v0.9.0 — One-click self-update (homegrown, no OTM)

Add an admin 'Pull & rebuild' button (Settings → Updates). It POSTs an
admin-gated route that signals a privileged 'updater' sidecar (adnanh/webhook +
docker socket) over the internal network with a shared secret; the sidecar runs
'git fetch && reset --hard origin/master && docker compose up -d --build app'
detached. The UI polls /api/version until the rebuilt app returns on the new
version, then reloads.

Secret matching uses webhook -template + getenv so UPDATER_SECRET stays out of
the repo (host .env only). No request data reaches the shell — the command is
fixed in updater/update.sh.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -29,12 +29,41 @@ services:
       GITEA_URL: http://192.168.0.5:3022
       GITEA_TOKEN: ${GITEA_TOKEN}
       GITEA_REPO: bonna61/Moonbase
+      # Self-update — admin "Pull & rebuild" signals the updater sidecar.
+      UPDATER_URL: http://updater:9000/hooks/moonbase-update
+      UPDATER_SECRET: ${UPDATER_SECRET}
     volumes:
       # Persist suggestion screenshot uploads across rebuilds.
       - /mnt/user/appdata/moonbase/uploads:/app/public/uploads
     networks:
       - internal
 
+  # Privileged self-update sidecar: holds the docker socket and rebuilds `app`
+  # on an authenticated webhook trigger. Only runs the fixed updater/update.sh.
+  updater:
+    build:
+      context: .
+      dockerfile: Dockerfile.updater
+    image: moonbase-updater:latest
+    restart: unless-stopped
+    command:
+      - -hooks
+      - /appdata/updater/hooks.json
+      - -template
+      - -hotreload
+      - -ip
+      - 0.0.0.0
+      - -port
+      - "9000"
+      - -verbose
+    environment:
+      UPDATER_SECRET: ${UPDATER_SECRET}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /mnt/user/appdata/moonbase:/appdata
+    networks:
+      - internal
+
 networks:
   internal:
     driver: bridge