From c5019f38b62dd92c4c1f544ad9809625bafd1fc6 Mon Sep 17 00:00:00 2001 From: Veillax <126523099+Veillax@users.noreply.github.com> Date: Mon, 26 Oct 2026 14:00:36 -0600 Subject: [PATCH] Add opt-in auto-update from Gitea releases The program now lives in /usr/local/lib/blacktip and is owned by its service user so it can replace itself. Co-Authored-By: Claude Sonnet 5.5 --- .env.example | 4 ++++ README.md | 4 ++++ cmd/blacktip/main.go | 5 +++++ deploy/blacktip.service | 4 ++-- deploy/install.sh | 16 ++++++++++------ go.mod | 2 +- go.sum | 2 ++ 7 files changed, 28 insertions(+), 9 deletions(-) diff --git a/.env.example b/.env.example index eca8956..3dea8dc 100644 --- a/.env.example +++ b/.env.example @@ -18,3 +18,7 @@ BLACKTIP_TOKEN= #BLACKTIP_TRAEFIK=/usr/local/lib/blacktip/traefik #BLACKTIP_ACME_DNS=cloudflare #CF_DNS_API_TOKEN= + +# Check for new releases every few hours and update and restart by itself (Linux and macOS). +# setup.sh turns this on; remove it to update by hand. +#BLACKTIP_AUTO_UPDATE=1 diff --git a/README.md b/README.md index 808d3e1..85dae98 100644 --- a/README.md +++ b/README.md @@ -54,6 +54,10 @@ sudo systemctl start blacktip Use `linux_arm64` or `linux_arm` for Raspberry Pi and other ARM machines. To upgrade, repeat the same steps: your settings and data are kept. `sudo ./install.sh --uninstall` removes the service and binary but leaves `/etc/blacktip` and `/var/lib/blacktip` alone. `blacktip -version` tells you which build is running. +**Updates** + +Set `BLACKTIP_AUTO_UPDATE=1` (or pass `-auto-update`) and Blacktip checks this server for a newer release every few hours, verifies it against `SHA256SUMS`, checks that the new binary runs, swaps it in and restarts itself. It only follows full releases (never pre-releases), never downgrades, and keeps the old binary if anything looks wrong. `setup.sh` turns it on. It is not available on Windows, and it is for the systemd and plain-binary installs: with Docker, pull a new image instead. + **With Docker** ``` diff --git a/cmd/blacktip/main.go b/cmd/blacktip/main.go index 8cbeafe..34859b2 100644 --- a/cmd/blacktip/main.go +++ b/cmd/blacktip/main.go @@ -11,6 +11,7 @@ import ( "git.veillax.com/Veillax/blacktip" "git.veillax.com/Veillax/reef/dotenv" + "git.veillax.com/Veillax/reef/selfupdate" ) // version is set at build time (deploy/build.sh). @@ -38,6 +39,7 @@ func main() { acmeDNS := flag.String("acme-dns", os.Getenv("BLACKTIP_ACME_DNS"), "with -traefik: DNS-challenge provider (e.g. cloudflare) for wildcard certificates; its credentials go in this process's environment") noACME := flag.Bool("no-acme", false, "with -traefik: serve Traefik's self-signed certificate instead of requesting Let's Encrypt ones") flag.String("env", ".env", "file to read secrets and settings from") + autoUpdate := flag.Bool("auto-update", os.Getenv("BLACKTIP_AUTO_UPDATE") == "1", "check for new releases every few hours and update and restart by itself (Linux and macOS)") showVersion := flag.Bool("version", false, "print the version and exit") flag.Parse() if *showVersion { @@ -58,6 +60,9 @@ func main() { log.Printf("blacktip %s starting", version) ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt) defer stop() + if *autoUpdate { + go selfupdate.Run(ctx, selfupdate.Config{Server: "https://git.veillax.com", Repo: "Veillax/blacktip", App: "blacktip", Current: version, Logf: log.Printf}) + } if err := b.Run(ctx); err != nil { log.Fatal(err) } diff --git a/deploy/blacktip.service b/deploy/blacktip.service index 99a375b..d05f0dd 100644 --- a/deploy/blacktip.service +++ b/deploy/blacktip.service @@ -10,7 +10,7 @@ Group=blacktip # The Traefik that ships with Blacktip; set BLACKTIP_TRAEFIK= (empty) in the env file for the built-in proxy. Environment=BLACKTIP_TRAEFIK=/usr/local/lib/blacktip/traefik EnvironmentFile=-/etc/blacktip/blacktip.env -ExecStart=/usr/local/bin/blacktip -data /var/lib/blacktip +ExecStart=/usr/local/lib/blacktip/blacktip -data /var/lib/blacktip WorkingDirectory=/var/lib/blacktip Restart=on-failure RestartSec=3 @@ -22,7 +22,7 @@ AmbientCapabilities=CAP_NET_BIND_SERVICE CapabilityBoundingSet=CAP_NET_BIND_SERVICE NoNewPrivileges=true ProtectSystem=strict -ReadWritePaths=/var/lib/blacktip +ReadWritePaths=/var/lib/blacktip /usr/local/lib/blacktip ProtectHome=true PrivateTmp=true ProtectKernelTunables=true diff --git a/deploy/install.sh b/deploy/install.sh index 8908333..73a08ae 100644 --- a/deploy/install.sh +++ b/deploy/install.sh @@ -5,7 +5,7 @@ # sudo ./install.sh --start the same, then start (or restart) the service # sudo ./install.sh --uninstall remove the service and binary (keeps the settings and data) # -# Files: /usr/local/bin/blacktip, /etc/systemd/system/blacktip.service, +# Files: /usr/local/lib/blacktip/blacktip (linked from /usr/local/bin/blacktip), /etc/systemd/system/blacktip.service, # /etc/blacktip/blacktip.env (your settings and secrets), /var/lib/blacktip (data). # Set DESTDIR=/some/dir to stage everything there without touching the system. set -eu @@ -17,6 +17,7 @@ UNIT=$ROOT/etc/systemd/system/$NAME.service CONF=$ROOT/etc/$NAME ENVFILE=$CONF/$NAME.env DATA=$ROOT/var/lib/$NAME +LIB=$ROOT/usr/local/lib/$NAME # the program lives here, owned by the service, so auto-update can replace it say() { printf '%s\n' "$*"; } real() { [ -z "${DESTDIR:-}" ]; } # are we touching the real system? @@ -30,7 +31,7 @@ if [ "${1:-}" = "--uninstall" ]; then if real; then systemctl disable --now "$NAME" > /dev/null 2>&1 || true fi - rm -f "$UNIT" "$BIN" "$ROOT/usr/local/lib/$NAME/traefik" + rm -f "$UNIT" "$BIN" "$LIB/$NAME" "$ROOT/usr/local/lib/$NAME/traefik" if real; then systemctl daemon-reload || true fi @@ -46,8 +47,11 @@ if real && ! id "$NAME" > /dev/null 2>&1; then fi mkdir -p "$ROOT/usr/local/lib/$NAME" "$ROOT/usr/local/bin" "$ROOT/etc/systemd/system" "$CONF" "$DATA" -install -m 0755 "$HERE/$NAME" "$BIN.new" -mv -f "$BIN.new" "$BIN" # atomic, so upgrading a running service is safe +mkdir -p "$LIB" +install -m 0755 "$HERE/$NAME" "$LIB/$NAME.new" +mv -f "$LIB/$NAME.new" "$LIB/$NAME" # atomic, so upgrading a running service is safe +rm -f "$BIN" +ln -s "/usr/local/lib/$NAME/$NAME" "$BIN" if [ -f "$HERE/traefik" ]; then install -m 0755 "$HERE/traefik" "$ROOT/usr/local/lib/$NAME/traefik.new" mv -f "$ROOT/usr/local/lib/$NAME/traefik.new" "$ROOT/usr/local/lib/$NAME/traefik" @@ -58,7 +62,7 @@ if [ ! -f "$ENVFILE" ]; then say "Created $ENVFILE. Edit it before starting." fi if real; then - chown -R "$NAME:$NAME" "$DATA" + chown -R "$NAME:$NAME" "$DATA" "$LIB" fi if real; then @@ -70,7 +74,7 @@ if real; then fi fi -say "Installed $("$BIN" -version 2> /dev/null || echo "$NAME")." +say "Installed $("$LIB/$NAME" -version 2> /dev/null || echo "$NAME")." say "Next:" say " 1. edit $ENVFILE" say " 2. systemctl start $NAME (or run this again with --start)" diff --git a/go.mod b/go.mod index 6c9ddcb..c2d9851 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module git.veillax.com/Veillax/blacktip go 1.27.3 require ( - git.veillax.com/Veillax/reef v0.1.0 + git.veillax.com/Veillax/reef v0.1.3 github.com/emersion/go-msgauth v0.7.0 golang.org/x/crypto v0.58.0 ) diff --git a/go.sum b/go.sum index d78a590..f233d8f 100644 --- a/go.sum +++ b/go.sum @@ -1,5 +1,7 @@ git.veillax.com/Veillax/reef v0.1.0 h1:O0OhEKFx2CsvACJ20sfzJNjGsngomtfDdKdxu4ROpCs= git.veillax.com/Veillax/reef v0.1.0/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso= +git.veillax.com/Veillax/reef v0.1.3 h1:RxSq2xwaup1+MieAkhlvOTZnYwPf19thFHEAe/7VxsI= +git.veillax.com/Veillax/reef v0.1.3/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso= github.com/Microsoft/go-winio v0.6.4 h1:kJF2pamtYCWXf0xAT8sAkwKC0pMl2HYBrRPHAqyUc+g= github.com/Microsoft/go-winio v0.6.4/go.mod h1:1xl5JXG4ze/m74GH6Dc4Mwxfc3VL5siRVQjIAlHH07U= github.com/emersion/go-msgauth v0.7.0 h1:vj2hMn6KhFtW41kshIBTXvp6KgYSqpA/ZN9Pv4g1INc=