feat(admin): manage server updates and local configuration

deploy/update.sh

@@ -14,6 +14,15 @@ fi
 trap 'rm -f "$0"' EXIT
 cd "$PIPU_DEPLOY_DIR"
 
+# Share a lock with manual deployments and config application.
+if [ ! -f .management.lock ]; then (umask 022; : > .management.lock); fi
+exec 9<.management.lock
+flock -n 9 || { echo 'Another deployment is running' >&2; exit 1; }
+
+touch config.local
+chmod 600 config.local
+compose() { docker compose --env-file config.local --env-file .env "$@"; }
+
 [ -f .env ] || { echo "нет .env — сначала sudo ./install.sh" >&2; exit 1; }
 
 # Ключи подписи (токены — M1, ссылки на обложки и аудио — M2): создаются один раз,
@@ -69,7 +78,15 @@ if [ -n "$LIBRARY_HOST" ] && [ -z "$(ls -A "$LIBRARY_HOST" 2>/dev/null)" ] && [
 fi
 
 REF="${1:-}"
-git fetch --tags --prune --quiet origin
+if [ -n "${PIPU_UPDATE_SOURCE:-}" ]; then
+  [[ "${PIPU_UPDATE_COMMIT:-}" =~ ^[a-f0-9]{40,64}$ ]] || { echo 'Invalid commit' >&2; exit 1; }
+  [[ "${PIPU_UPDATE_REF:-}" =~ ^refs/(heads/main|tags/v?[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?)$ ]] || { echo 'Invalid ref' >&2; exit 1; }
+  git -c protocol.file.allow=never -c protocol.ext.allow=never fetch --quiet -- "$PIPU_UPDATE_SOURCE" "$PIPU_UPDATE_REF"
+  FETCHED="$(git rev-parse 'FETCH_HEAD^{commit}')"
+  [ "$FETCHED" = "$PIPU_UPDATE_COMMIT" ] || { echo 'Source changed; select update again' >&2; exit 1; }
+else
+  git fetch --tags --prune --quiet origin
+fi
 
 if [ -z "$REF" ]; then
   REF="$(git tag -l 'v*' --sort=-v:refname | grep -v -- '-rc' | head -1)"
@@ -96,26 +113,40 @@ if [ -n "$cur_core" ] && [ -n "$tgt_core" ] && [ "$cur_core" != "$tgt_core" ] &&
 fi
 
 echo "→ переключаемся на $REF"
-if git show-ref --verify --quiet "refs/remotes/origin/$REF"; then
+# Refuse to overwrite local source changes.
+git diff --quiet && git diff --cached --quiet || { echo 'Repository has local changes' >&2; exit 1; }
+if [ -n "${PIPU_UPDATE_COMMIT:-}" ]; then
+  git checkout --quiet --detach "$PIPU_UPDATE_COMMIT"
+elif git show-ref --verify --quiet "refs/remotes/origin/$REF"; then
   git checkout --quiet "$REF"
   git merge --ff-only --quiet "origin/$REF"
 else
   git checkout --quiet --detach "$REF"
 fi
 
-VERSION="$(git describe --tags --always --dirty)"
+if [ -n "${PIPU_UPDATE_COMMIT:-}" ]; then
+  if [ "$REF" = main ]; then VERSION="main-$(git rev-parse --short HEAD)"; else VERSION="$REF"; fi
+else
+  VERSION="$(git describe --tags --always --dirty)"
+fi
 VERSION="${VERSION#v}"
 sed -i "s|^PIPU_VERSION=.*|PIPU_VERSION=$VERSION|" .env
 echo "→ версия $VERSION, сборка образов (первая сборка — 5–15 минут)"
 
-docker compose build --pull
-docker compose up -d --remove-orphans
+compose config --quiet
+if ! compose build --pull; then
+  # A build failure leaves running containers untouched; keep their version in .env.
+  sed -i "s|^PIPU_VERSION=.*|PIPU_VERSION=$CURRENT|" .env
+  echo 'Build failed; running containers were not replaced' >&2
+  exit 1
+fi
+compose up -d --remove-orphans
 docker image prune -f >/dev/null
 
 echo "→ ждём готовности api"
 for _ in $(seq 1 60); do
   # 127.0.0.1, а не localhost: в alpine localhost — сначала ::1, а nginx слушает только IPv4
-  if docker compose exec -T nginx wget -qO- http://127.0.0.1/readyz >/dev/null 2>&1; then
+  if compose exec -T nginx wget -qO- http://127.0.0.1/readyz >/dev/null 2>&1; then
     echo "pipu $VERSION запущен"
     exit 0
   fi