Jaroslav Beneš
fe25f596da
update.sh pulls the code and restarts, and says nothing about the unit -- so a host can run a new release under the old confinement and fail in a way that points nowhere. Dropping ProtectKernelTunables is exactly such a change: without it applied, an agent chat cannot start a sandbox at all. It compares the *template* against the one last applied here rather than against the installed file. An installed unit grows host-specific lines -- an ordering dependency on whatever serves the models, a note about how the prefix is mounted -- and diffing the files would warn about those forever. A warning that always fires is one nobody reads. Reinstalling automatically would clobber those same lines, so it only says so and leaves the merge to a person. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
88 lines
3.4 KiB
Bash
Executable File
88 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Pull the latest LLeMbas into the deployment and restart the service.
|
|
#
|
|
# Run this after pushing. It fetches, hard-resets the deployment checkout to the
|
|
# remote branch, reinstalls dependencies if they changed, and restarts. Nothing
|
|
# is ever edited in place under the deployment prefix, so a hard reset is safe
|
|
# and avoids merge conflicts from a dirty tree.
|
|
set -euo pipefail
|
|
|
|
SERVICE_USER="${SERVICE_USER:-lembas}"
|
|
PREFIX="${PREFIX:-/srv/lembas}"
|
|
BRANCH="${LEMBAS_BRANCH:-main}"
|
|
|
|
APP="$PREFIX/app"
|
|
VENV="$PREFIX/venv"
|
|
|
|
if [[ ! -d "$APP/.git" ]]; then
|
|
echo "No deployment at $APP. Run deploy/install.sh first." >&2
|
|
exit 1
|
|
fi
|
|
|
|
git_as() { sudo -u "$SERVICE_USER" git -C "$APP" "$@"; }
|
|
|
|
before=$(git_as rev-parse HEAD)
|
|
|
|
echo "== fetching =="
|
|
git_as fetch --quiet origin "$BRANCH"
|
|
git_as reset --hard --quiet "origin/$BRANCH"
|
|
|
|
after=$(git_as rev-parse HEAD)
|
|
|
|
if [[ "$before" == "$after" ]]; then
|
|
echo " already at ${after:0:7}, nothing to pull"
|
|
else
|
|
echo " ${before:0:7} -> ${after:0:7}"
|
|
git_as --no-pager log --oneline "$before..$after" | sed 's/^/ /'
|
|
fi
|
|
|
|
# Cheap and idempotent; catches a dependency added since the last deploy.
|
|
# The `search` extra is included because DuckDuckGo is the default web search
|
|
# provider and is meant to need no setup -- a deployment without it offers a
|
|
# provider that fails on every call.
|
|
echo "== dependencies =="
|
|
sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP[search]"
|
|
|
|
# The unit is NOT reinstalled automatically. An installed unit usually carries
|
|
# host-specific lines the template cannot know about -- an ordering dependency
|
|
# on whatever serves the models, a note about how the prefix is mounted -- and
|
|
# overwriting those on every update would be a worse surprise than drifting.
|
|
#
|
|
# So this compares the *template* against the one last applied here, not the
|
|
# template against the installed file. Comparing the files would warn forever
|
|
# about the local lines, and a warning that always fires is one nobody reads.
|
|
#
|
|
# The drift is worth catching: a change in the unit can be what makes a release
|
|
# work at all. Dropping ProtectKernelTunables is why an agent chat can start a
|
|
# sandbox, and a host that pulled the code without it would run the new version
|
|
# under the old confinement and fail confusingly.
|
|
STAMP="$PREFIX/.unit-applied"
|
|
current=$(sha256sum "$APP/deploy/lembas.service" | cut -d' ' -f1)
|
|
if [[ -f "$STAMP" && "$(cat "$STAMP")" != "$current" ]]; then
|
|
echo "== systemd unit ==" >&2
|
|
echo " deploy/lembas.service has changed since it was last applied here." >&2
|
|
echo " Review it and merge by hand, keeping this host's own lines:" >&2
|
|
echo " diff /etc/systemd/system/lembas.service <(sed \\" >&2
|
|
echo " -e 's|__PREFIX__|$PREFIX|g' -e 's|__SERVICE_USER__|$SERVICE_USER|g' \\" >&2
|
|
echo " $APP/deploy/lembas.service)" >&2
|
|
echo " Then: sudo systemctl daemon-reload && sudo systemctl restart lembas" >&2
|
|
echo " And record it as applied: echo $current | sudo tee $STAMP" >&2
|
|
elif [[ ! -f "$STAMP" ]]; then
|
|
# First run after this check was added. Assume what is installed is current;
|
|
# there is nothing to compare against and crying wolf on every host once is
|
|
# not worth it.
|
|
echo "$current" | sudo tee "$STAMP" >/dev/null
|
|
fi
|
|
|
|
echo "== restart =="
|
|
sudo systemctl restart lembas
|
|
sleep 2
|
|
|
|
if systemctl is-active --quiet lembas; then
|
|
echo " lembas is running"
|
|
else
|
|
echo " lembas FAILED to start:" >&2
|
|
sudo journalctl -u lembas -n 30 --no-pager >&2
|
|
exit 1
|
|
fi
|