fix OTA

webconfig/scripts/bt-update

@@ -13,24 +13,42 @@
 #   $ROOT/run/qt.alive             heartbeat written by the Qt UI
 #   $ROOT/.previous                path of the previously active version
 #
-# Designed to be launched detached (setsid) via sudo by the web service, so it
-# survives the service restart performed mid-update.
+# Launched via sudo by the web service. On first entry re-execs itself through
+# systemd-run so it lives outside buttontask-web.service's cgroup and survives
+# the web service restart performed mid-update (setsid alone is not enough).
 set -uo pipefail
 
 ROOT="${BUTTONTASK_ROOT:-/opt/buttontask}"
+
+# Re-exec in a transient unit unless we are already running there.
+if [ -z "${BT_UPDATE_DETACHED:-}" ]; then
+    unit="buttontask-update-$(date +%s)"
+    exec systemd-run --no-block --collect \
+        "--unit=${unit}" \
+        "--setenv=BT_UPDATE_DETACHED=1" \
+        "--setenv=BUTTONTASK_ROOT=${ROOT}" \
+        "$0" "$@"
+fi
+
 VERSIONS="$ROOT/versions"
 CURRENT="$ROOT/current"
 RUN="$ROOT/run"
 STATUS="$RUN/update-status.json"
 HEARTBEAT="$RUN/qt.alive"
 PREV_MARK="$ROOT/.previous"
+LOG="$RUN/update.log"
 HEALTH_TIMEOUT="${BUTTONTASK_HEALTH_TIMEOUT:-30}"
 
 mkdir -p "$RUN" "$VERSIONS"
 
+log() {
+    printf '%s %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$*" >> "$LOG"
+}
+
 write_status() {
     local state="$1"; local msg="${2:-}"
     msg="${msg//\"/}"
+    log "status: $state ${msg}"
     printf '{"state":"%s","message":"%s","ts":%s}\n' "$state" "$msg" "$(date +%s)" > "$STATUS"
 }
 
@@ -47,7 +65,10 @@ PY
 }
 
 restart_services() {
-    systemctl restart buttontask-web buttontask 2>/dev/null || true
+    log "restart buttontask"
+    systemctl restart buttontask 2>/dev/null || true
+    log "restart buttontask-web"
+    systemctl restart buttontask-web 2>/dev/null || true
 }
 
 # Returns 0 when the freshly started version looks healthy.
@@ -114,6 +135,7 @@ cmd_stage() {
     rm -rf "$dest"
     mv "$tmp" "$dest"
     chown -R buttontask:buttontask "$dest" 2>/dev/null || true
+    chmod -R u=rwX,go=rX "$dest" 2>/dev/null || true
     rm -f "$pkg"
 
     write_status switching "$ver"