Retry release uploads that hit a proxy timeout, and replace every existing asset on re-run

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -13,6 +13,12 @@ BLACKTIP_TOKEN=
 # Serve http/https with Traefik (path to a Traefik v3 binary), and optionally
 # use DNS challenge for wildcard certificates. The provider's credentials go here
 # too, named exactly as Traefik documents for that provider.
-#BLACKTIP_TRAEFIK=/usr/local/bin/traefik
+# Releases bundle a tested Traefik: /usr/local/lib/blacktip/traefik (systemd install),
+# /traefik (Docker image, already set; set it empty to use the built-in proxy).
+#BLACKTIP_TRAEFIK=/usr/local/lib/blacktip/traefik
 #BLACKTIP_ACME_DNS=cloudflare
 #CF_DNS_API_TOKEN=
+
+# Check for new releases every few hours and update and restart by itself (Linux and macOS).
+# setup.sh turns this on; remove it to update by hand.
+#BLACKTIP_AUTO_UPDATE=1

Dockerfile

@@ -18,7 +18,9 @@ LABEL org.opencontainers.image.title="Blacktip" \
 COPY --from=prep /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=prep /data /data
 COPY dist/bin/linux_${TARGETARCH}/blacktip /blacktip
-ENV BLACKTIP_DATA=/data
+COPY dist/bin/linux_${TARGETARCH}/traefik /traefik
+# Traefik serves http/https; set BLACKTIP_TRAEFIK= (empty) in .env to use the built-in proxy instead
+ENV BLACKTIP_DATA=/data BLACKTIP_TRAEFIK=/traefik
 VOLUME ["/data"]
 EXPOSE 51820/udp
 ENTRYPOINT ["/blacktip"]

README.md

@@ -21,7 +21,7 @@ Open the WireGuard UDP port (default 51820) and any ports you open from the dash
 | `-tunnel` | `BLACKTIP_TUNNEL` | UDP listen address for WireGuard (default `:51820`) |
 | `-data` | `BLACKTIP_DATA` | folder for the WireGuard key and certificates |
 | `-docker` | `BLACKTIP_DOCKER=1` | report local Docker containers so they can be picked as targets |
-| `-traefik` | `BLACKTIP_TRAEFIK` | path to a Traefik v3 binary, to serve http/https with Traefik |
+| `-traefik` | `BLACKTIP_TRAEFIK` | path to a Traefik v3 binary, to serve http/https with Traefik. Release archives and the Docker image include a tested one |
 | `-acme-dns` | `BLACKTIP_ACME_DNS` | with Traefik: DNS-challenge provider for wildcard certificates |
 | `-no-acme` | | with Traefik: serve its self-signed certificate instead of Let's Encrypt |
 | `-env` | | `.env` file to read (default `./.env`) |
@@ -54,6 +54,10 @@ sudo systemctl start blacktip
 
 Use `linux_arm64` or `linux_arm` for Raspberry Pi and other ARM machines. To upgrade, repeat the same steps: your settings and data are kept. `sudo ./install.sh --uninstall` removes the service and binary but leaves `/etc/blacktip` and `/var/lib/blacktip` alone. `blacktip -version` tells you which build is running.
 
+**Updates**
+
+Set `BLACKTIP_AUTO_UPDATE=1` (or pass `-auto-update`) and Blacktip checks this server for a newer release every few hours, verifies it against `SHA256SUMS`, checks that the new binary runs, swaps it in and restarts itself. It only follows full releases (never pre-releases), never downgrades, and keeps the old binary if anything looks wrong. `setup.sh` turns it on. It is not available on Windows, and it is for the systemd and plain-binary installs: with Docker, pull a new image instead.
+
 **With Docker**
 
 ```

cmd/blacktip/main.go

@@ -11,6 +11,7 @@ import (
 
 	"git.veillax.com/Veillax/blacktip"
 	"git.veillax.com/Veillax/reef/dotenv"
+	"git.veillax.com/Veillax/reef/selfupdate"
 )
 
 // version is set at build time (deploy/build.sh).
@@ -38,6 +39,7 @@ func main() {
 	acmeDNS := flag.String("acme-dns", os.Getenv("BLACKTIP_ACME_DNS"), "with -traefik: DNS-challenge provider (e.g. cloudflare) for wildcard certificates; its credentials go in this process's environment")
 	noACME := flag.Bool("no-acme", false, "with -traefik: serve Traefik's self-signed certificate instead of requesting Let's Encrypt ones")
 	flag.String("env", ".env", "file to read secrets and settings from")
+	autoUpdate := flag.Bool("auto-update", os.Getenv("BLACKTIP_AUTO_UPDATE") == "1", "check for new releases every few hours and update and restart by itself (Linux and macOS)")
 	showVersion := flag.Bool("version", false, "print the version and exit")
 	flag.Parse()
 	if *showVersion {
@@ -58,6 +60,9 @@ func main() {
 	log.Printf("blacktip %s starting", version)
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt)
 	defer stop()
+	if *autoUpdate {
+		go selfupdate.Run(ctx, selfupdate.Config{Server: "https://git.veillax.com", Repo: "Veillax/blacktip", App: "blacktip", Current: version, Logf: log.Printf})
+	}
 	if err := b.Run(ctx); err != nil {
 		log.Fatal(err)
 	}

deploy/blacktip.service

@@ -7,8 +7,10 @@ Wants=network-online.target
 [Service]
 User=blacktip
 Group=blacktip
+# The Traefik that ships with Blacktip; set BLACKTIP_TRAEFIK= (empty) in the env file for the built-in proxy.
+Environment=BLACKTIP_TRAEFIK=/usr/local/lib/blacktip/traefik
 EnvironmentFile=-/etc/blacktip/blacktip.env
-ExecStart=/usr/local/bin/blacktip -data /var/lib/blacktip
+ExecStart=/usr/local/lib/blacktip/blacktip -data /var/lib/blacktip
 WorkingDirectory=/var/lib/blacktip
 Restart=on-failure
 RestartSec=3
@@ -20,7 +22,7 @@ AmbientCapabilities=CAP_NET_BIND_SERVICE
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 NoNewPrivileges=true
 ProtectSystem=strict
-ReadWritePaths=/var/lib/blacktip
+ReadWritePaths=/var/lib/blacktip /usr/local/lib/blacktip
 ProtectHome=true
 PrivateTmp=true
 ProtectKernelTunables=true

deploy/build.sh

@@ -4,7 +4,7 @@
 #   deploy/build.sh [version]      version defaults to `git describe`
 #
 # Output:
-#   dist/bin/<os>_<arch>/blacktip             the raw binaries (the Docker image uses the linux ones)
+#   dist/bin/<os>_<arch>/blacktip and traefik             the raw binaries (the Docker image uses the linux ones)
 #   dist/blacktip_<version>_<os>_<arch>.tar.gz or .zip
 #   dist/SHA256SUMS
 #
@@ -28,10 +28,13 @@ for t in $TARGETS; do
 	CGO_ENABLED=0 GOOS=$os GOARCH=$arch GOARM=7 \
 		go build -trimpath -ldflags "-s -w -X main.version=$VERSION" -o "$out/$NAME$ext" "./cmd/$NAME"
 
+	# the Traefik that Blacktip drives for http/https (see BLACKTIP_TRAEFIK)
+	sh deploy/fetch-traefik.sh "$os" "$arch" "$out"
+
 	pkg="${NAME}_${VERSION}_${os}_${arch}"
 	stage="dist/stage/$pkg"
 	mkdir -p "$stage"
-	cp "$out/$NAME$ext" "$stage/"
+	cp "$out/$NAME$ext" "$out/traefik$ext" "$stage/"
 	for f in LICENSE README.md .env.example; do
 		[ -f "$f" ] && cp "$f" "$stage/"
 	done

deploy/docker-compose.yml

@@ -15,8 +15,6 @@ services:
       - blacktip-data:/data
       # To list this machine's Docker containers as targets (BLACKTIP_DOCKER=1):
       # - /var/run/docker.sock:/var/run/docker.sock:ro
-      # To serve websites with Traefik (BLACKTIP_TRAEFIK=/traefik): mount a Traefik v3 binary
-      # - /usr/local/bin/traefik:/traefik:ro
 
 volumes:
   blacktip-data:

deploy/fetch-traefik.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+# Downloads the official Traefik release for one platform and checks its checksum.
+#
+#   deploy/fetch-traefik.sh <os> <arch> <destination-dir>
+#
+# Blacktip ships this exact Traefik version, which is the one it was tested with.
+# Set TRAEFIK_VERSION to try another.
+set -eu
+OS=${1:?os} ARCH=${2:?arch} DEST=${3:?destination}
+VERSION=${TRAEFIK_VERSION:-3.7.16}
+case "$ARCH" in arm) ARCH=armv7 ;; esac
+EXT=tar.gz
+[ "$OS" = windows ] && EXT=zip
+BASE="https://github.com/traefik/traefik/releases/download/v$VERSION"
+FILE="traefik_v${VERSION}_${OS}_${ARCH}.$EXT"
+CACHE=${TRAEFIK_CACHE:-${TMPDIR:-/tmp}/traefik-cache}
+mkdir -p "$CACHE" "$DEST"
+[ -f "$CACHE/$FILE" ] || curl -fsSL -o "$CACHE/$FILE" "$BASE/$FILE"
+[ -f "$CACHE/checksums-$VERSION.txt" ] || curl -fsSL -o "$CACHE/checksums-$VERSION.txt" "$BASE/traefik_v${VERSION}_checksums.txt"
+want=$(grep " $FILE\$" "$CACHE/checksums-$VERSION.txt" | cut -d' ' -f1)
+[ -n "$want" ] || { echo "no checksum listed for $FILE" >&2; exit 1; }
+got=$(sha256sum "$CACHE/$FILE" | cut -d' ' -f1)
+[ "$want" = "$got" ] || { echo "checksum mismatch for $FILE" >&2; rm -f "$CACHE/$FILE"; exit 1; }
+if [ "$EXT" = zip ]; then
+	unzip -qo "$CACHE/$FILE" traefik.exe -d "$DEST"
+else
+	tar -xzf "$CACHE/$FILE" -C "$DEST" traefik
+fi
+echo "traefik $VERSION for $OS/$ARCH ready"

deploy/install.sh

@@ -5,7 +5,7 @@
 #   sudo ./install.sh --start      the same, then start (or restart) the service
 #   sudo ./install.sh --uninstall  remove the service and binary (keeps the settings and data)
 #
-# Files: /usr/local/bin/blacktip, /etc/systemd/system/blacktip.service,
+# Files: /usr/local/lib/blacktip/blacktip (linked from /usr/local/bin/blacktip), /etc/systemd/system/blacktip.service,
 #        /etc/blacktip/blacktip.env (your settings and secrets), /var/lib/blacktip (data).
 # Set DESTDIR=/some/dir to stage everything there without touching the system.
 set -eu
@@ -17,6 +17,7 @@ UNIT=$ROOT/etc/systemd/system/$NAME.service
 CONF=$ROOT/etc/$NAME
 ENVFILE=$CONF/$NAME.env
 DATA=$ROOT/var/lib/$NAME
+LIB=$ROOT/usr/local/lib/$NAME # the program lives here, owned by the service, so auto-update can replace it
 
 say() { printf '%s\n' "$*"; }
 real() { [ -z "${DESTDIR:-}" ]; } # are we touching the real system?
@@ -30,7 +31,7 @@ if [ "${1:-}" = "--uninstall" ]; then
 	if real; then
 		systemctl disable --now "$NAME" > /dev/null 2>&1 || true
 	fi
-	rm -f "$UNIT" "$BIN"
+	rm -f "$UNIT" "$BIN" "$LIB/$NAME" "$ROOT/usr/local/lib/$NAME/traefik"
 	if real; then
 		systemctl daemon-reload || true
 	fi
@@ -45,16 +46,25 @@ if real && ! id "$NAME" > /dev/null 2>&1; then
 	say "Created the system user '$NAME'."
 fi
 
-mkdir -p "$ROOT/usr/local/bin" "$ROOT/etc/systemd/system" "$CONF" "$DATA"
-install -m 0755 "$HERE/$NAME" "$BIN.new"
-mv -f "$BIN.new" "$BIN" # atomic, so upgrading a running service is safe
+mkdir -p "$ROOT/usr/local/lib/$NAME" "$ROOT/usr/local/bin" "$ROOT/etc/systemd/system" "$CONF" "$DATA"
+mkdir -p "$LIB"
+install -m 0755 "$HERE/$NAME" "$LIB/$NAME.new"
+mv -f "$LIB/$NAME.new" "$LIB/$NAME" # atomic, so upgrading a running service is safe
+rm -f "$BIN"
+LINK=/usr/local/lib/$NAME/$NAME
+[ -z "${DESTDIR:-}" ] || LINK=$LIB/$NAME # staging: point inside the staging folder
+ln -s "$LINK" "$BIN"
+if [ -f "$HERE/traefik" ]; then
+	install -m 0755 "$HERE/traefik" "$ROOT/usr/local/lib/$NAME/traefik.new"
+	mv -f "$ROOT/usr/local/lib/$NAME/traefik.new" "$ROOT/usr/local/lib/$NAME/traefik"
+fi
 install -m 0644 "$HERE/$NAME.service" "$UNIT"
 if [ ! -f "$ENVFILE" ]; then
 	install -m 0600 "$HERE/.env.example" "$ENVFILE"
 	say "Created $ENVFILE. Edit it before starting."
 fi
 if real; then
-	chown -R "$NAME:$NAME" "$DATA"
+	chown -R "$NAME:$NAME" "$DATA" "$LIB"
 fi
 
 if real; then
@@ -66,7 +76,7 @@ if real; then
 	fi
 fi
 
-say "Installed $("$BIN" -version 2> /dev/null || echo "$NAME")."
+say "Installed $("$LIB/$NAME" -version 2> /dev/null || echo "$NAME")."
 say "Next:"
 say "  1. edit $ENVFILE"
 say "  2. systemctl start $NAME      (or run this again with --start)"

deploy/publish-release.sh

@@ -42,19 +42,30 @@ else
 	echo "release $TAG already exists (id $id): replacing its files"
 fi
 
-existing=$(curl -fsS -H "$AUTH" "$API/releases/$id/assets" | json 'import sys, json
+# the ids of the release's assets with a given name (a failed upload can leave a partial one behind)
+asset_ids() {
+	curl -fsS -H "$AUTH" "$API/releases/$id/assets" | "$PY" -c 'import sys, json
 for a in json.load(sys.stdin):
-    print(a["id"], a["name"])')
+    if a["name"] == sys.argv[1]:
+        print(a["id"])' "$1"
+}
 
 for f in dist/*.tar.gz dist/*.zip dist/SHA256SUMS; do
 	[ -f "$f" ] || continue
 	name=$(basename "$f")
-	echo "$existing" | while read -r aid aname; do
-		if [ "$aname" = "$name" ]; then
+	n=1
+	while :; do
+		for aid in $(asset_ids "$name"); do
 			curl -fsS -X DELETE -H "$AUTH" "$API/releases/$id/assets/$aid" > /dev/null
-		fi
 		done
-	echo "uploading $name"
-	curl -fsS -X POST -H "$AUTH" -F "attachment=@$f" "$API/releases/$id/assets?name=$name" > /dev/null
+		echo "uploading $name (attempt $n)"
+		if curl -fsS --max-time 1200 -X POST -H "$AUTH" -F "attachment=@$f" "$API/releases/$id/assets?name=$name" > /dev/null; then
+			break
+		fi
+		# large uploads can hit a proxy timeout (HTTP 502); try again
+		[ "$n" -lt 5 ] || { echo "giving up on $name after $n attempts" >&2; exit 1; }
+		n=$((n + 1))
+		sleep $((n * 10))
+	done
 done
 echo "published $SERVER/$REPO/releases/tag/$TAG"

go.mod

@@ -3,7 +3,7 @@ module git.veillax.com/Veillax/blacktip
 go 1.27.3
 
 require (
-	git.veillax.com/Veillax/reef v0.1.0
+	git.veillax.com/Veillax/reef v0.1.3
 	github.com/emersion/go-msgauth v0.7.0
 	golang.org/x/crypto v0.58.0
 )

go.sum

@@ -1,5 +1,7 @@
 git.veillax.com/Veillax/reef v0.1.0 h1:O0OhEKFx2CsvACJ20sfzJNjGsngomtfDdKdxu4ROpCs=
 git.veillax.com/Veillax/reef v0.1.0/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
+git.veillax.com/Veillax/reef v0.1.3 h1:RxSq2xwaup1+MieAkhlvOTZnYwPf19thFHEAe/7VxsI=
+git.veillax.com/Veillax/reef v0.1.3/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
 github.com/Microsoft/go-winio v0.6.4 h1:kJF2pamtYCWXf0xAT8sAkwKC0pMl2HYBrRPHAqyUc+g=
 github.com/Microsoft/go-winio v0.6.4/go.mod h1:1xl5JXG4ze/m74GH6Dc4Mwxfc3VL5siRVQjIAlHH07U=
 github.com/emersion/go-msgauth v0.7.0 h1:vj2hMn6KhFtW41kshIBTXvp6KgYSqpA/ZN9Pv4g1INc=