From 8c3fe97939fb75c124ec346b69e5dc45b307709f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20Bene=C5=A1?= Date: Sat, 1 Aug 2026 19:35:42 +0200 Subject: [PATCH] Say when the systemd unit has moved on update.sh pulls the code and restarts, and says nothing about the unit -- so a host can run a new release under the old confinement and fail in a way that points nowhere. Dropping ProtectKernelTunables is exactly such a change: without it applied, an agent chat cannot start a sandbox at all. It compares the *template* against the one last applied here rather than against the installed file. An installed unit grows host-specific lines -- an ordering dependency on whatever serves the models, a note about how the prefix is mounted -- and diffing the files would warn about those forever. A warning that always fires is one nobody reads. Reinstalling automatically would clobber those same lines, so it only says so and leaves the merge to a person. Co-Authored-By: Claude Opus 5 (1M context) --- deploy/install.sh | 4 ++++ deploy/update.sh | 31 +++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+) diff --git a/deploy/install.sh b/deploy/install.sh index 9a095ec..2a1d4c3 100755 --- a/deploy/install.sh +++ b/deploy/install.sh @@ -110,6 +110,10 @@ sudo install -d -o "$SERVICE_USER" -g "$SERVICE_USER" -m 750 "$PREFIX/data" echo "== systemd unit ==" sed -e "s|__PREFIX__|$PREFIX|g" -e "s|__SERVICE_USER__|$SERVICE_USER|g" \ "$HERE/lembas.service" | sudo tee /etc/systemd/system/lembas.service >/dev/null +# Which version of the template this host is running. update.sh compares +# against it and says so when the template moves on, because the installed +# unit usually grows host-specific lines and cannot simply be overwritten. +sha256sum "$HERE/lembas.service" | cut -d' ' -f1 | sudo tee "$PREFIX/.unit-applied" >/dev/null sudo systemctl daemon-reload echo "== self-signed cert for $SITE_HOST ==" diff --git a/deploy/update.sh b/deploy/update.sh index a98da8b..fd35400 100755 --- a/deploy/update.sh +++ b/deploy/update.sh @@ -43,6 +43,37 @@ fi echo "== dependencies ==" sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP[search]" +# The unit is NOT reinstalled automatically. An installed unit usually carries +# host-specific lines the template cannot know about -- an ordering dependency +# on whatever serves the models, a note about how the prefix is mounted -- and +# overwriting those on every update would be a worse surprise than drifting. +# +# So this compares the *template* against the one last applied here, not the +# template against the installed file. Comparing the files would warn forever +# about the local lines, and a warning that always fires is one nobody reads. +# +# The drift is worth catching: a change in the unit can be what makes a release +# work at all. Dropping ProtectKernelTunables is why an agent chat can start a +# sandbox, and a host that pulled the code without it would run the new version +# under the old confinement and fail confusingly. +STAMP="$PREFIX/.unit-applied" +current=$(sha256sum "$APP/deploy/lembas.service" | cut -d' ' -f1) +if [[ -f "$STAMP" && "$(cat "$STAMP")" != "$current" ]]; then + echo "== systemd unit ==" >&2 + echo " deploy/lembas.service has changed since it was last applied here." >&2 + echo " Review it and merge by hand, keeping this host's own lines:" >&2 + echo " diff /etc/systemd/system/lembas.service <(sed \\" >&2 + echo " -e 's|__PREFIX__|$PREFIX|g' -e 's|__SERVICE_USER__|$SERVICE_USER|g' \\" >&2 + echo " $APP/deploy/lembas.service)" >&2 + echo " Then: sudo systemctl daemon-reload && sudo systemctl restart lembas" >&2 + echo " And record it as applied: echo $current | sudo tee $STAMP" >&2 +elif [[ ! -f "$STAMP" ]]; then + # First run after this check was added. Assume what is installed is current; + # there is nothing to compare against and crying wolf on every host once is + # not worth it. + echo "$current" | sudo tee "$STAMP" >/dev/null +fi + echo "== restart ==" sudo systemctl restart lembas sleep 2