An update you can ask for, and a boundary that stays where it was
The button cannot do the work, and that is the whole design. The service runs as an unprivileged account, cannot restart itself, and should not be able to: a web application that can restart its own service is one whose worst day is much worse. So /admin/updates writes a file, and an opt-in systemd .path unit runs deploy/update.sh as root. Three properties hold it up, and each is a thing that could have been got wrong. The request file carries nothing that reaches a command line -- no branch, no ref, no arguments -- because the branch is baked into the unit at install time, so pressing the button is always "deploy the branch this host was configured with" and can never be "deploy something else". It is off unless somebody passes INSTALL_UPDATE_HELPER=1, and re-running the installer without it removes both units and the marker. And without the helper the page says so and prints the manual command rather than writing a file nothing is watching, which would be a button that reports success and does nothing. The card that says all of this is rendered whether or not there is anything to apply. It was inside the "there is an update" branch first, so an administrator could not discover the helper was missing until the day they needed it, which is the worst possible moment. Opening the page makes no network request; Check is the one thing that fetches. And it shows the log between, not a count: "3 behind" is a number somebody has to go and look up, while the subjects are what decides whether this is worth restarting for right now. Docker is one stage, because there is nothing to build -- no Node, no compiled assets. It bakes no secret key (one in an image is one every copy shares, and rotating it makes stored API keys unreadable), no data, and no .git, so /admin/updates inside a container correctly reports that it was not installed from a checkout. Compose publishes on loopback and refuses to start without a key. TLS in front is a constraint rather than a recommendation: the service worker and the microphone both require HTTPS or localhost. The image was built and run before this was committed, which is how the missing COPY of LICENSE was found -- pyproject declares it and the build backend reads it, so the failure reads like a packaging problem and is one line. deploy/lxc-install.sh creates an unprivileged Debian container and runs the existing installer inside it. A wrapper, not a second install path: a parallel installer is two things to keep correct and one of them rots. /healthz opens the database rather than only proving the socket is listening -- a process that is up with a database it cannot open answers every page with a 500 -- and says nothing about what is here, being reachable without signing in. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jaroslav Beneš
co-authored by
Claude Opus 5
Claude Opus 5
parent
1b8c9f948c
commit
ddad585e4b
@@ -86,6 +86,10 @@
|
||||
{{ icon("user", "icon--sm") }}
|
||||
<span class="nav-item__label">Users</span>
|
||||
</a>
|
||||
<a class="nav-item {{ 'is-active' if section == 'updates' }}" href="/admin/updates">
|
||||
{{ icon("refresh", "icon--sm") }}
|
||||
<span class="nav-item__label">Updates</span>
|
||||
</a>
|
||||
<a class="nav-item {{ 'is-active' if section == 'groups' }}" href="/admin/groups">
|
||||
{{ icon("users", "icon--sm") }}
|
||||
<span class="nav-item__label">Groups & permissions</span>
|
||||
|
||||
@@ -0,0 +1,175 @@
|
||||
{% extends "admin/_layout.html" %}
|
||||
{% from "_macros.html" import icon %}
|
||||
{% set section = "updates" %}
|
||||
|
||||
{% block title %}Updates - {{ brand.name }}{% endblock %}
|
||||
{% block heading %}Updates{% endblock %}
|
||||
|
||||
{% block admin_content %}
|
||||
<p class="admin-lede">
|
||||
What is running here, what is on <code>{{ state.branch }}</code>, and what
|
||||
changed between. Checking reaches the remote; opening this page does not.
|
||||
</p>
|
||||
|
||||
{% if saved %}
|
||||
<div class="alert alert--success">{{ icon("check", "icon--sm") }} <span>{{ saved }}</span></div>
|
||||
{% endif %}
|
||||
{% if state.error %}
|
||||
<div class="alert alert--error">{{ icon("warning", "icon--sm") }} <span>{{ state.error }}</span></div>
|
||||
{% endif %}
|
||||
|
||||
<section class="card">
|
||||
<h2 class="card__title">Running</h2>
|
||||
<dl class="mode-list">
|
||||
<div class="mode-list__row">
|
||||
<dt><strong>Version</strong></dt>
|
||||
<dd>{{ state.version }}</dd>
|
||||
</div>
|
||||
{% if state.head %}
|
||||
<div class="mode-list__row">
|
||||
<dt><strong>Commit</strong></dt>
|
||||
<dd>
|
||||
<code>{{ state.head.short }}</code> {{ state.head.subject }}
|
||||
{% if state.dirty %}
|
||||
<span class="badge">uncommitted changes</span>
|
||||
{% endif %}
|
||||
</dd>
|
||||
</div>
|
||||
{% endif %}
|
||||
{% if state.checkout %}
|
||||
<div class="mode-list__row">
|
||||
<dt><strong>Checkout</strong></dt>
|
||||
<dd><code>{{ state.checkout }}</code></dd>
|
||||
</div>
|
||||
{% endif %}
|
||||
</dl>
|
||||
|
||||
{% if not state.is_git %}
|
||||
<p class="field__hint">
|
||||
This was not installed from a git checkout — a container image, or a wheel —
|
||||
so there is nothing here to compare or update. Update the image instead.
|
||||
</p>
|
||||
{% else %}
|
||||
<form method="post" action="/admin/updates/check" class="btn-row">
|
||||
<button class="btn" type="submit">
|
||||
{{ icon("globe", "icon--sm") }} Check the remote
|
||||
</button>
|
||||
</form>
|
||||
{% endif %}
|
||||
</section>
|
||||
|
||||
{% if state.is_git %}
|
||||
<section class="card">
|
||||
<h2 class="card__title">
|
||||
Available
|
||||
{% if state.up_to_date %}<span class="badge badge--leaf">up to date</span>
|
||||
{% elif state.behind %}<span class="badge">{{ state.behind | length }} behind</span>
|
||||
{% endif %}
|
||||
</h2>
|
||||
|
||||
{% if not state.remote %}
|
||||
<p class="field__hint">
|
||||
Nothing known about <code>origin/{{ state.branch }}</code> yet. Check the
|
||||
remote above.
|
||||
</p>
|
||||
{% elif state.up_to_date %}
|
||||
<p class="field__hint">
|
||||
<code>{{ state.remote.short }}</code> is what is running.
|
||||
</p>
|
||||
{% else %}
|
||||
<p class="card__lede">
|
||||
<code>{{ state.remote.short }}</code> {{ state.remote.subject }}
|
||||
</p>
|
||||
|
||||
{#
|
||||
The log between, not just a count. "3 behind" is a number somebody has to go
|
||||
and look up; the subjects are the thing that decides whether this is worth
|
||||
restarting for right now.
|
||||
#}
|
||||
<ul class="model-list">
|
||||
{% for commit in state.behind %}
|
||||
<li class="model-list__item">
|
||||
<div style="min-width: 0">
|
||||
<code class="text-xs">{{ commit.short }}</code> {{ commit.subject }}
|
||||
</div>
|
||||
</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
|
||||
{% if state.dirty %}
|
||||
<div class="alert alert--warning">
|
||||
{{ icon("warning", "icon--sm") }}
|
||||
<span>
|
||||
This checkout has uncommitted changes. The update does a hard reset, which
|
||||
would throw them away — nothing here is meant to be edited in place, so
|
||||
this usually means somebody was debugging on the box.
|
||||
</span>
|
||||
</div>
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
</section>
|
||||
|
||||
{#
|
||||
Its own card, and rendered whether or not there is anything to apply. It used
|
||||
to live inside the "there is an update" branch, so an administrator could not
|
||||
find out that the helper was missing until the day they needed it -- which is
|
||||
the worst moment to discover a thing has to be installed from a shell.
|
||||
#}
|
||||
<section class="card">
|
||||
<h2 class="card__title">Applying an update</h2>
|
||||
|
||||
{% if state.requested %}
|
||||
<div class="alert">
|
||||
{{ icon("clock", "icon--sm") }}
|
||||
<span>
|
||||
An update has been requested and is waiting for the helper to pick it up.
|
||||
The service restarts when it does.
|
||||
</span>
|
||||
</div>
|
||||
<form method="post" action="/admin/updates/cancel" class="btn-row">
|
||||
<button class="btn btn--sm" type="submit">Withdraw the request</button>
|
||||
</form>
|
||||
|
||||
{% elif state.helper %}
|
||||
<p class="card__lede">
|
||||
This host has the update helper installed, so the button below writes a
|
||||
request that a systemd unit picks up and runs as root. It always deploys
|
||||
<code>{{ state.branch }}</code> — the request carries no branch and no ref,
|
||||
so pressing it is never “deploy something else”.
|
||||
</p>
|
||||
<form method="post" action="/admin/updates/apply" class="btn-row"
|
||||
data-confirm="Update and restart? Replies being written are saved; open terminals are cut off.">
|
||||
<button class="btn btn--primary" type="submit" {{ 'disabled' if state.up_to_date }}>
|
||||
{{ icon("sparkle", "icon--sm") }}
|
||||
{{ "Nothing to apply" if state.up_to_date else "Update and restart" }}
|
||||
</button>
|
||||
</form>
|
||||
<p class="field__hint">
|
||||
Every restart ends every open terminal session — a command still running on
|
||||
the far side is cut off. A reply being written is saved with whatever it has.
|
||||
</p>
|
||||
|
||||
{% else %}
|
||||
<div class="alert">
|
||||
{{ icon("shield", "icon--sm") }}
|
||||
<span>
|
||||
The update helper is <strong>not installed on this host</strong>, so there
|
||||
is no button. That is the honest default: the service runs as an
|
||||
unprivileged account and cannot restart itself, and a web application that
|
||||
<em>can</em> is one whose worst day is much worse. Run this instead:
|
||||
<code>{{ command }}</code>
|
||||
</span>
|
||||
</div>
|
||||
<p class="field__hint">
|
||||
To install it, re-run the installer with
|
||||
<code>INSTALL_UPDATE_HELPER=1</code>. Doing so means anybody who can
|
||||
administer this web interface can deploy whatever is on
|
||||
<code>{{ state.branch }}</code> — which is the point, and worth deciding on
|
||||
purpose rather than arriving at.
|
||||
</p>
|
||||
{% endif %}
|
||||
</section>
|
||||
{% endif %}
|
||||
{% endblock %}
|
||||
|
||||
Reference in New Issue
Block a user