Fix letsencrypt auto-renew.

README.md

@@ -284,7 +284,8 @@ dokku google-auth:allow my-app alice@signal.org    # …or just on one app
 dokku google-auth:deny --global former@signal.org  # cut someone off
 dokku google-auth:disable my-app    # turn SSO off for an app
 dokku google-auth:logs -t           # follow auth service logs (sign-ins, denials)
-dokku google-auth:restart           # restart the auth service
+dokku google-auth:restart           # restart the auth service (rebuilds if the source moved)
+dokku google-auth:rebuild           # force a rebuild when the source looks unchanged
 ```
 
 Users can check who they're signed in as at `https://<any-app>/_google-auth/`
@@ -315,12 +316,18 @@ and sign out at `https://<any-app>/_google-auth/logout`.
 - **Plugin updates:** `sudo dokku plugin:update google-auth` rebuilds the
   service image and recreates the container with freshly written settings.
   Editing the plugin directory in place works too: the image is tagged with a
-  fingerprint of its source, so `google-auth:restart` (and anything else that
-  starts the service) rebuilds when the Go code has moved rather than reusing
-  the binary that happens to be tagged. This matters because the shell half of
-  the plugin takes effect the moment the files change while the binary does
-  not, and a container running an older build accepts the mount, accepts
-  `GOOGLE_AUTH_APP_CONFIG_DIR`, and ignores both.
+  fingerprint of `Dockerfile`, `go.mod`, `cmd/`, and `internal/`, so
+  `google-auth:restart` (and anything else that starts the service) rebuilds
+  when the Go code has moved rather than reusing the binary that happens to be
+  tagged. This matters because the shell half of the plugin takes effect the
+  moment the files change while the binary does not, and a container running an
+  older build accepts the mount, accepts `GOOGLE_AUTH_APP_CONFIG_DIR`, and
+  ignores both.
+  That fingerprint covers this plugin's own source and nothing else, so when
+  the inputs it cannot see change — a patched `golang:1.24-alpine`, a build that
+  died halfway — force the rebuild: `dokku google-auth:rebuild`, or
+  `dokku google-auth:rebuild --no-cache` to also discard the layer cache and
+  re-pull the base images.
   `dokku google-auth:report` names the running service's state — it asks the
   service itself rather than trusting Docker's metadata — and if it ever says
   it is ignoring per-app lists, `dokku google-auth:restart` recreates it.