schmidt.florian
8fe5f4411b
ci / build-test (push) Successful in 1m16s
An audit of this session's commits found several real problems, three of which
lose or expose data. Ordered by severity.
Live recompute was not atomic. RecomputeMeterAsync clears a meter's series with
ExecuteDelete, which commits by itself when no transaction is ambient, and only
then adds the rebuilt rows. Between the two the meter had *no* consumption:
a dashboard read reported zero, and a crash or cancelled request made the loss
permanent, for data the SDD treats as the long-term source of truth (§5.5).
Import and the events API already wrapped their recomputes; live ingestion,
which I added this session, did not. Now shares one transaction, joining an
ambient one rather than nesting.
The MQTT backfill migration counted brokers without regard to is_enabled. One
live broker plus a disabled leftover counted two, declined to backfill, and left
those sources unbound — which under endpoint-scoped routing means silently and
permanently dead. The "two or more is ambiguous" reasoning did not hold there:
the worker only ever connected to enabled endpoints. Corrected by a follow-up
migration rather than an edit, since the original may already have run; it
touches only rows still NULL, so hand-made bindings are safe.
A mapping edited after a dry run committed the *old* staged rows under the
*new* mapping. Readings went to the previous meter while the batch recorded the
current mapping — wrong data, provenance contradicting it, no exception. The
earlier fix re-validated but did not detect staleness. Commit now compares the
mapping against the one the preview was staged under and refuses.
"Test connection" sent a stored token to whatever Base URL was in the dialog.
Encrypting secrets at rest means the UI can decrypt what the operator can no
longer read, so this turned the button into an exfiltration primitive: point it
at any host, the token arrives as a Bearer header. A stored token now only goes
to the origin it was saved for; testing elsewhere requires typing it again.
A source that cannot ingest looked identical to a healthy one. Endpoint-scoped
routing made unbound and mis-bound sources silently dead, while the Sources tab
showed no connector at all and the delete dialog still promised sources would be
"unlinked". Added a Connector column that names the fault, stopped offering
disabled connectors (both workers filter on IsEnabled), and made the delete
warning say ingestion stops.
Virtual meters rendered four zero tiles: they evaluate on read and only
materialize when a cost category references them (§14.1), so summing
consumption is a confident lie about a working meter. They now report nothing
and the page explains why.
Re-importing an overlapping file failed at the database with EF's "An error
occurred while saving the entity changes", naming neither meter nor date — the
diagnosis problem a3af483 set out to fix, via the path its guard could not see.
Checked up front now, bounded by each meter's staged range.
The LXC updater left the service stopped on any failure. set -e plus an
explicit stop means Restart=always does not apply, so an OOM-killed publish or
a brief Gitea outage took MeterVault down until someone noticed. An EXIT trap
restarts the previous build and says so.
Claude-Session: https://claude.ai/code/session_01V6joyergfvVLFEizH1hJLd
68 lines
3.0 KiB
Bash
68 lines
3.0 KiB
Bash
#!/usr/bin/env bash
|
|
# MeterVault in-container updater — installed to /usr/bin/update by metervault-install.sh.
|
|
# Pulls the latest source and rebuilds in place: no host round-trip and no re-fetch of the
|
|
# community-scripts framework (safer + simpler than re-running the ct script).
|
|
#
|
|
# Kept as a standalone file rather than a heredoc in the installer so an already-provisioned
|
|
# container can bootstrap it straight from its own checkout:
|
|
# git -C /opt/metervault-src fetch --depth 1 origin master
|
|
# git -C /opt/metervault-src reset --hard origin/master
|
|
# install -m 0755 /opt/metervault-src/deploy/install/metervault-update.sh /usr/bin/update
|
|
set -euo pipefail
|
|
|
|
: "${SOURCE_DIR:=/opt/metervault-src}"
|
|
: "${INSTALL_DIR:=/opt/metervault}"
|
|
: "${METERVAULT_BRANCH:=master}"
|
|
|
|
# SAFETY GUARD — this must run INSIDE the MeterVault LXC, never on the Proxmox host.
|
|
if ! systemd-detect-virt --container --quiet 2>/dev/null; then
|
|
echo "Run 'update' inside the MeterVault LXC, not on the Proxmox host." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -d "${SOURCE_DIR}/.git" ]]; then
|
|
echo "No source checkout at ${SOURCE_DIR} — cannot rebuild. Reinstall to restore it." >&2
|
|
exit 1
|
|
fi
|
|
|
|
export DOTNET_CLI_TELEMETRY_OPTOUT=1 DOTNET_NOLOGO=1
|
|
|
|
# Anything between the stop and the restart can fail under `set -e`: a dotnet publish OOM-killed in a
|
|
# small container, a Gitea outage mid-fetch, a transient compile error on master. systemd's
|
|
# Restart=always does not cover a unit stopped on purpose, so without this the service simply stays
|
|
# down until someone notices. Bring the old build back up and say what happened — a failed update
|
|
# should cost the new version, not the running one.
|
|
restore_service_on_failure() {
|
|
local code=$?
|
|
if [[ ${code} -ne 0 ]]; then
|
|
echo "Update failed (exit ${code}). Restarting the previous build…" >&2
|
|
systemctl start metervault || echo "Could not restart metervault — check 'systemctl status metervault'." >&2
|
|
fi
|
|
exit "${code}"
|
|
}
|
|
trap restore_service_on_failure EXIT
|
|
|
|
echo "Stopping metervault…"
|
|
systemctl stop metervault || true
|
|
|
|
echo "Pulling latest source…"
|
|
git -C "${SOURCE_DIR}" fetch --depth 1 origin "${METERVAULT_BRANCH}"
|
|
git -C "${SOURCE_DIR}" reset --hard "origin/${METERVAULT_BRANCH}"
|
|
|
|
echo "Rebuilding (dotnet publish — this can take a few minutes)…"
|
|
dotnet publish "${SOURCE_DIR}/src/App/MeterVault.App.csproj" -c Release -o "${INSTALL_DIR}" /p:UseAppHost=false
|
|
|
|
echo "Starting metervault…"
|
|
systemctl start metervault
|
|
|
|
# Refresh this script from the checkout we just pulled, so a change to the updater itself lands
|
|
# without stranding the container again. Atomic rename, never an in-place write: bash reads the
|
|
# running script lazily, so truncating it mid-run would corrupt the remainder of this execution.
|
|
self="${SOURCE_DIR}/deploy/install/metervault-update.sh"
|
|
if [[ -f "${self}" ]] && ! cmp -s "${self}" /usr/bin/update; then
|
|
install -m 0755 "${self}" /usr/bin/.update.new && mv /usr/bin/.update.new /usr/bin/update
|
|
echo "Updater itself refreshed — the new version applies from the next run."
|
|
fi
|
|
|
|
echo "MeterVault updated."
|