Changeset 12bed59 in Klonkt

Timestamp:

08/07/2026 04:14:49 PM (5 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

f85b2c3

Parents:

fa33214

git-author:

Robin <roboburr@…> (07/31/2026 02:52:19 PM)

git-committer:

Robin <roboburr@…> (08/07/2026 04:14:49 PM)

Message:

Zet de oude klonkt.service opzij; maskeren werkte niet

Correctie op f434294. Daar maskeerde ik de oude unit om te voorkomen dat een
systemctl restart klonkt hem uit de dood liet opstaan. Getest met een
user-unit blijkt dat niet te werken:

Failed to mask unit: File '.../masktest.service' already exists

systemctl mask legt een symlink naar /dev/null op het pad van de unit, maar
install.sh schrijft klonkt.service in /etc/systemd/system, de map met de
hoogste prioriteit. Er is dan geen plek meer om de mask neer te zetten en
systemd weigert. Na de mislukte mask start restart de unit gewoon nog
(exitcode 0), dus de fix deed niets.

Erger: die mask stond zonder vangnet onder set -euo pipefail. In het
migratiescript zou hij de migratie afbreken NADAT de data al verplaatst was.
De fix was dus niet alleen nutteloos maar ook gevaarlijk.

Wat wel werkt, en nu getest is in beide richtingen: het unit-bestand opzij
zetten met een tijdstempel en daemon-reload. systemd kent de unit dan niet
meer, en een restart faalt hard met "Unit klonkt.service not found"
(exitcode 5) in plaats van stilletjes een tweede proces te starten dat een
lege database in de checkout schrijft. Terugzetten plus daemon-reload maakt
hem weer gewoon startbaar, dus de rollback blijft intact.

Changed files:
scripts/klonkt-migrate-data.sh

• eigen stap 'Retiring klonkt.service': stop, disable, bestand naar klonkt.service.retired-<tijdstempel>, daemon-reload
• stop en disable krijgen een vangnet zodat een al gestopte unit de migratie niet afbreekt
• waarom maskeren hier niet kan, staat erbij; dat is niet vanzelfsprekend

scripts/klonkt-refresh-updater.sh

• zelfde aanpak voor al gemigreerde servers, met een expliciete waarschuwing als het verplaatsen niet lukt

deploy/MULTI-INSTANCE.md

• rollback bijgewerkt naar het terugzetten van het bestand

-robo
Co-Authored-By: Claude Fable 5 <noreply@…>

Files:

• deploy/MULTI-INSTANCE.md (modified) (1 diff)
• scripts/klonkt-migrate-data.sh (modified) (1 diff)
• scripts/klonkt-refresh-updater.sh (modified) (1 diff)

deploy/MULTI-INSTANCE.md

@@ -84 +84 @@
 because the port comes from the same `.env`.
 
-**Rolling back.** The old `klonkt.service` is disabled and masked, not deleted.
-Masked because `disable` alone does not stop `systemctl restart klonkt` from
-starting it again, and a resurrected unit no longer finds its `.env` (that moved
-with the data): it would fall back to the defaults and write a fresh empty
-database into the checkout. To go back, move the data into `/opt/klonkt/storage`,
-restore the relative paths in `.env`, then `systemctl unmask klonkt` and
-`systemctl enable --now klonkt`.
+**The old unit is moved aside, not deleted.** It ends up next to its old place
+as `klonkt.service.retired-<timestamp>`. Stopping and disabling is not enough:
+`systemctl restart klonkt` starts a disabled unit anyway, which is exactly what
+an updater generated before the split does. A resurrected `klonkt.service` no
+longer finds its `.env` (that moved with the data), falls back to the built-in
+defaults, and writes a fresh empty database into the checkout. Masking does not
+work here either, because the unit file sits in `/etc/systemd/system` and
+`systemctl mask` refuses while a real file is there.
+
+**Rolling back.** Move the data into `/opt/klonkt/storage`, restore the relative
+paths in `.env`, move the retired unit file back to
+`/etc/systemd/system/klonkt.service`, then:
+
+```bash
+sudo systemctl daemon-reload
+sudo systemctl enable --now klonkt
+```
 
 ## Adding an instance

scripts/klonkt-migrate-data.sh

@@ -128 +128 @@
 run "systemctl daemon-reload"
 
+step "Retiring $OLD_UNIT"
+# Stopping and disabling is NOT enough: `systemctl restart klonkt` starts a
+# disabled unit anyway, and that is exactly what an updater generated before
+# the split does. A resurrected klonkt.service no longer finds its .env (that
+# moved with the data), falls back to the built-in defaults, and writes a
+# FRESH EMPTY database into the checkout.
+#
+# Masking does not help either: the unit file lives in /etc/systemd/system,
+# the highest-priority directory, and `systemctl mask` refuses when a real
+# file is already there ("File ... already exists"). Verified, not assumed.
+#
+# So the file is moved aside. systemd then no longer knows the unit at all and
+# any restart fails loudly with "Unit klonkt.service not found". The file is
+# kept next to its old place, timestamped, so a rollback is a move back.
+if [ -f "/etc/systemd/system/$OLD_UNIT" ]; then
+  run "systemctl stop $OLD_UNIT 2>/dev/null || true"
+  run "systemctl disable $OLD_UNIT 2>/dev/null || true"
+  RETIRED="/etc/systemd/system/${OLD_UNIT}.retired-$(date +%Y%m%d%H%M%S)"
+  run "mv '/etc/systemd/system/$OLD_UNIT' '$RETIRED'"
+  run "systemctl daemon-reload"
+  say "stopped, disabled and moved aside → $RETIRED"
+  say "roll back by moving that file back and running: systemctl daemon-reload"
+else
+  say "no $OLD_UNIT unit file to retire"
+fi
+
 step "Switching to klonkt@$SLUG"
-if systemctl list-unit-files "$OLD_UNIT" >/dev/null 2>&1; then
-  run "systemctl disable --now $OLD_UNIT"
-  # Disable only removes the autostart link: `systemctl restart klonkt` would
-  # still START it. That is not theoretical — an updater generated before the
-  # split does exactly that, and the resurrected unit finds no .env (it moved
-  # with the data), falls back to the built-in defaults and creates a FRESH
-  # EMPTY database in the checkout. Masking makes any such call fail loudly.
-  # Reversible: systemctl unmask klonkt.
-  run "systemctl mask $OLD_UNIT"
-  say "disabled and masked $OLD_UNIT (unmask to roll back)"
-fi
 run "systemctl enable --now 'klonkt@$SLUG'"
 

scripts/klonkt-refresh-updater.sh

@@ -59 +59 @@
 echo "klonkt-update rewritten: branch ${BRANCH}, code ${KLONKT_DIR}, instances under ${DATA_ROOT}"
 
-# On a split install the old single unit must not be startable. `disable` alone
-# does not stop `systemctl restart klonkt` from starting it, and a resurrected
-# klonkt.service has no .env (it moved with the data): it falls back to the
-# defaults and writes a fresh empty database into the checkout.
+# On a split install the old single unit must not be startable at all.
+# `disable` is not enough (restart starts a disabled unit anyway) and `mask`
+# refuses while the real file sits in /etc/systemd/system, the highest-priority
+# directory. Moving the file aside is what actually works: systemd stops
+# knowing the unit, so any restart fails loudly instead of quietly starting a
+# second process that writes an empty database into the checkout.
 SPLIT=0
 for d in "${DATA_ROOT}"/*/; do [ -f "$d/.env" ] && SPLIT=1 && break; done
-if [ "$SPLIT" = 1 ] && systemctl list-unit-files klonkt.service >/dev/null 2>&1; then
-  if ! systemctl is-enabled klonkt.service 2>/dev/null | grep -q masked; then
-    systemctl stop klonkt.service 2>/dev/null || true
-    systemctl disable klonkt.service 2>/dev/null || true
-    systemctl mask klonkt.service
-    echo "retired klonkt.service: stopped, disabled and masked (unmask to roll back)"
+if [ "$SPLIT" = 1 ] && [ -f /etc/systemd/system/klonkt.service ]; then
+  systemctl stop klonkt.service 2>/dev/null || true
+  systemctl disable klonkt.service 2>/dev/null || true
+  RETIRED="/etc/systemd/system/klonkt.service.retired-$(date +%Y%m%d%H%M%S)"
+  if mv /etc/systemd/system/klonkt.service "$RETIRED"; then
+    systemctl daemon-reload
+    echo "retired klonkt.service → $RETIRED (move it back + daemon-reload to roll back)"
+  else
+    echo "WARNING: could not move /etc/systemd/system/klonkt.service aside."
+    echo "         Until you do, any 'systemctl restart klonkt' starts a second"
+    echo "         process that writes an empty database into ${KLONKT_DIR}."
   fi
 fi