify backend /import:ro mount is wired
@@ -131,6 +132,24 @@ jobs:
             --profile staging \
             up -d --wait --remove-orphans
 
+      - name: Sync observability configs to host
+        # DooD: runner-config.yaml only shares /var/run/docker.sock with the host
+        # daemon — no workspace directory is mapped. Relative bind mounts in
+        # docker-compose.observability.yml would resolve to paths that don't
+        # exist on the host; Docker auto-creates directories in their place,
+        # causing "not a directory" mount failures at container startup.
+        #
+        # Fix: find the job container's overlay2 merged directory (visible in the
+        # host's mount namespace), then use nsenter to copy from there into a
+        # stable host path. The overlay path is the job container's full
+        # filesystem as seen from the host — no socket tricks needed.
+        run: |
+          OVERLAY=$(docker inspect "$(hostname)" --format '{{.GraphDriver.Data.MergedDir}}')
+          SRC="${OVERLAY}$(pwd)/infra/observability"
+          docker run --rm --privileged --pid=host \
+            alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d \
+            sh -c "nsenter -t 1 -m -- sh -c 'mkdir -p /srv/familienarchiv-staging/obs-configs && cp -r \"${SRC}/.\" /srv/familienarchiv-staging/obs-configs/'"
+
       - name: Start observability stack
         run: |
           docker compose \

.gitea/workflows/release.yml

@@ -83,6 +83,7 @@ jobs:
           GLITCHTIP_SECRET_KEY=${{ secrets.GLITCHTIP_SECRET_KEY }}
           GLITCHTIP_DOMAIN=https://glitchtip.archiv.raddatz.cloud
           SENTRY_DSN=${{ secrets.SENTRY_DSN }}
+          OBS_CONFIG_DIR=/srv/familienarchiv-production/obs-configs
           EOF
 
       - name: Build images
@@ -104,6 +105,16 @@ jobs:
             --env-file .env.production \
             up -d --wait --remove-orphans
 
+      - name: Sync observability configs to host
+        # DooD: same overlay2 trick as nightly.yml — see that file for the
+        # full rationale. Production path: /srv/familienarchiv-production/obs-configs.
+        run: |
+          OVERLAY=$(docker inspect "$(hostname)" --format '{{.GraphDriver.Data.MergedDir}}')
+          SRC="${OVERLAY}$(pwd)/infra/observability"
+          docker run --rm --privileged --pid=host \
+            alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d \
+            sh -c "nsenter -t 1 -m -- sh -c 'mkdir -p /srv/familienarchiv-production/obs-configs && cp -r \"${SRC}/.\" /srv/familienarchiv-production/obs-configs/'"
+
       - name: Start observability stack
         run: |
           docker compose \