CluPilotCloud/app
Claude 276f926d57
tests / pest (push) Successful in 7m41s Details
tests / assets (push) Successful in 20s Details
tests / release (push) Successful in 4s Details
Add the update button, and give it a host-side agent that can actually update
The panel had no way to update the installation, and could not have one on its
own: it runs as www-data inside a container, and the update restarts that
container. A button that shelled out would kill its own web server
mid-response, and would need the application to hold host-level credentials —
a far worse thing to own than an out-of-date checkout.

So the button is a mailbox. The panel writes a request into the checkout; a
systemd timer on the host, running as the service account, consumes it, runs
deploy/update.sh and writes back what happened. The same timer answers the
question the panel cannot answer alone — is there anything to update — which
needs a git fetch, and therefore credentials the application does not have.

The parts that were wrong before review, all of which would have shipped as a
button that looks fine and does nothing:

- The agent was only installed by install.sh, which the installed base never
  runs again. Every existing server would have shown the button permanently
  disabled. It has its own root entry point now, install.sh delegates to it,
  and update.sh says so when the unit is missing.
- On a release-pinned server the checkout is detached, so it followed
  "origin/HEAD" and then ran an update that deliberately stays on the pinned
  tag: updates advertised, nothing applied. It now compares TAGS in release
  mode and passes the target release through.
- On a branch other than main it advertised that branch's commits and then
  deployed main's, because update.sh defaults to main.
- A request written while the agent was down was executed whenever the agent
  next started, days later.
- A single status file meant the routine five-minute check overwrote a failed
  update with "idle" before anyone saw it.
- An agent that had been stopped left the button enabled forever, because a
  status file written once counted as an agent.
- The agent's error messages were German strings rendered into an English
  interface; it reports codes now and the panel translates them.

Also: the add-address button in the console-access panel was as tall as the
field plus its hint, because the hint was a sibling inside the flex row.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-27 05:33:17 +02:00
..
Actions fix(billing): hold only what cannot be matched, and let migrations roll back 2026-07-26 13:57:11 +02:00
Console feat(security): a way back into the console that does not need the console 2026-07-27 03:09:13 +02:00
Http Give the three console guards one answer to "is this the console?" 2026-07-27 04:52:21 +02:00
Livewire Add the update button, and give it a host-side agent that can actually update 2026-07-27 05:33:17 +02:00
Mail fix(admin): confirm maintenance delivery via MessageSent (retryable until sent); guard resend/cancel on derived state; fix flaky non-unique host wg_ip 2026-07-25 16:14:01 +02:00
Models Report the estate from the database, and print the traffic that is sold 2026-07-27 04:48:51 +02:00
Notifications fix(engine-b): default-deny firewall, disk-based capacity, synchronous credential mail 2026-07-25 12:39:15 +02:00
Policies fix(vpn): losing the operator roles closes the owner doors by itself 2026-07-25 22:50:13 +02:00
Providers feat(security): the console decides who may reach it, and the owner keeps the list 2026-07-26 20:27:26 +02:00
Provisioning fix(billing): a paid order opens a contract, and provisioning obeys it 2026-07-26 11:10:00 +02:00
Services Add the update button, and give it a host-side agent that can actually update 2026-07-27 05:33:17 +02:00
Support Give the three console guards one answer to "is this the console?" 2026-07-27 04:52:21 +02:00