tonym
1c66dbd481
Add an admin 'Pull & rebuild' button (Settings → Updates). It POSTs an admin-gated route that signals a privileged 'updater' sidecar (adnanh/webhook + docker socket) over the internal network with a shared secret; the sidecar runs 'git fetch && reset --hard origin/master && docker compose up -d --build app' detached. The UI polls /api/version until the rebuilt app returns on the new version, then reloads. Secret matching uses webhook -template + getenv so UPDATER_SECRET stays out of the repo (host .env only). No request data reaches the shell — the command is fixed in updater/update.sh. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>