rover self updating!

pi/install_roverd.sh

@@ -6,6 +6,7 @@ set -euo pipefail
 
 BINARY_SRC="dist/roverd"
 CONFIG_SRC="pi/roverd/roverd.sample.yaml"
+REPO_ROOT="$(pwd -P)"
 
 usage() {
 	cat <<'USAGE'
@@ -22,6 +23,7 @@ The script must run from the repository root and as root (sudo). It will:
   * install /usr/local/bin/roverd and /etc/roverd.yaml
   * install /usr/local/bin/video/audio helpers and systemd units
   * install fixed-location Google Chrome TTS assets for roverd
+  * install the fixed-command self-update helper used by admin-triggered updates
   * enable roverd.service and media publisher/listener services
 USAGE
 }
@@ -131,6 +133,45 @@ ensure_user roverd "dialout,gpio,video,render,audio"
 install -o roverd -g roverd -m 0755 "$BINARY_SRC" /usr/local/bin/roverd
 log "Installed roverd binary"
 
+install_self_update_support() {
+	local sudoers_file="/etc/sudoers.d/roverd-self-update"
+	local update_env="/etc/roverd-update.env"
+	local quoted_repo_root
+
+	# The self-update helper must know which checkout should receive the git
+	# pull. Recording the repository root during the normal installer run keeps
+	# the runtime websocket command simple and prevents the rover from accepting
+	# a caller-controlled path.
+	printf -v quoted_repo_root '%q' "$REPO_ROOT"
+	install -D -o root -g root -m 0644 /dev/null "$update_env"
+	cat > "$update_env" <<ENV
+# Managed by pi/install_roverd.sh.
+# This path is intentionally captured from the installer working directory so
+# admin-triggered rover updates always operate on the same full repository that
+# was used for the manual install.
+ROVERD_REPO_DIR=$quoted_repo_root
+ENV
+	log "Registered roverd update repository at $REPO_ROOT"
+
+	# The helper is root-owned and argument-free. sudoers grants the roverd
+	# service user exactly this command and nothing broader, which is important
+	# because update requests arrive over the rover websocket.
+	install -D -o root -g root -m 0755 pi/bin/roverd-self-update.sh /usr/local/sbin/roverd-self-update
+	cat > "$sudoers_file" <<'SUDOERS'
+# Managed by pi/install_roverd.sh.
+# Allow only the roverd service account to run the fixed self-update helper.
+roverd ALL=(root) NOPASSWD: /usr/local/sbin/roverd-self-update
+SUDOERS
+	chown root:root "$sudoers_file"
+	chmod 0440 "$sudoers_file"
+	if command -v visudo >/dev/null 2>&1; then
+		visudo -cf "$sudoers_file" >/dev/null
+	fi
+	log "Installed roverd self-update helper and sudoers rule"
+}
+
+install_self_update_support
+
 CONFIG_DEST="/etc/roverd.yaml"
 CONFIG_EXISTS=0
 if [[ -f "$CONFIG_DEST" ]]; then