Krystie
bfa4ba570e
The host-side updater has been silently broken in two ways: 1. Empty staging directories would cause rm -rf of live routes/src with no replacement, leaving the host tree gutted while the container kept serving from its own image. Now deploy_tree() refuses to delete unless the staging source has actual files. 2. chattr +i on critical files (used to protect security-hotfixed routes from being clobbered by upstream tarballs) caused rm -rf to partially execute then fail under set -e, leaving the host in a half-deleted state. Now deploy_tree() scans for immutable files, unlocks them before replace, and re-locks them after — so security-locked files survive every update. Also adds: - Channel gate: trigger.json channel=prerelease/beta/rc/alpha is rejected unless ALLOW_PRERELEASE=true is set in /opt/dashcaddy/updates/channel.conf. Default is 'stable only', safe for production. Staging hosts opt in. - channel.conf.example documenting the new opt-in mechanism. Verified end-to-end: manual trigger.json → path unit fired → routes (53 files) + src (62 files) deployed → container rebuilt → health check passed. totp.js remained locked with security edits intact.
9 lines
359 B
Plaintext
9 lines
359 B
Plaintext
# DashCaddy update channel configuration
|
|
#
|
|
# Copy this file to channel.conf and uncomment ALLOW_PRERELEASE to opt in to
|
|
# prerelease/beta/rc channels. Stable releases are always applied.
|
|
#
|
|
# Useful for staging hosts that want to test new releases before they hit prod.
|
|
# Production hosts should leave this set to false (the default).
|
|
|
|
# ALLOW_PRERELEASE=false |