fix(deploy): provision management agent during server updates

deploy/install-management.sh

@@ -1,18 +1,47 @@
 #!/usr/bin/env bash
-# Called explicitly by install.sh. Also usable once on existing installations.
+# Host setup shared by first install and updates.
 set -euo pipefail
 cd "$(dirname "$0")"
 DEPLOY="$(pwd -P)"
+ENSURE=0
+case "${1:-}" in
+  --ensure) ENSURE=1 ;;
+  '') ;;
+  *) echo "Usage: bash install-management.sh [--ensure]" >&2; exit 1 ;;
+esac
+
+# The active worker owns this process tree (systemd KillMode=control-group).
+# Restarting it here would kill the update. It refreshes itself after success.
+if [ "$ENSURE" = 1 ] && [ -n "${PIPU_UPDATE_SOURCE:-}" ]; then
+  systemctl is-active --quiet pipu-management.service || {
+    echo 'The management worker must stay active during its own update' >&2
+    exit 1
+  }
+  echo '→ агент управления продолжает обновление; новая копия применится после завершения'
+  exit 0
+fi
+
 DATA="${PIPU_DATA:-$(sed -n 's/^PIPU_DATA=//p' .env)}"
 DATA="${DATA:-/srv/pipu}"
+if [ "$(id -u)" -ne 0 ]; then
+  command -v sudo >/dev/null || { echo 'Для настройки агента запустите обновление с правами root (sudo)' >&2; exit 1; }
+  echo '→ для настройки системного сервиса агента нужны права sudo'
+  exec sudo -- env "PIPU_DATA=$DATA" bash "$DEPLOY/install-management.sh" "$@"
+fi
+
 command -v python3 >/dev/null || { echo 'Install python3 (>=3.10) first' >&2; exit 1; }
 python3 -c 'import sys; assert sys.version_info >= (3, 10), "Python >=3.10 required"'
 [ -d /etc/systemd/system ] || { echo 'systemd is required for server management' >&2; exit 1; }
+RESTART=0
 mkdir -p "$DATA/management" /var/lib/pipu-management /usr/local/lib/pipu
 chown 65532:65532 "$DATA/management"
 chmod 700 "$DATA/management" /var/lib/pipu-management
 # Copy outside the checkout: switching revisions must not replace a running worker.
-install -m 700 server-agent.py /usr/local/lib/pipu/server-agent.py
+if ! cmp -s server-agent.py /usr/local/lib/pipu/server-agent.py; then
+  install -m 700 server-agent.py /usr/local/lib/pipu/server-agent.py.new
+  mv -f /usr/local/lib/pipu/server-agent.py.new /usr/local/lib/pipu/server-agent.py
+  RESTART=1
+fi
 touch config.local
 chmod 600 config.local
 if [ -n "${SUDO_USER:-}" ]; then chown "$SUDO_USER" config.local; fi
@@ -20,7 +49,9 @@ if [ -n "${SUDO_USER:-}" ]; then chown "$SUDO_USER" config.local; fi
 quote_unit() { printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/%/%%/g'; }
 DEPLOY_UNIT="$(quote_unit "$DEPLOY")"
 MAILBOX_UNIT="$(quote_unit "$DATA/management")"
-cat > /etc/systemd/system/pipu-management.service <<EOF
+UNIT_TMP="$(mktemp)"
+trap 'rm -f "$UNIT_TMP"' EXIT
+cat > "$UNIT_TMP" <<EOF
 [Unit]
 Description=Pipu Music server management agent
 After=docker.service
@@ -37,7 +68,14 @@ KillMode=control-group
 [Install]
 WantedBy=multi-user.target
 EOF
-systemctl daemon-reload
+if ! cmp -s "$UNIT_TMP" /etc/systemd/system/pipu-management.service; then
+  install -m 644 "$UNIT_TMP" /etc/systemd/system/pipu-management.service
+  systemctl daemon-reload
+  RESTART=1
+fi
 systemctl enable pipu-management.service
-systemctl restart pipu-management.service
+if [ "$ENSURE" = 0 ] || [ "$RESTART" = 1 ] || ! systemctl is-active --quiet pipu-management.service; then
+  systemctl restart pipu-management.service
+fi
+systemctl is-active --quiet pipu-management.service
 echo '→ управление сервером: pipu-management.service'