Deploy a new build with verification and automatic rollback (#249)

kami/Maven

internal/update applies a new build of Maven to the box she runs on and
undoes it when the new build does not come up. cmd/mavupdate is the only
trigger: a CLI the owner runs on the host.

Apply is health-check the running daemon, snapshot the deployed artifacts,
make build, make test, install, restart, health-check — and restore the
snapshot on any failure. The order is load-bearing:

  - The preflight health check refuses to update a daemon that is already
    not answering. Without a working baseline, a failed update and a box
    that was already broken are indistinguishable, and the rollback has
    nothing to prove itself against.
  - The snapshot is taken BEFORE the build, because make build writes its
    binaries into the working tree and on the docker deployment the tree
    is the install dir — snapshotting afterwards would snapshot the new
    artifacts and leave nothing to roll back to.
  - Verification is make build plus make test, before anything is
    deployed, so a broken tree costs time and nothing else. A failed
    verify also puts the tree's artifacts back, so a later restart by
    hand cannot deploy code that failed its own tests.
  - The rollback depends on nothing that just changed: byte-for-byte
    copies out of the snapshot dir, sha256-verified on the way in, and
    the same restart command. No build, no migration, no cooperation from
    the code being replaced. It also runs on an uncancellable context —
    a rollback interrupted halfway is worse than the failure that caused
    it. When the restore itself fails it says so and names the directory
    to copy back by hand rather than reporting a tidy rollback.

Off unless configured, and the refusals are code, not documentation. The
daemon does not import this package: there is no IPC method, no web route,
no timer and no act that can start an update, so nothing Maven says or
routes reaches it. Nothing fetches code — the new version is whatever the
owner pulled into the tree. The plan's release checker, auto-update
channel and in-process crash-loop supervisor are deliberately absent; a
process cannot reliably notice that it keeps dying, and restart-on-crash
belongs to compose or systemd. The database is never snapshotted or rolled
back; schema compatibility stays store.Migrate's job.

The config is refused at load without a health socket, since an update
that cannot check its own result cannot roll back, and refused when the
snapshot dir is inside the install dir, since a restore must not read from
what the install writes.

Vikunja #249

This commit is contained in:

kami

2026-08-01 04:09:30 +04:00

parent ad074cea31

commit be066a4b04

12 changed files with 1626 additions and 1 deletions

									
										Makefile
									
		+7
		-1
	
												View File
												
				@@ -20,7 +20,7 @@ PIPER_ESPEAK  := $(shell pwd)/deps/piper/espeak-ng-data

				all: build

				build: build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav build-mail

				build: build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav build-mail build-update

				build-stt:

					CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \

				@@ -53,6 +53,12 @@ build-caldav:

				build-mail:

					$(GO) build $(GOFLAGS) -o mavmaild ./cmd/mavmaild/

				# mavupdate is an operator CLI, not a daemon: nothing runs it but a human on the

				# box. It is built with the rest so a broken update path is caught by `make

				# build` rather than the first time it is needed.

				build-update:

					$(GO) build $(GOFLAGS) -o mavupdate ./cmd/mavupdate/

				run-web: build-web

					./mavweb -addr :9200 -voice 127.0.0.1:9100