feat: establish secure update foundation

cmd/dyndns-web/main.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"strings"
 	"syscall"
 	"time"
@@ -18,20 +19,52 @@ import (
 	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/scheduler"
 	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/secure"
 	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/store"
+	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/updateagent"
 	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/web"
 )
 
 func main() {
-	if len(os.Args) > 1 && os.Args[1] == "healthcheck" {
+	command := commandForInvocation(os.Args)
+	if command == "healthcheck" {
 		os.Exit(healthcheck())
 	}
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
-	if err := run(logger); err != nil {
+	var err error
+	switch command {
+	case "serve":
+		err = run(logger)
+	case "update-agent":
+		ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+		defer stop()
+		err = updateagent.Serve(ctx, updateagent.ServerConfigFromEnvironment(), logger)
+	default:
+		err = errors.New("unknown command; expected serve, healthcheck, or update-agent")
+	}
+	if err != nil {
 		logger.Error("application stopped", "error", err)
 		os.Exit(1)
 	}
 }
 
+func commandForInvocation(arguments []string) string {
+	if len(arguments) == 0 {
+		return "invalid"
+	}
+	// v1.3 Compose files override the agent entrypoint and inherit the image's
+	// default "serve" command. Keep that one-time manual upgrade path working
+	// while the image itself still contains only one executable.
+	if filepath.Base(arguments[0]) == "update-agent" && (len(arguments) == 1 || (len(arguments) == 2 && arguments[1] == "serve")) {
+		return "update-agent"
+	}
+	if len(arguments) == 1 {
+		return "serve"
+	}
+	if len(arguments) == 2 {
+		return arguments[1]
+	}
+	return "invalid"
+}
+
 func run(logger *slog.Logger) error {
 	// Credentials and session data must never inherit a permissive process umask.
 	syscall.Umask(0o077)

cmd/dyndns-web/main_test.go

@@ -0,0 +1,24 @@
+package main
+
+import "testing"
+
+func TestCommandForInvocationKeepsV13ComposeAgentCompatible(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		arguments []string
+		want      string
+	}{
+		{arguments: []string{"/usr/local/bin/domain-control"}, want: "serve"},
+		{arguments: []string{"/usr/local/bin/domain-control", "update-agent"}, want: "update-agent"},
+		{arguments: []string{"/usr/local/bin/domain-control", "healthcheck"}, want: "healthcheck"},
+		{arguments: []string{"/usr/local/bin/update-agent"}, want: "update-agent"},
+		{arguments: []string{"/usr/local/bin/update-agent", "serve"}, want: "update-agent"},
+		{arguments: []string{"/usr/local/bin/domain-control", "serve", "extra"}, want: "invalid"},
+		{arguments: nil, want: "invalid"},
+	}
+	for _, test := range tests {
+		if got := commandForInvocation(test.arguments); got != test.want {
+			t.Errorf("commandForInvocation(%q) = %q; want %q", test.arguments, got, test.want)
+		}
+	}
+}