feat: establish secure update foundation

cmd/dyndns-web/main.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"strings"
 	"syscall"
 	"time"
@@ -18,20 +19,52 @@ import (
 	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/scheduler"
 	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/secure"
 	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/store"
+	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/updateagent"
 	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/web"
 )
 
 func main() {
-	if len(os.Args) > 1 && os.Args[1] == "healthcheck" {
+	command := commandForInvocation(os.Args)
+	if command == "healthcheck" {
 		os.Exit(healthcheck())
 	}
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
-	if err := run(logger); err != nil {
+	var err error
+	switch command {
+	case "serve":
+		err = run(logger)
+	case "update-agent":
+		ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+		defer stop()
+		err = updateagent.Serve(ctx, updateagent.ServerConfigFromEnvironment(), logger)
+	default:
+		err = errors.New("unknown command; expected serve, healthcheck, or update-agent")
+	}
+	if err != nil {
 		logger.Error("application stopped", "error", err)
 		os.Exit(1)
 	}
 }
 
+func commandForInvocation(arguments []string) string {
+	if len(arguments) == 0 {
+		return "invalid"
+	}
+	// v1.3 Compose files override the agent entrypoint and inherit the image's
+	// default "serve" command. Keep that one-time manual upgrade path working
+	// while the image itself still contains only one executable.
+	if filepath.Base(arguments[0]) == "update-agent" && (len(arguments) == 1 || (len(arguments) == 2 && arguments[1] == "serve")) {
+		return "update-agent"
+	}
+	if len(arguments) == 1 {
+		return "serve"
+	}
+	if len(arguments) == 2 {
+		return arguments[1]
+	}
+	return "invalid"
+}
+
 func run(logger *slog.Logger) error {
 	// Credentials and session data must never inherit a permissive process umask.
 	syscall.Umask(0o077)

cmd/dyndns-web/main_test.go

@@ -0,0 +1,24 @@
+package main
+
+import "testing"
+
+func TestCommandForInvocationKeepsV13ComposeAgentCompatible(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		arguments []string
+		want      string
+	}{
+		{arguments: []string{"/usr/local/bin/domain-control"}, want: "serve"},
+		{arguments: []string{"/usr/local/bin/domain-control", "update-agent"}, want: "update-agent"},
+		{arguments: []string{"/usr/local/bin/domain-control", "healthcheck"}, want: "healthcheck"},
+		{arguments: []string{"/usr/local/bin/update-agent"}, want: "update-agent"},
+		{arguments: []string{"/usr/local/bin/update-agent", "serve"}, want: "update-agent"},
+		{arguments: []string{"/usr/local/bin/domain-control", "serve", "extra"}, want: "invalid"},
+		{arguments: nil, want: "invalid"},
+	}
+	for _, test := range tests {
+		if got := commandForInvocation(test.arguments); got != test.want {
+			t.Errorf("commandForInvocation(%q) = %q; want %q", test.arguments, got, test.want)
+		}
+	}
+}

cmd/update-agent/main.go

@@ -1,88 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"log/slog"
-	"net"
-	"net/http"
-	"os"
-	"os/signal"
-	"path/filepath"
-	"strings"
-	"syscall"
-	"time"
-
-	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/updateagent"
-)
-
-func main() {
-	logger := slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
-	if err := run(logger); err != nil {
-		logger.Error("update agent stopped", "error", err)
-		os.Exit(1)
-	}
-}
-
-func run(logger *slog.Logger) error {
-	socket := env("UPDATE_AGENT_SOCKET", "/run/domain-control-update/agent.sock")
-	dockerSocket := env("UPDATE_DOCKER_SOCKET", "/var/run/docker.sock")
-	image := env("UPDATE_IMAGE_REPOSITORY", "git.j-mahler.de/admin/domain-control-webinterface-prod")
-	targetLabel := env("UPDATE_TARGET_LABEL", "de.j-mahler.domain-control.role=app")
-	directory := filepath.Dir(socket)
-	if err := os.MkdirAll(directory, 0o711); err != nil {
-		return err
-	}
-	if err := os.Chmod(directory, 0o711); err != nil {
-		return err
-	}
-	if err := os.Remove(socket); err != nil && !errors.Is(err, os.ErrNotExist) {
-		return err
-	}
-	listener, err := net.Listen("unix", socket)
-	if err != nil {
-		return err
-	}
-	defer listener.Close()
-	defer os.Remove(socket)
-	// The container runs as uid 0 with gid 10001. Group-only access lets the
-	// unprivileged web process connect without exposing the socket to others.
-	if err := os.Chmod(socket, 0o660); err != nil {
-		return err
-	}
-	runner := updateagent.NewDockerRunner(dockerSocket, image, targetLabel, logger)
-	controller := updateagent.NewController(runner, logger)
-	server := &http.Server{
-		Handler:           controller.Handler(),
-		ReadHeaderTimeout: 3 * time.Second,
-		ReadTimeout:       5 * time.Second,
-		WriteTimeout:      5 * time.Second,
-		IdleTimeout:       15 * time.Second,
-		MaxHeaderBytes:    8 << 10,
-	}
-	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
-	defer stop()
-	serverErrors := make(chan error, 1)
-	go func() {
-		logger.Info("update agent ready", "socket", socket)
-		serverErrors <- server.Serve(listener)
-	}()
-	select {
-	case err := <-serverErrors:
-		if errors.Is(err, http.ErrServerClosed) {
-			return nil
-		}
-		return err
-	case <-ctx.Done():
-		shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		defer cancel()
-		return server.Shutdown(shutdownCtx)
-	}
-}
-
-func env(name, fallback string) string {
-	if value := strings.TrimSpace(os.Getenv(name)); value != "" {
-		return value
-	}
-	return fallback
-}