Auto updates for Gitea

[tboerger]

I would like to integrate an auto-updater for Gitea. This will only work for our prebuilt binaries and our Docker container of course, for everything else we are out of control and the admin is responsible for the update on his own.

The functionality should be added via an build flag so that the regular builds by admins don't get this functionality.

Options

I can think about various options how we can handle this functionality. Below is a list of the options i though about:

1. Provide a app.ini or CLI flag to opt-out from the update process, update the prebuilt binaries and docker containers automatically and do a graceful restart, optionally send a notification to the admins that an update have been applied
2. Provide a app.ini or CLI flag to opt-out from the update process, add a page to the admin view that shows the latest available version and add a button to trigger the upgrade and graceful restart, optionally send a notification to the admins that there is a new version available

Tools

A pretty mature library is already out there in the wild, I would suggest to use https://github.com/inconshreveable/go-update for this. For the hosting of the updates we got the option to use our CDN based https://dl.gitea.io page or the service https://equinox.io/ offered by @inconshreveable.

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[Bwko]

Why not add a setting to app.ini? That way you don't have to recompile the binary when you decide to turn on auto updates.

[joubertredrat]

this auto update will be for all installation options or only install by binary?

[tboerger]

Why not add a setting to app.ini? That way you don't have to recompile the binary when you decide to turn on auto updates.

Because the functionality will be only available for our pre-compiled binaries and our docker image. Everything else can be built totally different and is not in our control. On top of the build flag there will be a setting to opt-out from this process.

this auto update will be for all installation options or only install by binary?

We can provide it only for our pre-compiled binaries, you never know which build tags and so on another install got.

[Bwko]

@tboerger Fair point.
I prefer a third option: same behaviour as option 2 but with an option to automatically update when there's a security/critical (non breaking) update.

[bkcsoft]

We should probably start with a update-button in admin-view, that gives us basic functions like "Check version against server" (.sig-files as well 😉) and "Update". At a later stage we can add auto-checking and auto-updating, since most likely people will not want to auto-update.

In any case, Auto-Update should be opt-in 😒

[pgaskin]

What happens to the setcap permissions which I use to bind to port 80. When the binary is replaced, these needs to be set again, which needs root.

[tboerger]

What happens to the setcap permissions which I use to bind to port 80. When the binary is replaced, these needs to be set again, which needs root.

That's something that needs to be tested, but AFAIK it doesn't replace the entire binary, it's doing a binary diff and merge.

[lunny]

So let's implment #1101 at first and move this to 1.x.x