64ff5f508b
GATE 1 refuses to ladder an app that cannot prove a rung landed, and only mastodon, nextcloud and stalwart could. None of those are installed here, so the stepped upgrade — button or automatic — was unreachable for every app on the box. Three fixes. _updaterPrimaryContainer assumed the container is "<app>-service". It is a convention, not a rule: matrix names its anchor service matrix-synapse and stoat names its api (container stoat-api). The verifier therefore inspected a container that does not exist, saw no state, and could only time out — on exactly the stateful apps that most need verifying. It now reads the anchor service's container_name from the compose, buffering per service block because container_name may sit either side of the image line. Added updaterVerifyHttpVersion: poll the app over its PUBLISHED port from the host, pull the version from a JSON field or a response header, and require agreement three polls running. Probed from the host rather than `docker exec … curl` because half these images ship no curl at all (mattermost is one), so exec-based probing is a coin flip on the vendor's base image. Version comparison matches only the components both sides state, since tags and self-reported builds rarely share precision: v1.158.0 vs 1.158.0, 11.9 vs 11.9.1, 8.7.0 vs 8.7 all agree; 11.9 vs 11.10 does not. Each app hook is then three facts. Verified live: all three confirm at the version they are actually on, and all three REFUSE a version they are not — which is the property that makes stepping them safe. updaterUpgradeAuto now skips apps with no verifier instead of queueing a task that GATE 1 will reject, which would otherwise mean a failure notification every day for an app that was never eligible. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
19 lines
808 B
Bash
19 lines
808 B
Bash
#!/bin/bash
|
|
|
|
# Matrix (Synapse) upgrade verification.
|
|
# ---------------------------------------------------------------------------
|
|
# Synapse runs database schema migrations on boot and does not serve until they
|
|
# finish, so "answering with the new version" is genuine evidence the rung
|
|
# landed rather than merely that a process started.
|
|
#
|
|
# /_synapse/admin/v1/server_version needs no authentication and returns the
|
|
# running version outright: {"server_version":"1.158.0"}. The tag carries a
|
|
# leading v (v1.158.0); the shared comparison comes down to numbers, so that
|
|
# difference does not matter.
|
|
|
|
# matrix_upgrade_verify <app> <expected-tag> <deadline-epoch>
|
|
matrix_upgrade_verify() {
|
|
updaterVerifyHttpVersion "$1" "$2" "$3" 8008 \
|
|
"/_synapse/admin/v1/server_version" "json:server_version"
|
|
}
|