updated logging

modules/core/sovran-hub.nix

@@ -28,7 +28,7 @@ let
       { name = "Matrix-Synapse"; unit = "matrix-synapse.service"; type = "system"; icon = "synapse"; enabled = cfg.services.synapse;          category = "communication"; }
       { name = "Element-Call";   unit = "livekit.service";        type = "system"; icon = "livekit"; enabled = cfg.features.element-calling;  category = "communication"; }
     ]
-    # ── Self-Hosted Apps ───────────────────────────────────────
+    # ── Self-Hosted Apps ────────────────<EFBFBD><EFBFBD>──────────────────────
     ++ [
       { name = "VaultWarden"; unit = "vaultwarden.service";      type = "system"; icon = "vaultwarden"; enabled = cfg.services.vaultwarden; category = "apps"; }
       { name = "Nextcloud";   unit = "phpfpm-nextcloud.service"; type = "system"; icon = "nextcloud";   enabled = cfg.services.nextcloud;   category = "apps"; }
@@ -58,11 +58,18 @@ let
     export PATH="${lib.makeBinPath [ pkgs.nix pkgs.nixos-rebuild pkgs.git pkgs.flatpak pkgs.coreutils ]}:$PATH"
 
     LOG="/var/log/sovran-hub-update.log"
+    LOCK="/run/sovran-hub-update.lock"
+
+    # Create lock file (survives server restarts, cleared on reboot since /run is tmpfs)
+    echo $$ > "$LOCK"
 
     # Truncate the log and redirect ALL output (stdout + stderr) into it
     : > "$LOG"
     exec > >(tee -a "$LOG") 2>&1
 
+    # Ensure lock is removed on exit (success or failure)
+    trap 'rm -f "$LOCK"' EXIT
+
     echo "══════════════════════════════════════════════════"
     echo "  Sovran_SystemsOS Update — $(date)"
     echo "══════════════════════════════════════════════════"