tonym
1c66dbd481
Add an admin 'Pull & rebuild' button (Settings → Updates). It POSTs an admin-gated route that signals a privileged 'updater' sidecar (adnanh/webhook + docker socket) over the internal network with a shared secret; the sidecar runs 'git fetch && reset --hard origin/master && docker compose up -d --build app' detached. The UI polls /api/version until the rebuilt app returns on the new version, then reloads. Secret matching uses webhook -template + getenv so UPDATER_SECRET stays out of the repo (host .env only). No request data reaches the shell — the command is fixed in updater/update.sh. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
8 lines
412 B
Docker
8 lines
412 B
Docker
# Privileged self-update sidecar. Holds the docker socket and, on an
|
|
# authenticated webhook trigger, runs `git pull && docker compose up -d --build app`
|
|
# against the moonbase stack. It only ever runs the fixed updater/update.sh —
|
|
# no request data reaches the shell. See docker-compose.yml + updater/hooks.json.
|
|
FROM docker:27-cli
|
|
RUN apk add --no-cache git docker-cli-compose webhook
|
|
ENTRYPOINT ["webhook"]
|