Use the auto-updating Blacktip, Bamboo and Reef; add the -auto-update option

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

deploy/hammerhead.service

@@ -8,7 +8,7 @@ Wants=network-online.target
 User=hammerhead
 Group=hammerhead
 EnvironmentFile=-/etc/hammerhead/hammerhead.env
-ExecStart=/usr/local/bin/hammerhead -listen :8080 -data /var/lib/hammerhead
+ExecStart=/usr/local/lib/hammerhead/hammerhead -listen :8080 -data /var/lib/hammerhead
 WorkingDirectory=/var/lib/hammerhead
 Restart=on-failure
 RestartSec=3
@@ -16,7 +16,7 @@ RestartSec=3
 # It only needs its own data folder and the network.
 NoNewPrivileges=true
 ProtectSystem=strict
-ReadWritePaths=/var/lib/hammerhead
+ReadWritePaths=/var/lib/hammerhead /usr/local/lib/hammerhead
 ProtectHome=true
 PrivateTmp=true
 ProtectKernelTunables=true

deploy/install.sh

@@ -5,7 +5,7 @@
 #   sudo ./install.sh --start      the same, then start (or restart) the service
 #   sudo ./install.sh --uninstall  remove the service and binary (keeps the settings and data)
 #
-# Files: /usr/local/bin/hammerhead, /etc/systemd/system/hammerhead.service,
+# Files: /usr/local/lib/hammerhead/hammerhead (linked from /usr/local/bin/hammerhead), /etc/systemd/system/hammerhead.service,
 #        /etc/hammerhead/hammerhead.env (your settings and secrets), /var/lib/hammerhead (data).
 # Set DESTDIR=/some/dir to stage everything there without touching the system.
 set -eu
@@ -17,6 +17,7 @@ UNIT=$ROOT/etc/systemd/system/$NAME.service
 CONF=$ROOT/etc/$NAME
 ENVFILE=$CONF/$NAME.env
 DATA=$ROOT/var/lib/$NAME
+LIB=$ROOT/usr/local/lib/$NAME # the program lives here, owned by the service, so auto-update can replace it
 
 say() { printf '%s\n' "$*"; }
 real() { [ -z "${DESTDIR:-}" ]; } # are we touching the real system?
@@ -30,7 +31,7 @@ if [ "${1:-}" = "--uninstall" ]; then
 	if real; then
 		systemctl disable --now "$NAME" > /dev/null 2>&1 || true
 	fi
-	rm -f "$UNIT" "$BIN"
+	rm -f "$UNIT" "$BIN" "$LIB/$NAME"
 	if real; then
 		systemctl daemon-reload || true
 	fi
@@ -46,15 +47,20 @@ if real && ! id "$NAME" > /dev/null 2>&1; then
 fi
 
 mkdir -p "$ROOT/usr/local/bin" "$ROOT/etc/systemd/system" "$CONF" "$DATA"
-install -m 0755 "$HERE/$NAME" "$BIN.new"
-mv -f "$BIN.new" "$BIN" # atomic, so upgrading a running service is safe
+mkdir -p "$LIB"
+install -m 0755 "$HERE/$NAME" "$LIB/$NAME.new"
+mv -f "$LIB/$NAME.new" "$LIB/$NAME" # atomic, so upgrading a running service is safe
+rm -f "$BIN"
+LINK=/usr/local/lib/$NAME/$NAME
+[ -z "${DESTDIR:-}" ] || LINK=$LIB/$NAME # staging: point inside the staging folder
+ln -s "$LINK" "$BIN"
 install -m 0644 "$HERE/$NAME.service" "$UNIT"
 if [ ! -f "$ENVFILE" ]; then
 	install -m 0600 "$HERE/.env.example" "$ENVFILE"
 	say "Created $ENVFILE. Edit it before starting."
 fi
 if real; then
-	chown -R "$NAME:$NAME" "$DATA"
+	chown -R "$NAME:$NAME" "$DATA" "$LIB"
 fi
 
 if real; then
@@ -66,7 +72,7 @@ if real; then
 	fi
 fi
 
-say "Installed $("$BIN" -version 2> /dev/null || echo "$NAME")."
+say "Installed $("$LIB/$NAME" -version 2> /dev/null || echo "$NAME")."
 say "Next:"
 say "  1. edit $ENVFILE"
 say "  2. systemctl start $NAME      (or run this again with --start)"

deploy/setup.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 # One-shot setup for a VPS. Run as root.
 #
-#   sh setup.sh [--domain hh.example.com] [--version v0.1.0]     Hammerhead (dashboard and API)
+#   sh setup.sh [--domain hh.example.com] [--version v0.1.0] [--no-auto-update]   Hammerhead (dashboard and API)
 #   sh setup.sh edge  --hammerhead URL --token TOKEN [--ports 25565,30000-30100] [--version V]
 #   sh setup.sh agent --hammerhead URL --token TOKEN [--version V]
 #
@@ -20,7 +20,7 @@ set -eu
 BASE=${SHARKS_BASE:-https://git.veillax.com/Veillax}
 MODE=hammerhead
 case "${1:-}" in edge | agent) MODE=$1; shift ;; esac
-DOMAIN= VERSION= HH= TOKEN= PORTS=
+DOMAIN= VERSION= HH= TOKEN= PORTS= AUTOUP=1
 while [ $# -gt 0 ]; do
 	case "$1" in
 		--domain) DOMAIN=$2; shift 2 ;;
@@ -28,11 +28,18 @@ while [ $# -gt 0 ]; do
 		--hammerhead) HH=$2; shift 2 ;;
 		--token) TOKEN=$2; shift 2 ;;
 		--ports) PORTS=$2; shift 2 ;;
+		--no-auto-update) AUTOUP=0; shift ;;
 		-h | --help) sed -n '2,16p' "$0"; exit 0 ;;
 		*) echo "unknown option $1 (see --help)" >&2; exit 2 ;;
 	esac
 done
 
+# auto_update <file> <PREFIX>: lets the program update itself unless --no-auto-update was given
+auto_update() {
+	[ "$AUTOUP" = 1 ] && set_env "$1" "$2_AUTO_UPDATE" 1
+	return 0
+}
+
 say() { printf '\n== %s\n' "$*"; }
 die() { echo "error: $*" >&2; exit 1; }
 [ "$(id -u)" = 0 ] || die "run as root: sudo sh $0 $*"
@@ -123,6 +130,7 @@ case $MODE in
 hammerhead)
 	fetch_install hammerhead
 	ENVF=/etc/hammerhead/hammerhead.env
+	auto_update "$ENVF" HAMMERHEAD
 	if ! grep -q '^HAMMERHEAD_MASTER_KEY=.' "$ENVF"; then
 		say "generating the master key"
 		set_env "$ENVF" HAMMERHEAD_MASTER_KEY "$(/usr/local/bin/hammerhead -genkey)"
@@ -166,6 +174,7 @@ edge)
 	ENVF=/etc/blacktip/blacktip.env
 	set_env "$ENVF" BLACKTIP_HAMMERHEAD "$HH"
 	set_env "$ENVF" BLACKTIP_TOKEN "$TOKEN"
+	auto_update "$ENVF" BLACKTIP
 	chmod 600 "$ENVF"
 	say "network"
 	# WireGuard moves a lot of UDP; the stock socket buffers are small
@@ -202,6 +211,7 @@ agent)
 	ENVF=/etc/bamboo/bamboo.env
 	set_env "$ENVF" BAMBOO_HAMMERHEAD "$HH"
 	set_env "$ENVF" BAMBOO_TOKEN "$TOKEN"
+	auto_update "$ENVF" BAMBOO
 	chmod 600 "$ENVF"
 	if command -v docker > /dev/null 2>&1 && getent group docker > /dev/null 2>&1; then
 		usermod -aG docker bamboo