fix: sync /etc/ssh only, not all of /etc/

Restoring all of /etc/ was overwriting system configs (PAM, nsswitch,
alternatives) which broke sshd after restart. Now only sync /etc/ssh/
for SSH host keys. Also restart sshd after restore to pick up restored
host keys, and add error logging to rsync.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

entrypoint.py

@@ -3,7 +3,7 @@
 HuggingRun v2 — Ubuntu Server on HuggingFace Spaces.
 
 Persistence via HF Dataset (direct file sync, no archives):
-  - Sync scope: /home, /root, /usr/local, /opt, /var/lib, /etc, /etc/ssh
+  - Sync scope: /home, /root, /usr/local, /opt, /var/lib, /etc/ssh
   - System packages: saved as package name list, restored via apt install
   - Symlinks/permissions safe: no system binary dirs synced
 """
@@ -31,15 +31,11 @@ BASE_PKG_FILE = "/etc/base-packages.list"
 PKG_FILE = os.path.join(PERSIST_PATH, "user-packages.list")
 
 # Directories to sync (user data only, no system binaries)
-SYNC_DIRS = ["/home", "/root", "/usr/local", "/opt", "/var/lib", "/etc"]
+# NOTE: /etc/ssh only (for host keys), NOT all of /etc/ (breaks sshd/PAM)
+SYNC_DIRS = ["/home", "/root", "/usr/local", "/opt", "/var/lib", "/etc/ssh"]
 
 # Exclude from rsync
-RSYNC_EXCLUDES = [
-    "*.sock", "*.pid", "*.lock",
-    "/etc/hostname", "/etc/hosts", "/etc/resolv.conf", "/etc/mtab",
-    "/etc/alternatives",    # symlinks, apt rebuilds
-    "/etc/ld.so.cache",     # rebuilt by ldconfig
-]
+RSYNC_EXCLUDES = ["*.sock", "*.pid", "*.lock"]
 
 # Exclude from HF upload
 UPLOAD_IGNORE = [
@@ -61,9 +57,11 @@ def log(msg):
         pass
 
 
-def sh(cmd):
+def sh(cmd, log_err=False):
     """Run shell command, return (exit_code, stdout)."""
     r = subprocess.run(cmd, shell=True, capture_output=True, text=True)
+    if log_err and r.returncode != 0 and r.stderr:
+        log(f"  cmd error: {r.stderr.strip()[:200]}")
     return r.returncode, (r.stdout or "").strip()
 
 
@@ -144,11 +142,11 @@ def restore():
         if not os.path.isdir(src):
             continue
         cmd = f"rsync -rlptD {excludes} '{src}/' '{d}/'"
-        rc, _ = sh(cmd)
+        rc, _ = sh(cmd, log_err=True)
         if rc == 0:
             log(f"  {d}/ restored")
         else:
-            log(f"  {d}/ restore failed")
+            log(f"  {d}/ restore failed (rc={rc})")
 
     # Reinstall apt packages
     if os.path.exists(PKG_FILE) and os.path.exists(BASE_PKG_FILE):
@@ -169,6 +167,14 @@ def restore():
     else:
         log("── RESTORE: no package list")
 
+    # Restart sshd to pick up restored host keys
+    sh("pkill -x sshd")
+    time.sleep(0.5)
+    os.makedirs("/run/sshd", exist_ok=True)
+    rc, _ = sh(f"/usr/sbin/sshd -o Port={SSH_PORT} -o ListenAddress=127.0.0.1 "
+               f"-o PermitRootLogin=yes -o PasswordAuthentication=yes -o UsePAM=yes")
+    log(f"  sshd restarted {'ok' if rc == 0 else 'FAILED'}")
+
     # Fix up after restore
     sh('ldconfig 2>/dev/null')
     log("── RESTORE: complete")