29 lines
1.3 KiB
INI
29 lines
1.3 KiB
INI
# Clusev update-sentinel — service unit (HOST-side).
|
|
#
|
|
# Triggered by clusev-update.path. Runs watch.sh update: consumes the sentinel, then runs
|
|
# update.sh (git pull --ff-only + the idempotent install.sh). A oneshot — it exits when done
|
|
# and the .path unit re-arms for the next request.
|
|
#
|
|
# SECURITY: like the restart unit, this is host-side; the panel container has NO Docker socket
|
|
# and only writes the sentinel file. This service runs as ROOT (not the `clusev` user the
|
|
# restart unit uses) because update.sh -> install.sh needs root for docker/systemd/apt. It only
|
|
# ever runs the project's own committed update.sh, pulling from the configured (trusted) remote.
|
|
#
|
|
# install.sh rewrites WorkingDirectory= / ExecStart= / Environment=CLUSEV_DIR to the real path.
|
|
[Unit]
|
|
Description=Clusev update sentinel — pull + re-install the stack on request
|
|
After=docker.service
|
|
Requires=docker.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
User=root
|
|
# HOME is needed so update.sh's `git config --global --add safe.directory` lands in root's
|
|
# config and the subsequent root-run `git pull` is allowed on the clusev-owned tree.
|
|
Environment=HOME=/root
|
|
Environment=CLUSEV_DIR=/home/nexxo/clusev
|
|
WorkingDirectory=/home/nexxo/clusev
|
|
ExecStart=/home/nexxo/clusev/docker/restart-sentinel/watch.sh update
|
|
# A full update (pull + image rebuild + migrate) takes longer than a restart.
|
|
TimeoutStartSec=900
|