Add opt-in auto-update from Gitea releases

The program now lives in /usr/local/lib/blacktip and is owned by its service user so it can replace itself.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

deploy/blacktip.service

@@ -10,7 +10,7 @@ Group=blacktip
 # The Traefik that ships with Blacktip; set BLACKTIP_TRAEFIK= (empty) in the env file for the built-in proxy.
 Environment=BLACKTIP_TRAEFIK=/usr/local/lib/blacktip/traefik
 EnvironmentFile=-/etc/blacktip/blacktip.env
-ExecStart=/usr/local/bin/blacktip -data /var/lib/blacktip
+ExecStart=/usr/local/lib/blacktip/blacktip -data /var/lib/blacktip
 WorkingDirectory=/var/lib/blacktip
 Restart=on-failure
 RestartSec=3
@@ -22,7 +22,7 @@ AmbientCapabilities=CAP_NET_BIND_SERVICE
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 NoNewPrivileges=true
 ProtectSystem=strict
-ReadWritePaths=/var/lib/blacktip
+ReadWritePaths=/var/lib/blacktip /usr/local/lib/blacktip
 ProtectHome=true
 PrivateTmp=true
 ProtectKernelTunables=true

deploy/install.sh

@@ -5,7 +5,7 @@
 #   sudo ./install.sh --start      the same, then start (or restart) the service
 #   sudo ./install.sh --uninstall  remove the service and binary (keeps the settings and data)
 #
-# Files: /usr/local/bin/blacktip, /etc/systemd/system/blacktip.service,
+# Files: /usr/local/lib/blacktip/blacktip (linked from /usr/local/bin/blacktip), /etc/systemd/system/blacktip.service,
 #        /etc/blacktip/blacktip.env (your settings and secrets), /var/lib/blacktip (data).
 # Set DESTDIR=/some/dir to stage everything there without touching the system.
 set -eu
@@ -17,6 +17,7 @@ UNIT=$ROOT/etc/systemd/system/$NAME.service
 CONF=$ROOT/etc/$NAME
 ENVFILE=$CONF/$NAME.env
 DATA=$ROOT/var/lib/$NAME
+LIB=$ROOT/usr/local/lib/$NAME # the program lives here, owned by the service, so auto-update can replace it
 
 say() { printf '%s\n' "$*"; }
 real() { [ -z "${DESTDIR:-}" ]; } # are we touching the real system?
@@ -30,7 +31,7 @@ if [ "${1:-}" = "--uninstall" ]; then
 	if real; then
 		systemctl disable --now "$NAME" > /dev/null 2>&1 || true
 	fi
-	rm -f "$UNIT" "$BIN" "$ROOT/usr/local/lib/$NAME/traefik"
+	rm -f "$UNIT" "$BIN" "$LIB/$NAME" "$ROOT/usr/local/lib/$NAME/traefik"
 	if real; then
 		systemctl daemon-reload || true
 	fi
@@ -46,8 +47,11 @@ if real && ! id "$NAME" > /dev/null 2>&1; then
 fi
 
 mkdir -p "$ROOT/usr/local/lib/$NAME" "$ROOT/usr/local/bin" "$ROOT/etc/systemd/system" "$CONF" "$DATA"
-install -m 0755 "$HERE/$NAME" "$BIN.new"
-mv -f "$BIN.new" "$BIN" # atomic, so upgrading a running service is safe
+mkdir -p "$LIB"
+install -m 0755 "$HERE/$NAME" "$LIB/$NAME.new"
+mv -f "$LIB/$NAME.new" "$LIB/$NAME" # atomic, so upgrading a running service is safe
+rm -f "$BIN"
+ln -s "/usr/local/lib/$NAME/$NAME" "$BIN"
 if [ -f "$HERE/traefik" ]; then
 	install -m 0755 "$HERE/traefik" "$ROOT/usr/local/lib/$NAME/traefik.new"
 	mv -f "$ROOT/usr/local/lib/$NAME/traefik.new" "$ROOT/usr/local/lib/$NAME/traefik"
@@ -58,7 +62,7 @@ if [ ! -f "$ENVFILE" ]; then
 	say "Created $ENVFILE. Edit it before starting."
 fi
 if real; then
-	chown -R "$NAME:$NAME" "$DATA"
+	chown -R "$NAME:$NAME" "$DATA" "$LIB"
 fi
 
 if real; then
@@ -70,7 +74,7 @@ if real; then
 	fi
 fi
 
-say "Installed $("$BIN" -version 2> /dev/null || echo "$NAME")."
+say "Installed $("$LIB/$NAME" -version 2> /dev/null || echo "$NAME")."
 say "Next:"
 say "  1. edit $ENVFILE"
 say "  2. systemctl start $NAME      (or run this again with --start)"