Update from hub: node self-update endpoint, hub push per machine / all, push-nodes CLI run by make deploy, outdated badges + Update buttons on Machines

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/nodes/nodes.go

@@ -16,6 +16,7 @@ import (
 	"net/http"
 	"net/http/httputil"
 	"net/url"
+	"os"
 	"regexp"
 	"sort"
 	"strings"
@@ -278,6 +279,94 @@ func (m *Manager) Remove(ctx context.Context, name string) error {
 	return err
 }
 
+// ---- update from hub ----
+
+type PushResult struct {
+	Name    string `json:"name"`
+	OK      bool   `json:"ok"`
+	Version string `json:"version,omitempty"`
+	Error   string `json:"error,omitempty"`
+}
+
+// Push uploads binPath (normally the hub's own executable) to the node's self-update
+// endpoint. The node verifies it, installs it and restarts itself. Refused when the
+// node's architecture differs from ours.
+func (m *Manager) Push(ctx context.Context, name, binPath, ourArch string) PushResult {
+	res := PushResult{Name: name}
+	n, ok := m.node(name)
+	if !ok {
+		res.Error = "no such machine"
+		return res
+	}
+	// arch check via /api/me
+	req, _ := http.NewRequestWithContext(ctx, "GET", n.URL+"/api/me", nil)
+	req.Header.Set("Authorization", "Bearer "+n.Token)
+	resp, err := m.client(n).Do(req)
+	if err != nil {
+		res.Error = "unreachable: " + shortErr(err)
+		return res
+	}
+	var me struct {
+		Arch    string `json:"arch"`
+		Version string `json:"version"`
+	}
+	_ = json.NewDecoder(io.LimitReader(resp.Body, 64<<10)).Decode(&me)
+	resp.Body.Close()
+	if me.Arch != "" && ourArch != "" && me.Arch != ourArch {
+		res.Error = fmt.Sprintf("architecture mismatch: node is %s, this binary is %s — build for it and deploy by hand", me.Arch, ourArch)
+		return res
+	}
+	f, err := os.Open(binPath)
+	if err != nil {
+		res.Error = err.Error()
+		return res
+	}
+	defer f.Close()
+	st, _ := f.Stat()
+	up, _ := http.NewRequestWithContext(ctx, "POST", n.URL+"/api/self-update", f)
+	up.ContentLength = st.Size()
+	up.Header.Set("Authorization", "Bearer "+n.Token)
+	up.Header.Set("Content-Type", "application/octet-stream")
+	c := &http.Client{Transport: transportFor(n), Timeout: 5 * time.Minute}
+	r2, err := c.Do(up)
+	if err != nil {
+		res.Error = "upload: " + shortErr(err)
+		return res
+	}
+	defer r2.Body.Close()
+	var reply struct {
+		Version string `json:"version"`
+		Error   string `json:"error"`
+	}
+	_ = json.NewDecoder(io.LimitReader(r2.Body, 64<<10)).Decode(&reply)
+	if r2.StatusCode != 200 {
+		if reply.Error == "" {
+			reply.Error = fmt.Sprintf("HTTP %d", r2.StatusCode)
+		}
+		res.Error = reply.Error
+		return res
+	}
+	res.OK, res.Version = true, reply.Version
+	return res
+}
+
+// PushAll updates every node, in parallel.
+func (m *Manager) PushAll(ctx context.Context, binPath, ourArch string) []PushResult {
+	var list []config.Node
+	m.cfg.View(func(c *config.Config) { list = append(list, c.Nodes...) })
+	out := make([]PushResult, len(list))
+	var wg sync.WaitGroup
+	for i, n := range list {
+		wg.Add(1)
+		go func(i int, name string) {
+			defer wg.Done()
+			out[i] = m.Push(ctx, name, binPath, ourArch)
+		}(i, n.Name)
+	}
+	wg.Wait()
+	return out
+}
+
 // ---- proxy ----
 
 // Proxy returns the handler for /api/nodes/<name>/<rest>: it rewrites to <node>/api/<rest>,