nexxo a4626d2569 Stop root workers breaking every page, and let the panel be closed ... ── The 500 ───────────────────────────────────────────────────────────────── "touch(): Utime failed: Operation not permitted", from BladeCompiler, on every request for the affected view. Blade compiles a view and then touch()es the compiled file to the source's mtime. touch() with an explicit time needs ownership of the file. A compose service without `user:` runs as ROOT — and queue, scheduler and reverb had none — so the first worker to render a view wrote a root-owned compiled file that the web process, as www-data, could never refresh again. The queue is what renders mails, which is why this surfaced now. queue, reverb and scheduler run as www-data. queue-provisioning stays root and says why: it brings wg0 up and runs `wg set` for every peer change, which needs NET_ADMIN on the running process. It renders no mail. And update.sh normalises ownership at the END of a run as well as at the start. The first call heals what a previous run left; the second heals what this one made — `git checkout` rewrites the tree as the service account while the old build is still serving. ── The panel that would not go away ───────────────────────────────────────── The same 500 is why it kept coming back: every poll failed, the watcher treats a failed request as "still restarting" (which it normally is), and the overlay stayed up over a console nobody could then reach to find out why. A restart is seconds. After two minutes of nothing the panel now says so and offers a way out — for an operator only, behind the same flag as the step and the log, so a customer on the 503 page is not shown a button suggesting they can call the deployment off. A successful answer clears it again: one bad minute must not leave a "something is wrong" notice sitting there for the rest of the run. Not an always-present close button. The deployment does not stop because somebody dismissed a panel, and offering that at the wrong moment is a lie. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-07-29 15:43:54 +02:00
..
caddy	Make the private hostnames look like nothing is there, and close the way past the proxy	2026-07-27 11:26:48 +02:00
lib	Stop the update agent dying on its own tag arithmetic	2026-07-29 00:00:17 +02:00
clupilot.env.example	Show times on the operator's clock, keep storing them in UTC	2026-07-27 17:32:21 +02:00
install-agent.sh	Let an update install host packages, without handing out root	2026-07-29 10:27:56 +02:00
install.sh	Deploy as the application's user, and take back what root already took	2026-07-28 22:52:09 +02:00
update-agent.sh	Mint the archive collection key from the console instead of by hand	2026-07-29 10:08:32 +02:00
update.sh	Stop root workers breaking every page, and let the panel be closed	2026-07-29 15:43:54 +02:00