Show commit builds and mandate automatic node updates

Hop-State: A_06FP97T67MMQBS4JYJVZ710
Hop-Proposal: R_06FP97R88JYXTBZTNVXV08G
Hop-Task: T_06FP95PNKD7PXAMPWPRWSD8
Hop-Attempt: AT_06FP95PNKE2R52XYNMKVRWG

deploy/install.sh

@@ -59,8 +59,12 @@ runuser -u synapsis -- npm --prefix "$APP_DIR" run db:migrate
 runuser -u synapsis -- npm --prefix "$APP_DIR" run build
 
 install -m 0644 "$APP_DIR/deploy/synapsis.service" /etc/systemd/system/synapsis.service
+install -m 0644 "$APP_DIR/deploy/synapsis-update.service" /etc/systemd/system/synapsis-update.service
+install -m 0644 "$APP_DIR/deploy/synapsis-update.timer" /etc/systemd/system/synapsis-update.timer
+runuser -u synapsis -- git -C "$APP_DIR" rev-parse HEAD | install -m 0644 -o synapsis -g synapsis /dev/stdin "$DATA_DIR/deployed-commit"
 systemctl daemon-reload
 systemctl enable --now synapsis
+systemctl enable --now synapsis-update.timer
 
 echo "Synapsis is listening on http://127.0.0.1:${PORT}"
 echo "Edit $ENV_FILE, run $APP_DIR/deploy/update.sh, then configure your own reverse proxy."

deploy/synapsis-update.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Update Synapsis to the latest main commit
+After=network-online.target
+Wants=network-online.target
+ConditionPathExists=/opt/synapsis/.git
+
+[Service]
+Type=oneshot
+ExecStart=/opt/synapsis/deploy/update.sh
+TimeoutStartSec=30min
+UMask=0027

deploy/synapsis-update.timer

@@ -0,0 +1,13 @@
+[Unit]
+Description=Keep Synapsis on the latest main commit
+
+[Timer]
+OnBootSec=1min
+OnUnitInactiveSec=1min
+RandomizedDelaySec=15s
+AccuracySec=5s
+Persistent=true
+Unit=synapsis-update.service
+
+[Install]
+WantedBy=timers.target

deploy/uninstall.sh

@@ -10,8 +10,12 @@ if [[ ${EUID} -ne 0 ]]; then
   exit 1
 fi
 
+systemctl disable --now synapsis-update.timer 2>/dev/null || true
+systemctl stop synapsis-update.service 2>/dev/null || true
 systemctl disable --now synapsis 2>/dev/null || true
-rm -f /etc/systemd/system/synapsis.service
+rm -f /etc/systemd/system/synapsis.service \
+  /etc/systemd/system/synapsis-update.service \
+  /etc/systemd/system/synapsis-update.timer
 systemctl daemon-reload
 rm -rf "$APP_DIR"
 

deploy/update.sh

@@ -4,6 +4,8 @@ set -euo pipefail
 APP_DIR="${APP_DIR:-/opt/synapsis}"
 DATA_DIR="${DATA_DIR:-/var/lib/synapsis}"
 ENV_FILE="${ENV_FILE:-/etc/synapsis.env}"
+BRANCH="${BRANCH:-main}"
+DEPLOYED_COMMIT_FILE="$DATA_DIR/deployed-commit"
 
 if [[ ${EUID} -ne 0 ]]; then
   echo "Run this updater as root." >&2
@@ -17,27 +19,83 @@ set -a
 source "$ENV_FILE"
 set +a
 
+install_update_units() {
+  units_changed=0
+  for unit in synapsis.service synapsis-update.service synapsis-update.timer; do
+    if ! cmp -s "$APP_DIR/deploy/$unit" "/etc/systemd/system/$unit"; then
+      install -m 0644 "$APP_DIR/deploy/$unit" "/etc/systemd/system/$unit"
+      units_changed=1
+    fi
+  done
+
+  if [[ "$units_changed" == "1" ]]; then
+    systemctl daemon-reload
+  fi
+  if ! systemctl is-enabled --quiet synapsis-update.timer; then
+    systemctl enable synapsis-update.timer
+  fi
+  if ! systemctl is-active --quiet synapsis-update.timer; then
+    systemctl start synapsis-update.timer
+  fi
+}
+
+if [[ "${SYNAPSIS_APPLY_UPDATE:-0}" != "1" ]]; then
+  runuser -u synapsis -- git -C "$APP_DIR" fetch --prune origin "+refs/heads/$BRANCH:refs/remotes/origin/$BRANCH"
+
+  current_commit="$(runuser -u synapsis -- git -C "$APP_DIR" rev-parse HEAD)"
+  target_commit="$(runuser -u synapsis -- git -C "$APP_DIR" rev-parse "origin/$BRANCH")"
+  deployed_commit=""
+  if [[ -f "$DEPLOYED_COMMIT_FILE" ]]; then
+    deployed_commit="$(tr -d '[:space:]' < "$DEPLOYED_COMMIT_FILE")"
+  fi
+
+  if [[ -n "$deployed_commit" && "$deployed_commit" == "$target_commit" ]]; then
+    install_update_units
+    echo "Synapsis is already current at ${target_commit:0:7}."
+    exit 0
+  fi
+
+  if [[ "$current_commit" != "$target_commit" ]]; then
+    if ! runuser -u synapsis -- git -C "$APP_DIR" merge-base --is-ancestor "$current_commit" "$target_commit"; then
+      echo "Cannot auto-update: local checkout has diverged from origin/$BRANCH." >&2
+      exit 1
+    fi
+    runuser -u synapsis -- git -C "$APP_DIR" merge --ff-only "origin/$BRANCH"
+  fi
+
+  exec env SYNAPSIS_APPLY_UPDATE=1 APP_DIR="$APP_DIR" DATA_DIR="$DATA_DIR" ENV_FILE="$ENV_FILE" BRANCH="$BRANCH" bash "$APP_DIR/deploy/update.sh"
+fi
+
 systemctl stop synapsis
 trap 'systemctl start synapsis' EXIT
 
 if [[ -f "${DATABASE_PATH:-$DATA_DIR/synapsis.db}" ]]; then
   database_file="${DATABASE_PATH:-$DATA_DIR/synapsis.db}"
-  backup_dir="$DATA_DIR/backups/$(date -u +%Y%m%dT%H%M%SZ)"
-  install -d -o synapsis -g synapsis -m 0750 "$backup_dir"
-  cp "$database_file" "$backup_dir/synapsis.db"
+  backup_root="$DATA_DIR/backups"
+  backup_staging="$backup_root/.latest.$$"
+  backup_dir="$backup_root/latest"
+  install -d -o synapsis -g synapsis -m 0750 "$backup_root"
+  rm -rf "$backup_staging"
+  install -d -o synapsis -g synapsis -m 0750 "$backup_staging"
+  cp "$database_file" "$backup_staging/synapsis.db"
   for suffix in -wal -shm; do
     if [[ -f "${database_file}${suffix}" ]]; then
-      cp "${database_file}${suffix}" "$backup_dir/synapsis.db${suffix}"
+      cp "${database_file}${suffix}" "$backup_staging/synapsis.db${suffix}"
     fi
   done
-  chown -R synapsis:synapsis "$backup_dir"
+  chown -R synapsis:synapsis "$backup_staging"
+  rm -rf "$backup_dir"
+  mv "$backup_staging" "$backup_dir"
+  find "$backup_root" -mindepth 1 -maxdepth 1 ! -name latest -exec rm -rf {} +
 fi
 
-runuser -u synapsis -- git -C "$APP_DIR" pull --ff-only
 runuser -u synapsis -- npm --prefix "$APP_DIR" ci
 runuser -u synapsis -- npm --prefix "$APP_DIR" run db:migrate
 runuser -u synapsis -- npm --prefix "$APP_DIR" run build
 
+deployed_commit="$(runuser -u synapsis -- git -C "$APP_DIR" rev-parse HEAD)"
+printf '%s\n' "$deployed_commit" | install -m 0644 -o synapsis -g synapsis /dev/stdin "$DEPLOYED_COMMIT_FILE"
+install_update_units
 systemctl start synapsis
 trap - EXIT
-echo "Synapsis updated successfully."
+echo "Synapsis updated successfully to ${deployed_commit:0:7}."