Release Version 5.0.14 · cipi-sh/cipi

[5.0.14] — 2026-08-06

cipi self-update / cipi api update hung forever on panel API package update — bare ssh-keyscan github.com (no timeout) blocked before Composer, and VCS composer update had no wall-clock limit (stderr was often discarded). Now: timed keyscan + official GitHub host-key fallback, Composer guard (timeout + COMPOSER_PROCESS_TIMEOUT), timed queue stop/migrate, and cipi api update updates cipi/api only (full rebuild remains cipi api upgrade). Self-update delegates to _api_update_package / _gui_update_package so the first upgrade pass already gets the fix.
systemctl list-unit-files --quiet UNIT is not an existence check — it exits 0 even when zero units match, so PostgreSQL (and optional PHP-FPM units) could be treated as present. Detection now uses systemctl cat via systemd_unit_exists for DB engines and cipi service.
cipi db engines — prints ASCII not_installed instead of an em dash, so API/GUI parsers cannot mis-read the status column.

cipi self-update aborted with _cipi_composer_prepare_github: command not found and left the panel on HTTP 500 — upgrading from older builds (e.g. v5.0.2) kept the pre-update self-update/common.sh helpers in memory while sourcing the new gui.sh, which called a helper that did not exist yet. After the blanket chown -R root:root /opt/cipi, GUI .env / storage stayed root-owned and PHP-FPM returned 500. lib/gui.sh now has the same inline fallback as the API (_gui_composer_prepare_github), ensure_cipi_gui_permissions also restores .env ownership, and self-update always reclaims panel permissions at the end even if the Composer step fails. Migration 5.0.13 reclaims API/GUI ownership on update.

cipi php switch could leave the panel on nginx 502 — it now rewrites the API and (when installed) GUI FPM pools onto the target PHP (listen = /run/php/cipi-api.sock / cipi-gui.sock), removes them from other versions, stops the old FPM to release the socks, recreates /run/php + both sockets via the new php*-fpm, waits until they exist, and rolls back both pools if either socket never appears.

cipi php switch failed with unable to remove '/etc/alternatives/php.dpkg-tmp': Read-only file system — same remount-ro class as SMTP/basicauth/vault. Switch now remounts ///etc writable before update-alternatives, clears stale *.dpkg-tmp leftovers, retries once on RO errors, and prints an actionable recovery hint.

cipi php switch false failure after a successful CLI switch — update-alternatives --set php often prints using /usr/bin/phpX.Y … then exits non-zero when a slave alternative (phar/phpdbg/…) is missing or broken. The panel API treated that as hard failure even though /usr/bin/php already pointed at the new version. Switch now verifies the resolved binary and continues when the master link is correct. Re-running switch when CLI is already on the target version still migrates a leftover API FPM pool.

Panel API PUT /api/php/default failed with sudo: a terminal is required to read the password — /etc/sudoers.d/cipi-api allowed php list|install|remove but not php switch, so www-data could not set the system default PHP without a TTY. Added cipi php switch * to the whitelist. Migration 5.0.9 regenerates sudoers on cipi self-update.

Panel API cipi/api updates — cipi self-update / cipi api update now pull cipi/api from GitHub via Composer VCS when no bundled /opt/cipi/cipi-api copy exists (same model as cipi/gui). Only runs if the panel API is already installed (/opt/cipi/api/artisan); it never installs the API on servers that do not use it. Fixes servers stuck on Packagist while GitHub already has 1.16+.
Non-interactive CLI flags — parse_args strips wrapping quotes from --key='value' arguments built by the panel API (escapeshellarg), so cipi smtp configure --host=… and similar commands receive clean values.
Migration 5.0.8 — reduced to a noop (the previous script duplicated self-update and could abort with ensure_cipi_api_permissions: command not found).
ssh_dir: unbound variable during self-update — _cipi_composer_prepare_github / _api_composer_prepare_github used local ssh_dir=… kh="${ssh_dir}/…", which under set -u expands ssh_dir before it is assigned and aborted the API/GUI composer step.