feat: split update config into update.env

scripts/enroll_update_service.sh

@@ -2,6 +2,7 @@
 set -euo pipefail
 
 ENV_FILE="${ENV_FILE:-/etc/skd/env}"
+UPDATE_ENV_FILE="${UPDATE_ENV_FILE:-/etc/skd/update.env}"
 SERVICE_URL="${SKD_UPDATE_SERVICE_URL:-}"
 PROJECT_ID="${SKD_UPDATE_PROJECT_ID:-}"
 TOKEN_FILE="${SKD_UPDATE_TOKEN_FILE:-}"
@@ -20,7 +21,8 @@ Options:
   --client-id ID        Client ID (default: hostname)
   --software-id ID      Software ID (default: safe-kiddo)
   --output PATH         Write token to PATH (default: SKD_UPDATE_TOKEN_FILE if set)
-  --env-file PATH       Read env file (default: /etc/skd/env)
+  --env-file PATH       Read core env file (default: /etc/skd/env)
+  --update-env PATH     Read update env file (default: /etc/skd/update.env)
   -h, --help            Show this help
 EOF
 }
@@ -34,6 +36,7 @@ while [[ $# -gt 0 ]]; do
     --enroll-token) ENROLL_TOKEN="$2"; shift 2 ;;
     --output) OUTPUT_PATH="$2"; shift 2 ;;
     --env-file) ENV_FILE="$2"; shift 2 ;;
+    --update-env) UPDATE_ENV_FILE="$2"; shift 2 ;;
     -h|--help) usage; exit 0 ;;
     *) echo "Unknown option: $1" >&2; usage; exit 1 ;;
   esac
@@ -41,26 +44,26 @@ done
 
 read_env_value() {
   local key="$1"
-  python3 - <<'PY' "${ENV_FILE}" "${key}"
+  python3 - <<'PY' "${ENV_FILE}" "${UPDATE_ENV_FILE}" "${key}"
 from pathlib import Path
 import sys
 
-path = Path(sys.argv[1])
-key = sys.argv[2]
-if not path.exists():
-    sys.exit(0)
-
-for raw in path.read_text(encoding="utf-8").splitlines():
-    line = raw.strip()
-    if not line or line.startswith("#"):
+env_paths = [Path(sys.argv[1]), Path(sys.argv[2])]
+key = sys.argv[3]
+for path in env_paths:
+    if not path.exists():
         continue
-    if not line.startswith(f"{key}="):
-        continue
-    value = line.split("=", 1)[1].strip()
-    if (value.startswith('"') and value.endswith('"')) or (value.startswith("'") and value.endswith("'")):
-        value = value[1:-1]
-    print(value)
-    sys.exit(0)
+    for raw in path.read_text(encoding="utf-8").splitlines():
+        line = raw.strip()
+        if not line or line.startswith("#"):
+            continue
+        if not line.startswith(f"{key}="):
+            continue
+        value = line.split("=", 1)[1].strip()
+        if (value.startswith('"') and value.endswith('"')) or (value.startswith("'") and value.endswith("'")):
+            value = value[1:-1]
+        print(value)
+        sys.exit(0)
 PY
 }
 

scripts/install.sh

@@ -10,6 +10,7 @@ SERVICE_GROUP="${SERVICE_GROUP:-$SERVICE_USER}"
 INSTALL_DIR="${INSTALL_DIR:-/opt/sk}"
 ENV_DIR="/etc/${SERVICE_NAME}"
 ENV_FILE="${ENV_DIR}/env"
+UPDATE_ENV_FILE="${ENV_DIR}/update.env"
 SYSTEMD_PATH="/etc/systemd/system/${SERVICE_NAME}.service"
 
 log() {
@@ -56,6 +57,18 @@ if [[ ! -f "${ENV_FILE}" ]]; then
   sudo chown root:"${SERVICE_GROUP}" "${ENV_FILE}"
 fi
 
+if [[ ! -f "${UPDATE_ENV_FILE}" ]]; then
+  if [[ -f "${SOURCE_DIR}/env.update.example" ]]; then
+    sudo cp "${SOURCE_DIR}/env.update.example" "${UPDATE_ENV_FILE}"
+    log "Copied env.update.example to ${UPDATE_ENV_FILE}; edit update service variables."
+  else
+    sudo touch "${UPDATE_ENV_FILE}"
+    log "Created empty ${UPDATE_ENV_FILE}; populate update variables."
+  fi
+  sudo chmod 640 "${UPDATE_ENV_FILE}"
+  sudo chown root:"${SERVICE_GROUP}" "${UPDATE_ENV_FILE}"
+fi
+
 is_debian_like() {
   if [[ ! -r /etc/os-release ]]; then
     return 1
@@ -113,6 +126,7 @@ User=root
 Group=root
 WorkingDirectory=${INSTALL_DIR}
 EnvironmentFile=${ENV_FILE}
+EnvironmentFile=-${UPDATE_ENV_FILE}
 ExecStart=${INSTALL_DIR}/.venv/bin/uvicorn backend.app:app --host 0.0.0.0 --port 80
 Restart=on-failure
 RestartSec=3