* upgrade: restart services when the upgrade fails before code changes
The upgrade script stops wrolpi-api and wrolpi-app before fetching, so a
failed fetch, signature verification, or checkout left the WROLPi down
with unchanged code on disk. The EXIT trap now restarts both services
for failures that occur before scripts/upgrade.sh begins modifying the
system. The post-checkout verification failure rolls the branch back to
the previously-running commit first, so services never restart on an
unverified commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* upgrade: only restart services when rollback lands on the known-good commit
Review fixes: a failed rollback no longer leaves the restart flag set, so
services cannot start on an unverified or mixed tree; the non-atomic
checkout failure path now rolls back too; trimmed narrative comments.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
verify-commit judges signature validity regardless of ownertrust, so the
upgrade's security model (possession of the pinned key is the trust
anchor) is unchanged — but gpg printed "WARNING: This key is not
certified with a trusted signature!" on every healthy upgrade, making
valid-signature logs look like something continued past a failure.
Import ownertrust for the sole key in the keyring to silence it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Same fix install.sh received in bf88ac9f: on a box with no local
release branch (installed before that patch), the tracked release/
directory makes a bare `git checkout -f release` fail with
"could be both a local file and a tracking branch", aborting upgrades.
`checkout -f -B <branch> origin/<branch>` is unambiguous and already
resets the branch to origin, replacing the separate reset --hard.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Global IPs from `hostname -I` (e.g. routable IPv6 assigned via SLAAC)
violated the Root CA's critical nameConstraints, failing leaf verification
with "permitted subtree violation" (error 47) and aborting
install/repair/upgrade. Filter SAN candidates, including EXTRA_SANS, to the
permitted private ranges and log skipped entries; normalize the IP:/DNS:
prefix case in EXTRA_SANS since openssl rejects lowercase prefixes.
Also guard the service stops in upgrade.sh so upgrading a box whose
install died before the units were installed can still recover.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
scripts/upgrade.sh runs `npm install`, which rewrites app/package-lock.json
and leaves the working tree dirty. The next upgrade's `git checkout ${BRANCH}`
then aborts with "Your local changes would be overwritten by checkout" before
the following `git reset --hard` can discard them, failing the upgrade with
exit 4.
Use `git checkout -f` so the branch switch discards local modifications; the
reset --hard immediately after already forces the tree to match origin, so the
intent (blow away local changes) is unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
upgrade.sh delegates to wrolpi-upgrade.service at the very start, but that
unit is only installed by repair.sh, which runs near the end of the upgrade.
On a box that has never run a repair since the unit was introduced, the
delegation fails immediately with "Unit wrolpi-upgrade.service not found",
the service never runs (so nothing is logged to the journal), and
/opt/wrolpi/upgrade.log is never created.
Install/refresh the unit from the checked-out tree and daemon-reload right
before starting the service. The delegation block already runs as root, so
no sudoers changes are needed. This is idempotent and also self-heals a
stale unit file.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Importing maps as wrolpi user, then changing ownership to _renderd.
Changing ownership of /opt/wrolpi as well.
Creating pgpass for wrolpi user in debian 11.
Install specific version of serve.
Not echoing the echo.
Updating cache directory in create_db.sh.
Use python binary to run db upgrade.
Install renderd.conf to /etc on RPi OS.
Fetching DC map from wrolpi.org to avoid broken daily PBFs.
Only get latest dc map if it doesn't exist.
carto switched again??
Changing mod_tile directory to /var/cache/renderd/tiles for RPi OS.
Copying renderd configs for RPi OS.
Installing postgres 13 for RPi OS map.
Changing title of feature matrix.
Moving download link up in readme.
Changing mod_tile to _renderd.
Using unix socket rather than host connection.
Getting openstreetmap-carto as _renderd user.
Assigning ownership of gis db to _renderd in reset_map.sh.
Creating _renderd db user.
Using _renderd to run renderd on debian 11.
Installing python modules that map requires globally.
Upgrading db using venv.
Installing nodejs which installs npm.
Install npm/node after other dependencies.
Updating apt so nodejs can be installed.
Upgrading PyYAML in new venv.
Installing pip via apt.
Including bash binary for portability.
Moving images link out of list.
Moving download up on Readme.
Removing map installation from readme.
Installing specific version of carto.
Creating venv for wrolpi project. Using venv to install requirements and run wrolpi's main.py.
Logging upgrade script.
Including upgrade script in Upgrade readme.
Moving upgrade logic into separate script. This is necessary so and repo update will take immediate effect on the upgrade.
Modifying and unifying Debian installation with RPi OS installation.
