shcizo
41a619b316
Docker Build / docker (push) Successful in 38s
## Summary
- `POST /update` on the master (outside OIDC, bearer `UPDATER_API_KEY`; unset → 503). Matches `image` against `image_repo` on all agents, marks `available_*` on every match, starts webhook-triggered jobs for `auto` services targeting `<image_repo>:<tag>` (followed tag when no tag is given), and waits for them up to `UPDATE_TIMEOUT` (default 5m). 404 on no match, 500 if any auto job failed or timed out, otherwise 200.
- Manual/auto toggle per service on the overview and service page (`POST /services/{id}/mode`, CSRF); auto is blocked for self, `build:` and container services with the reason shown. "Update available" badge and an "Available" row.
- `FinishJob` clears `available_*` only when the successful job was created for that exact ref, after it was reported. Migration `0003_webhook.sql`, phase-3 plan doc, README / gitea-action README / CLAUDE.md / deploy example updated. `action.yml` unchanged.
Closes #8
## Behaviour changes for CI
- Mixed results now return 500 (the old 207 is gone); no match returns 404 instead of 200.
- With a `tag`, Compose services get pinned to `<image_repo>:<tag>` via `compose.override.yaml`; the tag must be a pushed tag.
- `busy` (job already active) and `refused` (not updatable) are reported but return 200.
- The reverse proxy read timeout must exceed `UPDATE_TIMEOUT`.
## Test plan
- [x] `go test ./...` and `go test -race ./internal/agent/... ./internal/master/... ./internal/e2e/`
- [x] `go test -tags integration ./internal/master/store/` against throwaway Postgres
- [x] UI verified in browser (mode toggle, disabled reason, badge via SSE, Available row)
- [ ] Manual: webhook with manual service → `marked` + badge
- [ ] Manual: webhook with auto service → waits, `succeeded`, badge cleared, override pinned
- [ ] Manual: wrong token 401, unknown image 404, offline agent 500
- [ ] Gitea action pointed at the master's `/update` in a real CI run
Reviewed-on: #22
50 lines
2.0 KiB
YAML
50 lines
2.0 KiB
YAML
# Example Swarm stack for the package-updater master (inventory, updates and the CI webhook).
|
|
# Deploy on the manager: docker stack deploy -c master.stack.yml package-updater-master
|
|
#
|
|
# Before deploying:
|
|
# 1. In Postgres: CREATE USER package_updater ...; CREATE DATABASE package_updater OWNER package_updater;
|
|
# 2. In Authentik: create an OAuth2/OpenID provider + application with redirect URI
|
|
# https://updater.example.com/auth/callback, and a group "updater-admins".
|
|
# 3. docker secret create pu_oidc_client_secret - ; docker secret create pu_database_url -
|
|
# 4. docker secret create pu_updater_api_key - (required by this example; it enables POST /update)
|
|
# To run without the webhook, remove the pu_updater_api_key lines (the UPDATER_API_KEY
|
|
# part of the entrypoint, the service secret and the secrets entry); the endpoint then answers 503.
|
|
# The reverse proxy must allow a read timeout longer than UPDATE_TIMEOUT (default 5m).
|
|
services:
|
|
master:
|
|
image: gitea.shcizo.se/shcizo/package-updater:latest
|
|
entrypoint: ["/bin/sh", "-c", "DATABASE_URL=$$(cat /run/secrets/pu_database_url) OIDC_CLIENT_SECRET=$$(cat /run/secrets/pu_oidc_client_secret) UPDATER_API_KEY=$$(cat /run/secrets/pu_updater_api_key) exec /usr/local/bin/updater-master"]
|
|
environment:
|
|
PUBLIC_URL: https://updater.example.com
|
|
AGENT_URL: wss://10.0.0.5:8090/agent
|
|
OIDC_ISSUER: https://auth.example.com/application/o/package-updater/
|
|
OIDC_CLIENT_ID: package-updater
|
|
ALLOWED_GROUP: updater-admins
|
|
# UPDATE_TIMEOUT: 5m
|
|
secrets:
|
|
- pu_database_url
|
|
- pu_oidc_client_secret
|
|
- pu_updater_api_key
|
|
ports:
|
|
# Agents connect here directly over the internal network, not via the proxy.
|
|
- target: 8090
|
|
published: 8090
|
|
mode: host
|
|
networks:
|
|
- proxy
|
|
deploy:
|
|
placement:
|
|
constraints: [node.role == manager]
|
|
|
|
secrets:
|
|
pu_database_url:
|
|
external: true
|
|
pu_oidc_client_secret:
|
|
external: true
|
|
pu_updater_api_key:
|
|
external: true
|
|
|
|
networks:
|
|
proxy:
|
|
external: true
|