An update you can ask for, and a boundary that stays where it was

The button cannot do the work, and that is the whole design. The service runs as
an unprivileged account, cannot restart itself, and should not be able to: a web
application that can restart its own service is one whose worst day is much
worse. So /admin/updates writes a file, and an opt-in systemd .path unit runs
deploy/update.sh as root.

Three properties hold it up, and each is a thing that could have been got wrong.
The request file carries nothing that reaches a command line -- no branch, no
ref, no arguments -- because the branch is baked into the unit at install time,
so pressing the button is always "deploy the branch this host was configured
with" and can never be "deploy something else". It is off unless somebody passes
INSTALL_UPDATE_HELPER=1, and re-running the installer without it removes both
units and the marker. And without the helper the page says so and prints the
manual command rather than writing a file nothing is watching, which would be a
button that reports success and does nothing.

The card that says all of this is rendered whether or not there is anything to
apply. It was inside the "there is an update" branch first, so an administrator
could not discover the helper was missing until the day they needed it, which is
the worst possible moment.

Opening the page makes no network request; Check is the one thing that fetches.
And it shows the log between, not a count: "3 behind" is a number somebody has to
go and look up, while the subjects are what decides whether this is worth
restarting for right now.

Docker is one stage, because there is nothing to build -- no Node, no compiled
assets. It bakes no secret key (one in an image is one every copy shares, and
rotating it makes stored API keys unreadable), no data, and no .git, so
/admin/updates inside a container correctly reports that it was not installed
from a checkout. Compose publishes on loopback and refuses to start without a
key. TLS in front is a constraint rather than a recommendation: the service
worker and the microphone both require HTTPS or localhost.

The image was built and run before this was committed, which is how the missing
COPY of LICENSE was found -- pyproject declares it and the build backend reads
it, so the failure reads like a packaging problem and is one line.

deploy/lxc-install.sh creates an unprivileged Debian container and runs the
existing installer inside it. A wrapper, not a second install path: a parallel
installer is two things to keep correct and one of them rots.

/healthz opens the database rather than only proving the socket is listening -- a
process that is up with a database it cannot open answers every page with a 500
-- and says nothing about what is here, being reachable without signing in.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deploy/README.md

@@ -45,7 +45,37 @@ Everything is overridable from the environment:
 | `HOME_DIR` | `/home/lembas` | that account's home |
 | `PREFIX` | `/srv/lembas` | install root (bind mount of `HOME_DIR`) |
 | `REPO_URL` | this checkout's `origin` | so a fork deploys itself |
-| `LEMBAS_BRANCH` | `main` | branch to deploy |
+| `LEMBAS_BRANCH` | `main` | branch to deploy, and what `/admin/updates` compares against |
+| `INSTALL_UPDATE_HELPER` | `0` | `1` lets the web interface deploy that branch as root |
+
+## Updating from the web interface
+
+`/admin/updates` says what is running, what is on the branch and what changed
+between. **Checking** reaches the remote; opening the page does not.
+
+The button is opt-in, and the reason is a boundary rather than caution:
+
+```bash
+INSTALL_UPDATE_HELPER=1 SITE_HOST=chat.example ./deploy/install.sh
+```
+
+That installs `lembas-update.path` and `lembas-update.service`. The web
+interface writes `$PREFIX/data/update-requested`; the path unit notices and the
+service runs `update.sh` **as root**.
+
+**What that grants.** Anybody who can administer this web interface can then
+deploy whatever is on the configured branch and restart the service. That is the
+point of it, and it is why it is not the default.
+
+**What it deliberately does not grant.** The request file carries nothing that
+reaches a command line — no branch, no ref, no arguments. The branch is baked
+into the unit at install time from `LEMBAS_BRANCH`, so the button is always
+"deploy the branch this host was configured with" and never "deploy something
+else". Re-running the installer without the flag removes both units and the
+marker, and the page goes back to printing the manual command.
+
+Without the helper the page says so and shows `sudo …/deploy/update.sh`, which is
+the same honest degradation the SSH and search extras have.
 
 ## Deploying a change
 
@@ -59,6 +89,45 @@ reinstalls dependencies and restarts, printing the commits it pulled. The hard
 reset is deliberate: nothing is ever edited in place there, so there is no local
 work to preserve and no conflicts to resolve.
 
+## In a container
+
+A `Dockerfile` and a `docker-compose.yml` are in the repository root.
+
+```bash
+echo "LEMBAS_SECRET_KEY=$(python -c 'import secrets;print(secrets.token_urlsafe(48))')" > .env
+docker compose up -d
+```
+
+It publishes on `127.0.0.1:8080` and expects **a TLS reverse proxy in front**.
+That is a constraint, not a preference: a service worker and a microphone both
+require HTTPS or localhost, so over plain http on a LAN address the app cannot be
+installed and cannot dictate — and the session cookie is deliberately not marked
+`secure`, so an attacker on that network could steal a session.
+
+Three things about the image:
+
+- **No secret key is baked in**, and compose refuses to start without one. A key
+  in an image is a key every copy of that image shares, and rotating it signs
+  everybody out *and* makes stored upstream API keys unreadable.
+- **`.git` is excluded**, so `/admin/updates` inside a container says it was not
+  installed from a checkout and offers nothing. That is correct: a container is
+  updated by pulling a new image.
+- **One replica.** The generation registry, the stop mechanism, the terminal
+  sessions and the schedule ticker are all in-process — two would mean two
+  tickers and every schedule firing twice.
+
+## On Proxmox
+
+```bash
+CTID=140 SITE_HOST=chat.example ./deploy/lxc-install.sh
+```
+
+Run on the Proxmox host. It creates an **unprivileged** Debian container,
+installs the dependencies, and runs `deploy/install.sh` inside it — the same
+installer, so a fix there reaches this without anybody remembering. Unprivileged
+is not a default to change: nothing LLeMbas does needs privilege, because agent
+chats run their commands over SSH on some *other* machine.
+
 ## Operating it
 
 ```bash