v0.9.0 — One-click self-update (homegrown, no OTM)

Add an admin 'Pull & rebuild' button (Settings → Updates). It POSTs an
admin-gated route that signals a privileged 'updater' sidecar (adnanh/webhook +
docker socket) over the internal network with a shared secret; the sidecar runs
'git fetch && reset --hard origin/master && docker compose up -d --build app'
detached. The UI polls /api/version until the rebuilt app returns on the new
version, then reloads.

Secret matching uses webhook -template + getenv so UPDATER_SECRET stays out of
the repo (host .env only). No request data reaches the shell — the command is
fixed in updater/update.sh.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

updater/hooks.json

@@ -0,0 +1,15 @@
+[
+  {
+    "id": "moonbase-update",
+    "execute-command": "/appdata/updater/update.sh",
+    "command-working-directory": "/appdata",
+    "response-message": "update started",
+    "trigger-rule": {
+      "match": {
+        "type": "value",
+        "value": "{{ getenv \"UPDATER_SECRET\" }}",
+        "parameter": { "source": "header", "name": "X-Update-Token" }
+      }
+    }
+  }
+]

updater/update.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+# Triggered by the webhook sidecar when an admin clicks "Pull & rebuild".
+# Runs the rebuild DETACHED so the webhook responds immediately — otherwise the
+# app container (which the admin's browser is talking to) would be recreated
+# mid-request. The app UI then polls /api/version until the new version answers.
+#
+# Only `app` is rebuilt: postgres and this updater are left running untouched.
+set -e
+
+nohup sh -c '
+  cd /appdata
+  echo "=== update $(date) ==="
+  git fetch origin master
+  git reset --hard origin/master
+  COMPOSE_PROJECT_NAME=moonbase docker compose up -d --build app
+  echo "=== done $(date) ==="
+' >> /appdata/update.log 2>&1 &
+
+echo "update started"