An update you can ask for, and a boundary that stays where it was

The button cannot do the work, and that is the whole design. The service runs as
an unprivileged account, cannot restart itself, and should not be able to: a web
application that can restart its own service is one whose worst day is much
worse. So /admin/updates writes a file, and an opt-in systemd .path unit runs
deploy/update.sh as root.

Three properties hold it up, and each is a thing that could have been got wrong.
The request file carries nothing that reaches a command line -- no branch, no
ref, no arguments -- because the branch is baked into the unit at install time,
so pressing the button is always "deploy the branch this host was configured
with" and can never be "deploy something else". It is off unless somebody passes
INSTALL_UPDATE_HELPER=1, and re-running the installer without it removes both
units and the marker. And without the helper the page says so and prints the
manual command rather than writing a file nothing is watching, which would be a
button that reports success and does nothing.

The card that says all of this is rendered whether or not there is anything to
apply. It was inside the "there is an update" branch first, so an administrator
could not discover the helper was missing until the day they needed it, which is
the worst possible moment.

Opening the page makes no network request; Check is the one thing that fetches.
And it shows the log between, not a count: "3 behind" is a number somebody has to
go and look up, while the subjects are what decides whether this is worth
restarting for right now.

Docker is one stage, because there is nothing to build -- no Node, no compiled
assets. It bakes no secret key (one in an image is one every copy shares, and
rotating it makes stored API keys unreadable), no data, and no .git, so
/admin/updates inside a container correctly reports that it was not installed
from a checkout. Compose publishes on loopback and refuses to start without a
key. TLS in front is a constraint rather than a recommendation: the service
worker and the microphone both require HTTPS or localhost.

The image was built and run before this was committed, which is how the missing
COPY of LICENSE was found -- pyproject declares it and the build backend reads
it, so the failure reads like a packaging problem and is one line.

deploy/lxc-install.sh creates an unprivileged Debian container and runs the
existing installer inside it. A wrapper, not a second install path: a parallel
installer is two things to keep correct and one of them rots.

/healthz opens the database rather than only proving the socket is listening -- a
process that is up with a database it cannot open answers every page with a 500
-- and says nothing about what is here, being reachable without signing in.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deploy/install.sh

@@ -26,6 +26,11 @@ SERVICE_USER="${SERVICE_USER:-lembas}"
 HOME_DIR="${HOME_DIR:-/home/lembas}"
 PREFIX="${PREFIX:-/srv/lembas}"
 BRANCH="${LEMBAS_BRANCH:-main}"
+# Whether to install the units that let the web interface update this host.
+# Off, and off on a re-run that does not ask for it: it grants anybody who can
+# administer the web UI the ability to deploy the branch, as root. See the
+# "Updating from the web interface" section of deploy/README.md.
+INSTALL_UPDATE_HELPER="${INSTALL_UPDATE_HELPER:-0}"
 # Default to wherever this checkout came from, so a fork deploys itself.
 REPO_URL="${REPO_URL:-$(git -C "$HERE" remote get-url origin 2>/dev/null || true)}"
 
@@ -43,6 +48,11 @@ echo "   host    : https://$SITE_HOST  ->  127.0.0.1:$APP_PORT"
 echo "   user    : $SERVICE_USER ($HOME_DIR)"
 echo "   prefix  : $PREFIX"
 echo "   repo    : $REPO_URL ($BRANCH)"
+if [[ "$INSTALL_UPDATE_HELPER" == "1" ]]; then
+  echo "   updates : web interface may deploy $BRANCH as root (helper units)"
+else
+  echo "   updates : by hand only ($PREFIX/app/deploy/update.sh)"
+fi
 
 echo "== service user =="
 # --system: no ageing, no mail spool. Home under /home, not /var/lib, so the
@@ -101,6 +111,11 @@ LEMBAS_PORT=$APP_PORT
 LEMBAS_LOG_LEVEL=info
 LEMBAS_ALLOW_SIGNUP=true
 LEMBAS_DEFAULT_THEME=moria
+# Which branch /admin/updates compares against. Deployment configuration, not
+# an instance setting: it decides what code runs here, and a value a web
+# administrator could edit would turn "you may deploy the branch" into "you may
+# deploy anything".
+LEMBAS_UPDATE_BRANCH=$BRANCH
 EOF
   sudo chown "$SERVICE_USER:$SERVICE_USER" "$ENV_FILE"
   sudo chmod 600 "$ENV_FILE"
@@ -120,6 +135,35 @@ sed -e "s|__PREFIX__|$PREFIX|g" -e "s|__SERVICE_USER__|$SERVICE_USER|g" \
 sha256sum "$HERE/lembas.service" | cut -d' ' -f1 | sudo tee "$PREFIX/.unit-applied" >/dev/null
 sudo systemctl daemon-reload
 
+echo "== update helper =="
+# Two units and a marker. The marker is what the web interface reads to decide
+# whether to offer the button at all -- a file rather than `systemctl
+# is-enabled`, because that would be a subprocess on every page render to answer
+# a question that changes once.
+UPDATE_MARKER="$PREFIX/data/.update-helper"
+if [[ "$INSTALL_UPDATE_HELPER" == "1" ]]; then
+  for unit in lembas-update.path lembas-update.service; do
+    sed -e "s|__PREFIX__|$PREFIX|g" \
+        -e "s|__SERVICE_USER__|$SERVICE_USER|g" \
+        -e "s|__UPDATE_BRANCH__|$BRANCH|g" \
+        "$HERE/$unit" | sudo tee "/etc/systemd/system/$unit" >/dev/null
+  done
+  sudo systemctl daemon-reload
+  sudo systemctl enable --now lembas-update.path
+  sudo touch "$UPDATE_MARKER"
+  sudo chown "$SERVICE_USER:$SERVICE_USER" "$UPDATE_MARKER"
+  echo "   installed. The web interface can now deploy $BRANCH and restart."
+else
+  # Removed rather than left, so turning it off is re-running without the flag
+  # rather than remembering three commands. The button then says so and prints
+  # the manual one, which is the honest degradation.
+  sudo systemctl disable --now lembas-update.path 2>/dev/null || true
+  sudo rm -f /etc/systemd/system/lembas-update.path \
+             /etc/systemd/system/lembas-update.service "$UPDATE_MARKER"
+  sudo systemctl daemon-reload
+  echo "   not installed (INSTALL_UPDATE_HELPER=1 to allow updating from the web UI)"
+fi
+
 echo "== self-signed cert for $SITE_HOST =="
 sudo mkdir -p /etc/nginx/ssl
 if [[ ! -f "/etc/nginx/ssl/$SITE_HOST.crt" ]]; then