DebTik/scripts/debtik-update

#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
if [[ -d /opt/debtik/go/bin ]]; then export PATH=/opt/debtik/go/bin:$PATH; fi
# Transient systemd units may omit HOME; Go needs explicit cache locations.
export HOME=${HOME:-/root}
export GOPATH=${GOPATH:-/var/cache/debtik/go}
export GOCACHE=${GOCACHE:-/var/cache/debtik/go-build}
mkdir -p "$GOPATH" "$GOCACHE"
base=/var/lib/debtik/update
mkdir -p "$base"
exec 9>"$base/lock"
flock -n 9 || { echo 'An update is already running' >&2; exit 1; }
exec >>"$base/update.log" 2>&1
state() { printf '%s\n' "$1" >"$base/status"; printf '[%s] %s\n' "$(date -u +%FT%TZ)" "$1"; }
cleanup_veth() {
  python3 - <<'PY'
import json,subprocess,pathlib
p=pathlib.Path('/etc/debtik/vpn/aerotun_instances.json')
if p.exists():
 for tunnel in json.loads(p.read_text()):
  name=tunnel['name']
  result=subprocess.run(['ip','-j','-d','link','show','dev',name],capture_output=True,text=True)
  if result.returncode:
   continue
  links=json.loads(result.stdout)
  if len(links)!=1:raise RuntimeError('Ambiguous AeroTUN interface')
  link=links[0]
  if link.get('linkinfo',{}).get('info_kind')=='veth':
   if link.get('link')!=name+'_ep':raise RuntimeError('Unexpected veth peer')
   subprocess.run(['ip','link','delete',name],check=True)
PY
}
restore() {
  state rolling_back
  systemctl stop debtik.service || systemctl stop proxmox-router.service || true
  cleanup_veth || true
  for name in debtik debtik-cli; do
    test -f "$base/previous/$name"
    cp -p "$base/previous/$name" "/usr/local/bin/$name.rollback"
    mv -f "/usr/local/bin/$name.rollback" "/usr/local/bin/$name"
  done
  ln -sf /usr/local/bin/debtik /usr/local/bin/proxmox-router
  for name in debtik-update debtik-release-version debtik-install-dependencies; do
    if [[ -f "$base/previous/$name" ]]; then install -m 0750 "$base/previous/$name" "/usr/local/libexec/$name.rollback"; mv -f "/usr/local/libexec/$name.rollback" "/usr/local/libexec/$name"; fi
  done
  if [[ -f "$base/previous_commit" ]]; then cp -p "$base/previous_commit" "$base/installed_commit"; fi
  if [[ -f "$base/previous_version" ]]; then cp -p "$base/previous_version" "$base/installed_version"; fi
  if [[ -f "$base/previous/go.mod" ]]; then cp -p "$base/previous/go.mod" "$base/go.mod"; fi
  if [[ -f "$base/previous/debtik.service" ]]; then
    install -m 0644 "$base/previous/debtik.service" /etc/systemd/system/debtik.service
    systemctl daemon-reload
  fi
  systemctl start debtik.service
  systemctl is-active --quiet debtik.service
  if [[ -f "$base/previous/iptables.save" ]]; then iptables-restore -c < "$base/previous/iptables.save"; fi
  if [[ -s "$base/previous/ip6tables.save" ]]; then ip6tables-restore -c < "$base/previous/ip6tables.save"; fi
  state rolled_back
}
if [[ ${1:-} == rollback ]]; then restore; exit; fi
[[ $# == 4 && $1 == install ]] || { echo 'Usage: debtik-update install URL BRANCH | rollback' >&2; exit 2; }
repo=$2 branch=$3 pin=$4
git_opts=()
if [[ -n $pin ]]; then
  [[ $pin =~ ^sha256//[A-Za-z0-9+/]{43}=$ ]] || exit 2
  git_opts=(-c http.sslVerify=false -c "http.pinnedpubkey=$pin")
fi
[[ $repo == http://* || $repo == https://* || $repo == ssh://* ]] || exit 2
[[ $branch =~ ^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$ && $branch != *..* ]] || exit 2
work=$(mktemp -d "$base/work.XXXXXXXX")
trap 'rm -rf "$work"' EXIT
trap 'state failed' ERR
state fetching
version_tool=/usr/local/libexec/debtik-release-version
version=$(GIT_TERMINAL_PROMPT=0 git "${git_opts[@]}" ls-remote --tags "$repo" 'refs/tags/v*' | "$version_tool" latest)
installed_version=$(cat "$base/installed_version")
if ! "$version_tool" greater "$version" "$installed_version"; then
  state failed
  echo "Update refused: available version $version must be greater than installed version $installed_version"
  exit 1
fi
GIT_TERMINAL_PROMPT=0 git -c protocol.file.allow=never "${git_opts[@]}" clone --single-branch --branch "v$version" -- "$repo" "$work/source"
cd "$work/source"
commit=$(git rev-parse HEAD)
[[ $(cat VERSION) == "$version" ]] || { state failed; echo 'Release tag and VERSION do not match'; exit 1; }
bash -n scripts/debtik-update
bash -n scripts/install-dependencies.sh
bash -n install.sh
python3 -c 'import pathlib; compile(pathlib.Path("scripts/release-version.py").read_text(),"release-version.py","exec")'
state dependencies
bash scripts/install-dependencies.sh
state building
go_cmd=$(command -v go || true)
if [[ -x /opt/debtik/go/bin/go ]]; then go_cmd=/opt/debtik/go/bin/go; fi
[[ -n $go_cmd ]] || { state failed; echo 'Go is not installed'; exit 1; }
CGO_ENABLED=0 "$go_cmd" build -trimpath -ldflags "-X debtik/internal/api.BuildCommit=$commit" -o "$work/debtik" ./cmd/server
CGO_ENABLED=0 "$go_cmd" build -trimpath -o "$work/debtik-cli" ./cmd/debtik-cli
install -d -m 0700 "$base/previous"
rm -f "$base/previous/debtik.service"
if [[ -f /etc/systemd/system/debtik.service ]]; then cp -p /etc/systemd/system/debtik.service "$base/previous/debtik.service"; fi
for name in debtik debtik-cli; do cp -p "/usr/local/bin/$name" "$base/previous/$name"; done
for name in debtik-update debtik-release-version debtik-install-dependencies debtik-ifnames; do
  if [[ -f "/usr/local/libexec/$name" ]]; then cp -p "/usr/local/libexec/$name" "$base/previous/$name"; fi
done
cp -p "$base/installed_version" "$base/previous_version"
if [[ -f "$base/installed_commit" ]]; then cp -p "$base/installed_commit" "$base/previous_commit"; fi
if [[ -f "$base/go.mod" ]]; then cp -p "$base/go.mod" "$base/previous/go.mod"; fi
install -m 0644 go.mod "$base/go.mod"
printf '%s\n' "$commit" > "$base/candidate_commit"
iptables-save -c > "$base/previous/iptables.save"
ip6tables-save -c > "$base/previous/ip6tables.save"
state installing
rollback_on_error() { trap - ERR; restore || state failed; exit 1; }
trap rollback_on_error ERR
if systemctl is-active --quiet proxmox-router.service; then
  systemctl stop proxmox-router.service || true
  systemctl disable proxmox-router.service || true
fi
systemctl stop debtik.service || true
cleanup_veth
for name in debtik debtik-cli; do
  install -m 0755 "$work/$name" "/usr/local/bin/$name.next"
  mv -f "/usr/local/bin/$name.next" "/usr/local/bin/$name"
done
ln -sf /usr/local/bin/debtik /usr/local/bin/proxmox-router
install -m 0750 scripts/debtik-update /usr/local/libexec/debtik-update.next
install -m 0750 scripts/release-version.py /usr/local/libexec/debtik-release-version.next
install -m 0750 scripts/install-dependencies.sh /usr/local/libexec/debtik-install-dependencies.next
install -m 0755 scripts/debtik-ifnames /usr/local/libexec/debtik-ifnames.next
mv -f /usr/local/libexec/debtik-update.next /usr/local/libexec/debtik-update
mv -f /usr/local/libexec/debtik-release-version.next /usr/local/libexec/debtik-release-version
mv -f /usr/local/libexec/debtik-install-dependencies.next /usr/local/libexec/debtik-install-dependencies
mv -f /usr/local/libexec/debtik-ifnames.next /usr/local/libexec/debtik-ifnames
mkdir -p /etc/network/if-pre-up.d
ln -sf /usr/local/libexec/debtik-ifnames /etc/network/if-pre-up.d/debtik-ifnames
# Migrate legacy /etc/proxmox-router config directory to /etc/debtik
if [[ -d /etc/proxmox-router && ! -L /etc/proxmox-router ]]; then
  install -d -m 0700 /etc/debtik
  cp -a /etc/proxmox-router/* /etc/debtik/ 2>/dev/null || true
  rm -rf /etc/proxmox-router
  ln -s /etc/debtik /etc/proxmox-router
fi
if [[ ! -e /etc/proxmox-router ]]; then
  install -d -m 0700 /etc/debtik
  ln -s /etc/debtik /etc/proxmox-router
fi
if [[ -f systemd/debtik.service ]]; then
  install -m 0644 systemd/debtik.service /etc/systemd/system/debtik.service
  if [[ -f systemd/debtik-ifnames.service ]]; then
    install -m 0644 systemd/debtik-ifnames.service /etc/systemd/system/debtik-ifnames.service
  fi
  if [[ -f /etc/systemd/system/proxmox-router.service.d/mstpd.conf && ! -f /etc/systemd/system/debtik.service.d/mstpd.conf ]]; then
    install -d -m 0755 /etc/systemd/system/debtik.service.d
    cp /etc/systemd/system/proxmox-router.service.d/mstpd.conf /etc/systemd/system/debtik.service.d/mstpd.conf
  fi
  systemctl daemon-reload
  systemctl enable debtik-ifnames.service || true
  systemctl enable debtik.service
fi
systemctl start debtik.service
sleep 3
systemctl is-active --quiet debtik.service
printf '%s\n' "$commit" > "$base/installed_commit"
printf '%s\n' "$version" > "$base/installed_version"
state complete