anti
7765b36c50
Adds a separate `decnet updater` daemon on each worker that owns the agent's release directory and installs tarball pushes from the master over mTLS. A normal `/update` never touches the updater itself, so the updater is always a known-good rescuer if a bad agent push breaks /health — the rotation is reversed and the agent restarted against the previous release. `POST /update-self` handles updater upgrades explicitly (no auto-rollback). - decnet/updater/: executor, FastAPI app, uvicorn launcher - decnet/swarm/updater_client.py, tar_tree.py: master-side push - cli: `decnet updater`, `decnet swarm update [--host|--all] [--include-self] [--dry-run]`, `--updater` on `swarm enroll` - enrollment API issues a second cert (CN=updater@<host>) signed by the same CA; SwarmHost records updater_cert_fingerprint - tests: executor, app, CLI, tar tree, enroll-with-updater (37 new) - wiki: Remote-Updates page + sidebar + SWARM-Mode cross-link
11 lines
431 B
Python
11 lines
431 B
Python
"""DECNET self-updater daemon.
|
|
|
|
Runs on each worker alongside ``decnet agent``. Receives working-tree
|
|
tarballs from the master and owns the agent's lifecycle: snapshot →
|
|
install → restart → probe → auto-rollback on failure.
|
|
|
|
Deliberately separate process, separate venv, separate mTLS cert so that
|
|
a broken ``decnet agent`` push can always be rolled back by the updater
|
|
that shipped it. See ``wiki/Remote-Updates.md``.
|
|
"""
|