Release 1.2.0

- daynivo-config.json, daynivo-authorized_keys and daynivo-network-reset
  on the boot partition; errors go to daynivo-config.error.txt.
- daynivo-kiosk-ctl, with voxip-kiosk-ctl as a symlink to it.
- The voxip-* names keep working, so existing SD cards and instructions
  stay valid; when both config files are present the Daynivo one is
  applied last.
- Internal names (services, /etc/voxip-kiosk, user voxip) are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -1,8 +1,11 @@
 name: CI
 
+# Only pushes to this repository, no pull_request: the runner allows privileged
+# containers, and a pull request from a fork could otherwise run its own
+# workflow with root access on the runner machine.
 on:
   push:
-  pull_request:
+    branches: ["**"]
 
 jobs:
   test-bookworm:
@@ -10,16 +13,20 @@ jobs:
     runs-on: ubuntu-latest
     container: debian:bookworm
     steps:
-      - uses: actions/checkout@v4
       - name: Install Debian packages
         run: |
           apt-get update
           DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-            python3 python3-flask python3-argon2 python3-websocket python3-pytest shellcheck
+            ca-certificates git python3 python3-flask python3-argon2 python3-websocket python3-pytest shellcheck
+      - name: Checkout
+        # Plain git: JavaScript actions need Node, which debian:bookworm doesn't have.
+        run: |
+          git clone "${{ github.server_url }}/${{ github.repository }}.git" .
+          git checkout "${{ github.sha }}"
       - name: Tests
         run: python3 -m pytest -p no:cacheprovider
       - name: Shellcheck
-        run: shellcheck -S warning install.sh update.sh uninstall.sh image/build.sh image/stage-voxip/prerun.sh image/stage-voxip/00-voxip/00-run.sh bin/voxip-kiosk-x
+        run: shellcheck -S warning install.sh install-online.sh update.sh uninstall.sh tools/release-upload.sh image/build.sh image/stage-voxip/prerun.sh image/stage-voxip/00-voxip/00-run.sh bin/voxip-kiosk-x
 
   test-latest:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -0,0 +1,77 @@
+# Gitea Actions: a tag vX.Y.Z (matching VERSION) becomes a release with
+#   daynivo-kiosk-os-X.Y.Z.tar.gz (+ .sha256)   installed by install-online.sh and the updater
+#   install-online.sh                            the one-line installer
+#   <date>-daynivo-kiosk-os-X.Y.Z.img.xz (+ .sha256), built afterwards (30–90+ minutes)
+#
+# Runner requirements: act_runner with the "ubuntu-latest" label, and for the
+# image job `container.privileged: true` in its config (pi-gen needs loop
+# devices and binfmt_misc). A secret RELEASE_TOKEN (repository write access)
+# is used when set, otherwise the job's own token.
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+env:
+  GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+  GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITEA_TOKEN }}
+
+jobs:
+  package:
+    runs-on: ubuntu-latest
+    container: debian:bookworm
+    steps:
+      - name: Tools
+        run: |
+          apt-get update
+          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+            ca-certificates curl git python3 python3-flask python3-argon2 python3-websocket python3-pytest shellcheck
+      - name: Checkout
+        # Plain git: JavaScript actions need Node, which debian:bookworm doesn't have.
+        run: git clone --depth 1 --branch "${{ github.ref_name }}" "${{ github.server_url }}/${{ github.repository }}.git" src
+      - name: Tag matches VERSION
+        working-directory: src
+        run: test "v$(tr -d '[:space:]' < VERSION)" = "${{ github.ref_name }}"
+      - name: Tests
+        working-directory: src
+        run: |
+          python3 -m pytest -q -p no:cacheprovider
+          shellcheck -S warning install.sh install-online.sh update.sh uninstall.sh tools/release-upload.sh image/build.sh
+      - name: Package
+        working-directory: src
+        run: |
+          V="$(tr -d '[:space:]' < VERSION)"
+          mkdir -p ../dist
+          git archive --prefix="daynivo-kiosk-os-$V/" -o "../dist/daynivo-kiosk-os-$V.tar.gz" HEAD
+          (cd ../dist && sha256sum "daynivo-kiosk-os-$V.tar.gz" > "daynivo-kiosk-os-$V.tar.gz.sha256")
+          cp install-online.sh ../dist/
+      - name: Publish
+        run: src/tools/release-upload.sh "${{ github.ref_name }}" dist/*
+
+  image:
+    needs: package
+    runs-on: ubuntu-latest
+    container:
+      image: debian:bookworm
+      options: --privileged
+    timeout-minutes: 360
+    steps:
+      - name: Tools (pi-gen)
+        run: |
+          apt-get update
+          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+            ca-certificates curl git python3 openssl coreutils quilt parted qemu-user-static binfmt-support \
+            debootstrap zerofree zip dosfstools libarchive-tools libcap2-bin grep rsync xz-utils file bc gpg \
+            pigz xxd arch-test bmap-tools kmod fdisk udev
+      - name: Enable ARM emulation
+        run: |
+          mountpoint -q /proc/sys/fs/binfmt_misc || mount -t binfmt_misc binfmt_misc /proc/sys/fs/binfmt_misc
+          update-binfmts --enable qemu-arm
+      - name: Checkout
+        run: git clone --depth 1 --branch "${{ github.ref_name }}" "${{ github.server_url }}/${{ github.repository }}.git" src
+      - name: Build image
+        working-directory: src
+        run: ./image/build.sh --native
+      - name: Publish
+        run: src/tools/release-upload.sh "${{ github.ref_name }}" src/image/deploy/*.img.xz src/image/deploy/*.img.xz.sha256

Makefile

@@ -22,7 +22,7 @@ test-bookworm:
 		apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
 		python3 python3-flask python3-argon2 python3-websocket python3-pytest shellcheck >/dev/null && \
 		cp -r /src /work && cd /work && rm -rf .venv && python3 -m pytest -p no:cacheprovider && \
-		shellcheck -S warning install.sh update.sh uninstall.sh image/build.sh bin/voxip-kiosk-x'
+		shellcheck -S warning install.sh install-online.sh update.sh uninstall.sh tools/release-upload.sh image/build.sh bin/voxip-kiosk-x'
 
 # Web interface on http://127.0.0.1:8080 with throwaway state in .dev/ (system actions fail gracefully).
 dev:

README.md

@@ -23,14 +23,15 @@ hardware staat in [`docs/HARDWARE-TEST.md`](docs/HARDWARE-TEST.md).
 
 ### Optie A — kant-en-klare image
 
-1. Bouw de image (zie hieronder) of gebruik een uitgebrachte
+1. Download de nieuwste `*-daynivo-kiosk-os-*.img.xz` bij de
-   `*-daynivo-kiosk-os-*.img.xz`.
+   [releases](https://git.rothman.nl/rothman/daynivo-kiosk-os/releases),
+   of bouw hem zelf (zie hieronder).
 2. Schrijf hem met **Raspberry Pi Imager** (*Eigen image gebruiken*) of
    **balenaEtcher** naar een microSD-kaart van 16 GB of groter.
 3. Optioneel, in Raspberry Pi Imager → *OS-aanpassingen*: wifi, gebruiker
    met wachtwoord en/of SSH-sleutel, tijdzone. Zonder aanpassingen heeft de
    image **geen** bruikbaar wachtwoord en staat SSH uit.
-4. Optioneel: zet een `voxip-config.json` op de bootpartitie (zie
+4. Optioneel: zet een `daynivo-config.json` op de bootpartitie (zie
    [Uitrol bij meerdere klanten](#uitrol-bij-meerdere-klanten)).
 5. Start de Pi. Bij de eerste boot wordt de rootpartitie automatisch
    vergroot tot de hele SD-kaart. Daarna verschijnt een setupscherm met de
@@ -44,8 +45,17 @@ Vereist: Raspberry Pi OS Lite Bookworm of Trixie met NetworkManager (de
 standaard sinds Bookworm).
 
 ```bash
-sudo apt-get install -y git
+curl -fsSL https://daynivo.nl/kiosk/install.sh | sudo bash -s -- \
-git clone <url-van-deze-repository> daynivo-kiosk-os
+  --url "https://schermen-ijsselflat.voxip.nl" --name "IJsselflat" --hostname ijsselflat
+```
+
+`install-online.sh` (dat is wat daynivo.nl serveert, en het hangt ook bij
+elke release) haalt de nieuwste release op, controleert de SHA-256, pakt hem
+uit in `/opt/daynivo-kiosk-os/<versie>` en draait daar `install.sh`. Git is
+niet nodig. Vanuit een clone kan het ook:
+
+```bash
+git clone https://git.rothman.nl/rothman/daynivo-kiosk-os.git
 cd daynivo-kiosk-os
 sudo ./install.sh --url "https://schermen-ijsselflat.voxip.nl" --name "IJsselflat" --hostname ijsselflat
 ```
@@ -60,6 +70,23 @@ de Daynivo-repository)? Dan neemt `install.sh` de display-URL (inclusief
 
 ### Updaten
 
+In de webinterface onder **Systeem → Software-updates**: *Nu controleren*,
+*Bijwerken naar …*, en het vinkje **Automatisch bijwerken**. Elke nacht
+tussen 03:00 en 05:00 (`voxip-kiosk-update.timer`) kijkt de kiosk of er een
+nieuwe release is; met het vinkje aan installeert hij die meteen. Dat werkt
+ook op een apparaat dat met de image of vanuit een clone is geïnstalleerd.
+Vanaf de commandoregel:
+
+```bash
+sudo /usr/lib/voxip-kiosk/voxip-kiosk-updater --check     # alleen kijken
+sudo /usr/lib/voxip-kiosk/voxip-kiosk-updater --install   # nieuwste release installeren
+```
+
+De updater installeert alleen een nieuwere versie met een kloppende
+checksum, pakt hem uit in `/opt/daynivo-kiosk-os/<versie>` (de laatste twee
+blijven bewaard) en draait daar `update.sh --no-pull`. Vanuit een clone kan
+het ook met git:
+
 ```bash
 cd daynivo-kiosk-os
 sudo ./update.sh          # git pull --ff-only + back-up van /etc/voxip-kiosk + install.sh --upgrade
@@ -117,6 +144,34 @@ bouwen zijn. Er bestaat geen snapshot-archief voor Raspberry Pi OS, dus
 twee builds op verschillende dagen kunnen nieuwere pakketversies bevatten.
 Bewaar voor een uitrol daarom de gebouwde `.img.xz` zelf.
 
+## Releases
+
+Een release maak je door `VERSION` te verhogen, te committen en een tag met
+hetzelfde nummer te pushen:
+
+```bash
+echo 1.2.0 > VERSION && git commit -am "Release 1.2.0"
+git tag v1.2.0 && git push && git push origin v1.2.0
+```
+
+Gitea Actions (`.github/workflows/release.yml`) draait dan de tests en maakt
+een release met `daynivo-kiosk-os-<versie>.tar.gz` (+ `.sha256`) en
+`install-online.sh`. Daarna bouwt dezelfde workflow het SD-image en hangt het
+`.img.xz` (+ `.sha256`) aan dezelfde release; dat duurt 30 tot 90 minuten of
+langer. Zodra de tar-bestanden er staan, zien de kiosks de nieuwe versie.
+
+Vereist op de Gitea-server:
+
+- een **act_runner** met het label `ubuntu-latest`;
+- voor het image: `container.privileged: true` in de runnerconfiguratie
+  (pi-gen heeft loop-devices en binfmt_misc nodig) en genoeg schijfruimte
+  (± 15 GB tijdens het bouwen);
+- de maximale bijlagegrootte (`[attachment] MAX_SIZE` in `app.ini`, in MB)
+  groter dan het image (± 1 GB);
+- optioneel een repository-secret `RELEASE_TOKEN` (token met schrijfrecht op
+  de repository), als het standaardtoken van de workflow geen releases mag
+  maken.
+
 ## Beheer
 
 ### Webinterface — `http://<hostname>.local:8080`
@@ -136,14 +191,14 @@ browser blijft draaien. *Chromium herstarten* herstart alleen de browser.
 ### Commandoregel (via SSH)
 
 ```bash
-sudo voxip-kiosk-ctl status              # overzicht
+sudo daynivo-kiosk-ctl status              # overzicht
-sudo voxip-kiosk-ctl setup-code          # setupcode voor de eerste configuratie
+sudo daynivo-kiosk-ctl setup-code          # setupcode voor de eerste configuratie
-sudo voxip-kiosk-ctl reset-password      # wachtwoord vergeten: nieuwe setupcode
+sudo daynivo-kiosk-ctl reset-password      # wachtwoord vergeten: nieuwe setupcode
-sudo voxip-kiosk-ctl set-url https://…   # URL wijzigen
+sudo daynivo-kiosk-ctl set-url https://…   # URL wijzigen
-sudo voxip-kiosk-ctl reload              # pagina herladen
+sudo daynivo-kiosk-ctl reload              # pagina herladen
-sudo voxip-kiosk-ctl restart-browser     # Chromium herstarten
+sudo daynivo-kiosk-ctl restart-browser     # Chromium herstarten
-sudo voxip-kiosk-ctl health              # healthcheck-rapport
+sudo daynivo-kiosk-ctl health              # healthcheck-rapport
-sudo voxip-kiosk-ctl maintenance on|off  # healthcheck tijdelijk niets laten herstellen
+sudo daynivo-kiosk-ctl maintenance on|off  # healthcheck tijdelijk niets laten herstellen
 journalctl -u voxip-kiosk-browser -u voxip-kiosk-agent -f
 ```
 
@@ -164,8 +219,9 @@ journalctl -u voxip-kiosk-browser -u voxip-kiosk-agent -f
 | `admin_port` | `8080` | poort van de beheerinterface |
 | `admin_https` | `false` | HTTPS met zelfondertekend certificaat |
 | `admin_allow_public` | `false` | ook toegang vanaf publieke IP-adressen (afgeraden) |
+| `auto_update` | `false` | elke nacht een nieuwe release installeren |
 
-Wijzigingen via de webinterface of `voxip-kiosk-ctl` worden atomair
+Wijzigingen via de webinterface of `daynivo-kiosk-ctl` worden atomair
 opgeslagen, met een `.bak` van de vorige versie. Een URL-wijziging gaat in
 zonder dat Chromium herstart. Scherminstellingen gelden na een herstart van
 Chromium (een vinkje in de webinterface doet dat direct).
@@ -175,15 +231,15 @@ Chromium (een vinkje in de webinterface doet dat direct).
 Eén image voor alle klanten. Per apparaat zet je na het flashen op de
 bootpartitie (`bootfs`, zichtbaar op Windows en macOS):
 
-- **`voxip-config.json`**: instellingen voor deze kiosk, plus optioneel
+- **`daynivo-config.json`**: instellingen voor deze kiosk, plus optioneel
   `hostname` en `wifi_country`. Een voorbeeld staat als
-  `voxip-config.example.json` op de bootpartitie.
+  `daynivo-config.example.json` op de bootpartitie.
-- **`voxip-authorized_keys`**: openbare SSH-sleutels. SSH gaat dan aan, alleen
+- **`daynivo-authorized_keys`**: openbare SSH-sleutels. SSH gaat dan aan, alleen
   met sleutel-login.
 - Wifi en een eigen gebruiker stel je in via Raspberry Pi Imager.
 
 De bestanden worden bij het opstarten verwerkt en hernoemd naar
-`*.applied`, of naar `*.rejected` met de reden in `voxip-config.error.txt`.
+`*.applied`, of naar `*.rejected` met de reden in `daynivo-config.error.txt`.
 
 ### Daynivo-schermen
 
@@ -214,8 +270,8 @@ make dev    # http://127.0.0.1:8080 met tijdelijke mappen in .dev/
 
 | Symptoom | Oplossing |
 |---|---|
-| Zwart scherm na opstarten | `sudo voxip-kiosk-ctl status`. Kijk in de journal van `voxip-kiosk-x`/`voxip-kiosk-browser`. Staat de monitor aan vóór de Pi? |
+| Zwart scherm na opstarten | `sudo daynivo-kiosk-ctl status`. Kijk in de journal van `voxip-kiosk-x`/`voxip-kiosk-browser`. Staat de monitor aan vóór de Pi? |
-| Beheerinterface onbereikbaar na netwerkwijziging | Wacht 3 minuten (automatische rollback) of zet `voxip-network-reset` op de bootpartitie en herstart. |
+| Beheerinterface onbereikbaar na netwerkwijziging | Wacht 3 minuten (automatische rollback) of zet `daynivo-network-reset` op de bootpartitie en herstart. |
-| Wachtwoord vergeten | `sudo voxip-kiosk-ctl reset-password` via SSH, of verwijder `/etc/voxip-kiosk/admin.json` met de SD-kaart in een Linux-pc. |
+| Wachtwoord vergeten | `sudo daynivo-kiosk-ctl reset-password` via SSH, of verwijder `/etc/voxip-kiosk/admin.json` met de SD-kaart in een Linux-pc. |
 | `kiosk.local` werkt niet | Gebruik het IP-adres (staat op het setupscherm en in je router). Windows heeft soms Bonjour/mDNS nodig. Geef iedere kiosk een unieke hostname. |
 | Onderspanning in het dashboard | Gebruik de officiële 5,1 V/2,5 A-voeding. Onderspanning veroorzaakt crashes en SD-kaartcorruptie. |

VERSION

@@ -1 +1 @@
-1.0.0
+1.2.0

bin/voxip-kiosk-updater

@@ -0,0 +1,9 @@
+#!/usr/bin/python3 -I
+# Installed to /usr/lib/voxip-kiosk/ by install.sh. -I: ignore PYTHON* env and user site-packages.
+import sys
+
+sys.path.insert(0, "/usr/lib/voxip-kiosk/python")
+
+from voxip_kiosk.updater import main  # noqa: E402
+
+sys.exit(main())

config/config.default.json

@@ -11,5 +11,6 @@
   "browser_profile": "persistent",
   "admin_port": 8080,
   "admin_https": false,
-  "admin_allow_public": false
+  "admin_allow_public": false,
+  "auto_update": false
 }

docs/ARCHITECTURE.md

@@ -12,7 +12,7 @@ samenwerken en waarom bepaalde keuzes zijn gemaakt.
 - Lokale webbeheerinterface (*Daynivo Kiosk Manager*) op poort 8080.
 - Geen klantspecifieke code: alles wat per klant verschilt staat in
   `/etc/voxip-kiosk/config.json` en kan bij uitrol via de bootpartitie
-  worden meegegeven (`voxip-config.json`).
+  worden meegegeven (`daynivo-config.json`).
 
 ## Overzicht
 
@@ -50,7 +50,8 @@ samenwerken en waarom bepaalde keuzes zijn gemaakt.
 | `voxip-kiosk-browser` | `kiosk` | Past rotatie/resolutie/DPMS toe (xrandr/xset), ruimt een vastgelopen profiel op en start Chromium. |
 | `voxip-kiosk-agent` | `kiosk` | Bestuurt Chromium via het DevTools Protocol op localhost: offline-pagina, URL-wissel zonder herstart, periodiek verversen, hang-detectie. |
 | `voxip-kiosk-manager` | `voxip` | Flask-webinterface (gunicorn, 1 worker, 4 threads). |
-| `voxip-kiosk-helper` | `root` (via sudo) | Enige geprivilegieerde ingang: reboot, uitschakelen, Chromium herstarten, hostname, wifi-land, wifi-scan, netwerkconfiguratie + rollback. |
+| `voxip-kiosk-helper` | `root` (via sudo) | Enige geprivilegieerde ingang: reboot, uitschakelen, Chromium herstarten, hostname, wifi-land, wifi-scan, netwerkconfiguratie + rollback, updates controleren en starten. |
+| `voxip-kiosk-updater` | `root` (timer, of eigen transient unit via de helper) | Haalt de nieuwste release op (HTTPS, SHA-256), pakt hem uit in `/opt/daynivo-kiosk-os/<versie>` en draait `update.sh --no-pull`. Nooit een oudere of gelijke versie. |
 | `voxip-kiosk-healthcheck` | `root` | Bewaakt alle services en herstelt ze, met logging. |
 
 De webinterface draait **nooit** als root. De sudoers-regel staat
@@ -103,7 +104,7 @@ Zolang er geen beheerderswachtwoord is:
    adressen van de beheerinterface;
 3. kan een wachtwoord alleen ingesteld worden met die code.
 
-Wie fysiek bij het scherm staat (of via SSH `voxip-kiosk-ctl setup-code`
+Wie fysiek bij het scherm staat (of via SSH `daynivo-kiosk-ctl setup-code`
 draait) kan het apparaat dus claimen, iemand anders op het netwerk niet.
 
 ### Netwerkwijzigingen met rollback
@@ -118,7 +119,7 @@ draait) kan het apparaat dus claimen, iemand anders op het netwerk niet.
 5. Valt de stroom uit tijdens die periode, dan zet
    `voxip-network-guard.service` de snapshot terug bij het opstarten, nog
    vóór NetworkManager start.
-6. Noodherstel: een leeg bestand `voxip-network-reset` op de bootpartitie
+6. Noodherstel: een leeg bestand `daynivo-network-reset` op de bootpartitie
    verwijdert bij de volgende boot alle Daynivo-netwerkprofielen (terug naar
    DHCP).
 
@@ -130,8 +131,11 @@ draait) kan het apparaat dus claimen, iemand anders op het netwerk niet.
   bij het laden terug op de standaard, zodat de kiosk altijd start.
   Onbekende sleutels blijven bewaard (vooruit-/achteruitcompatibel).
 - `/etc/voxip-kiosk/admin.json`: Argon2id-hash, 0600, alleen `voxip`.
-- Updates (`install.sh --upgrade` / `update.sh`) overschrijven nooit
+- Updates (`install.sh --upgrade` / `update.sh` / de updater) overschrijven
-  bestaande configuratie.
+  nooit bestaande configuratie. De updater draait in een eigen systemd-unit,
+  zodat het herstarten van de beheerinterface tijdens `install.sh` de update
+  niet afbreekt. De checksum komt van dezelfde server als de download: hij
+  vangt een kapotte download af, geen gehackte releaseserver.
 
 ### Betrouwbaarheid (24/7)
 
@@ -161,7 +165,7 @@ draait) kan het apparaat dus claimen, iemand anders op het netwerk niet.
   (toegestaan: privé, link-local, loopback, CGNAT/VPN 100.64.0.0/10).
 - Optioneel HTTPS (zelfondertekend certificaat, automatisch aangemaakt).
 - SSH staat in de image standaard uit en wordt alleen ingeschakeld met
-  credentials uit Raspberry Pi Imager of `voxip-authorized_keys` op de
+  credentials uit Raspberry Pi Imager of `daynivo-authorized_keys` op de
   bootpartitie (dan alleen sleutel-login).
 - Strikte security-headers en CSP (`default-src 'self'`).
 
@@ -188,7 +192,7 @@ daynivo-kiosk-os/
 │   ├── netinfo.py               netwerkstatus (zonder rechten)
 │   ├── sysinfo.py               CPU, temperatuur, geheugen, opslag, IP
 │   ├── services.py              systemd- en journal-status
-│   ├── ctl.py                   CLI voor SSH-beheer (voxip-kiosk-ctl)
+│   ├── ctl.py                   CLI voor SSH-beheer (daynivo-kiosk-ctl)
 │   └── web/                     Flask-app, templates, statische bestanden
 ├── www/                         lokale kioskpagina's (start, offline, setup)
 ├── systemd/                     unit-bestanden

docs/HARDWARE-TEST.md

@@ -47,14 +47,14 @@ Noteer per stap: ✅ / ❌ + opmerking, de imageversie en het schermtype.
       (zie Logboek → Kiosk-agent).
 - [ ] Screenshot op de Kiosk-pagina toont wat er op het scherm staat.
 - [ ] Daynivo-URL met `?token=`: het token is overal gemaskeerd
-      (dashboard, `voxip-kiosk-ctl status`, `journalctl -u voxip-kiosk-agent`).
+      (dashboard, `daynivo-kiosk-ctl status`, `journalctl -u voxip-kiosk-agent`).
 
 ## 4. Herstel
 
 - [ ] `sudo pkill -9 chromium`: binnen 15 s is de pagina terug. Het logboek
       toont de herstart.
 - [ ] `sudo pkill -9 Xorg`: X en Chromium komen binnen 20 s terug.
-- [ ] Crashloop: `sudo voxip-kiosk-ctl set-url https://localhost:1/` en
+- [ ] Crashloop: `sudo daynivo-kiosk-ctl set-url https://localhost:1/` en
       daarna 7× `sudo pkill -9 chromium` binnen 2 minuten. De service komt
       in de fouttoestand (start-limit). De healthcheck logt een fout en start
       hem na ongeveer 5 minuten opnieuw. Er is geen eindeloze stille lus.
@@ -82,7 +82,7 @@ Noteer per stap: ✅ / ❌ + opmerking, de imageversie en het schermtype.
 - [ ] **Rollback na stroomuitval:** herhaal, trek binnen 3 minuten de stroom
       eruit. Na het opstarten zijn de oude instellingen actief.
 - [ ] **Noodreset:** stel iets onbereikbaars in en bevestig het. Zet
-      `voxip-network-reset` op de bootpartitie en start: weer DHCP.
+      `daynivo-network-reset` op de bootpartitie en start: weer DHCP.
 
 ## 6. Systeem
 
@@ -104,7 +104,7 @@ Noteer per stap: ✅ / ❌ + opmerking, de imageversie en het schermtype.
       zonder ingrijpen terug in de kiosk, zonder "herstellen"-melding.
 - [ ] 72 uur continu draaien met verversinterval 5 min. Daarna: geheugen
       < 80% (dashboard), geen onderspanning, `journalctl -p err -b` zonder
-      terugkerende fouten, `voxip-kiosk-ctl status` alles *Actief*.
+      terugkerende fouten, `daynivo-kiosk-ctl status` alles *Actief*.
 - [ ] SD-kaartschrijfacties: `cat /proc/diskstats | grep mmcblk0` op t=0 en
       na 1 uur stationair. Het verschil in geschreven sectoren (kolom 10) is
       minder dan 50 MB per uur.
@@ -112,13 +112,21 @@ Noteer per stap: ✅ / ❌ + opmerking, de imageversie en het schermtype.
 
 ## 8. Uitrol en updates
 
-- [ ] Nieuwe kaart met `voxip-config.json` (url, device_name, hostname,
+- [ ] Nieuwe kaart met `daynivo-config.json` (url, device_name, hostname,
-      rotation) en `voxip-authorized_keys` op de bootpartitie: bij de eerste
+      rotation) en `daynivo-authorized_keys` op de bootpartitie: bij de eerste
       boot toegepast, hernoemd naar `.applied`, SSH alleen met sleutel.
-- [ ] Ongeldige `voxip-config.json` (http-URL): `.rejected` en
+- [ ] Ongeldige `daynivo-config.json` (http-URL): `.rejected` en
-      `voxip-config.error.txt` met de reden. De kiosk start met de standaardconfiguratie.
+      `daynivo-config.error.txt` met de reden. De kiosk start met de standaardconfiguratie.
 - [ ] `sudo ./update.sh` vanuit een nieuwere checkout: versie in het dashboard
       verhoogd, configuratie en wachtwoord ongewijzigd, back-up in `/var/backups`.
+- [ ] Systeem → Software-updates → *Nu controleren* met een nieuwere release
+      op Gitea: "beschikbaar". *Bijwerken naar …*: binnen enkele minuten is de
+      nieuwe versie actief, de beheerinterface komt terug, configuratie en
+      wachtwoord ongewijzigd.
+- [ ] *Automatisch bijwerken* aan, `sudo systemctl start voxip-kiosk-update.service`:
+      de nieuwere release wordt geïnstalleerd. Met het vinkje uit: alleen gecontroleerd.
+- [ ] `curl -fsSL https://daynivo.nl/kiosk/install.sh | sudo bash` op een verse
+      Raspberry Pi OS Lite: installeert de nieuwste release, setupcode op het scherm.
 - [ ] `sudo ./uninstall.sh --purge` op een testkaart: geen Daynivo-services of
       -bestanden meer (`systemctl list-unit-files | grep voxip` is leeg).
 - [ ] Installatie op een bestaande Raspberry Pi OS Lite (Bookworm) met de

image/boot-README.txt

@@ -4,10 +4,10 @@ Daynivo Kiosk OS — bestanden op deze bootpartitie
 Je kunt een kiosk vooraf instellen door vóór de eerste start bestanden op
 deze partitie te zetten (bijvoorbeeld direct na het flashen). Ze worden bij
 het opstarten verwerkt en daarna hernoemd naar *.applied (of *.rejected bij
-een fout; de reden staat dan in voxip-config.error.txt).
+een fout; de reden staat dan in daynivo-config.error.txt).
 
-voxip-config.json
+daynivo-config.json
-    Instellingen voor deze kiosk. Zie voxip-config.example.json. Toegestaan:
+    Instellingen voor deze kiosk. Zie daynivo-config.example.json. Toegestaan:
     alle sleutels uit /etc/voxip-kiosk/config.json plus "hostname" en
     "wifi_country". Voorbeeld:
 
@@ -18,12 +18,12 @@ voxip-config.json
         "rotation": 90
       }
 
-voxip-authorized_keys
+daynivo-authorized_keys
     Openbare SSH-sleutels (één per regel). SSH wordt dan ingeschakeld, alleen
     met sleutel-login, voor de beheerder (voxipadmin of de gebruiker die je
     in Raspberry Pi Imager hebt aangemaakt).
 
-voxip-network-reset
+daynivo-network-reset
     Leeg bestand. Verwijdert bij de volgende start alle via de
     beheerinterface ingestelde netwerkprofielen (terug naar DHCP). Gebruik
     dit als de kiosk na een netwerkwijziging onbereikbaar is.

image/stage-voxip/00-voxip/00-run.sh

@@ -20,4 +20,4 @@ EOF_CHROOT
 
 # Instructions next to config.txt for whoever opens the boot partition.
 install -m 0644 files/voxip-kiosk/image/boot-README.txt "${ROOTFS_DIR}/boot/firmware/VOXIP-LEESMIJ.txt"
-install -m 0644 files/voxip-kiosk/image/voxip-config.example.json "${ROOTFS_DIR}/boot/firmware/voxip-config.example.json"
+install -m 0644 files/voxip-kiosk/image/daynivo-config.example.json "${ROOTFS_DIR}/boot/firmware/daynivo-config.example.json"

install-online.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+#
+# Install Daynivo Kiosk OS from the latest release, without git:
+#
+#   curl -fsSL https://daynivo.nl/kiosk/install.sh | sudo bash
+#   curl -fsSL https://daynivo.nl/kiosk/install.sh | sudo bash -s -- --url "https://…" --name "Hal"
+#
+# Downloads the newest release from the Gitea repository, checks its SHA-256,
+# unpacks it to /opt/daynivo-kiosk-os/<version> and runs its install.sh with
+# the given options (see install.sh --help). Later updates come from the web
+# interface (Systeem → Software-updates) or the same updater.
+
+set -euo pipefail
+
+API="${DAYNIVO_RELEASE_API:-https://git.rothman.nl/api/v1/repos/rothman/daynivo-kiosk-os/releases/latest}"
+DEST=/opt/daynivo-kiosk-os
+
+say() { printf '\033[1;34m==>\033[0m %s\n' "$*"; }
+die() { printf '\033[1;31mFout:\033[0m %s\n' "$*" >&2; exit 1; }
+
+# Everything runs from main(), called on the last line: a download that breaks
+# off halfway through this script runs nothing.
+main() {
+  [[ $EUID -eq 0 ]] || die "Voer dit uit met sudo (… | sudo bash)."
+  for tool in curl python3 sha256sum tar; do
+    command -v "$tool" >/dev/null || die "$tool ontbreekt."
+  done
+
+  say "Nieuwste release opzoeken"
+  local json version tarball checksum
+  json="$(curl -fsSL --proto '=https' "$API")" || die "Kan de releaseserver niet bereiken ($API)."
+  read -r version tarball checksum < <(python3 -I -c '
+import json, sys
+data = json.loads(sys.stdin.read())
+version = data["tag_name"].removeprefix("v")
+assets = {a["name"]: a["browser_download_url"] for a in data.get("assets") or []}
+name = f"daynivo-kiosk-os-{version}.tar.gz"
+print(version, assets[name], assets[name + ".sha256"])
+' <<<"$json") || die "De nieuwste release heeft geen installatiebestand."
+  [[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || die "Onbekend versienummer: $version"
+
+  say "Daynivo Kiosk OS $version downloaden"
+  local tmp
+  tmp="$(mktemp -d)"
+  trap 'rm -rf "$tmp"' EXIT
+  curl -fsSL --proto '=https' -o "$tmp/release.tar.gz" "$tarball"
+  curl -fsSL --proto '=https' -o "$tmp/release.sha256" "$checksum"
+  local expected actual
+  expected="$(awk '{print $1; exit}' "$tmp/release.sha256")"
+  actual="$(sha256sum "$tmp/release.tar.gz" | awk '{print $1}')"
+  [[ -n $expected && $expected == "$actual" ]] || die "Checksum klopt niet; er wordt niets geïnstalleerd."
+
+  tar -C "$tmp" --no-same-owner -xzf "$tmp/release.tar.gz"
+  [[ "$(tr -d '[:space:]' < "$tmp/daynivo-kiosk-os-$version/VERSION")" == "$version" ]] || die "Release bevat een andere versie."
+  install -d -m 0755 "$DEST"
+  rm -rf "${DEST:?}/$version"
+  mv "$tmp/daynivo-kiosk-os-$version" "$DEST/$version"
+
+  say "Installeren"
+  "$DEST/$version/install.sh" "$@"
+}
+
+main "$@"

install.sh

@@ -26,9 +26,10 @@ SHARE=/usr/share/voxip-kiosk
 DOC=/usr/share/doc/voxip-kiosk
 ETC=/etc/voxip-kiosk
 UNITS=(voxip-kiosk-x.service voxip-kiosk-browser.service voxip-kiosk-agent.service voxip-kiosk-manager.service
-       voxip-kiosk-healthcheck.service voxip-kiosk-healthcheck.timer voxip-network-guard.service voxip-boot-import.service)
+       voxip-kiosk-healthcheck.service voxip-kiosk-healthcheck.timer voxip-network-guard.service voxip-boot-import.service
+       voxip-kiosk-update.service voxip-kiosk-update.timer)
 ENABLE=(voxip-kiosk-x.service voxip-kiosk-browser.service voxip-kiosk-agent.service voxip-kiosk-manager.service
-        voxip-kiosk-healthcheck.timer voxip-network-guard.service voxip-boot-import.service)
+        voxip-kiosk-healthcheck.timer voxip-network-guard.service voxip-boot-import.service voxip-kiosk-update.timer)
 
 say()  { printf '\033[1;34m==>\033[0m %s\n' "$*"; }
 warn() { printf '\033[1;33mLet op:\033[0m %s\n' "$*" >&2; }
@@ -134,10 +135,12 @@ rm -rf "$LIB/python.old"
 mv "$LIB/python.new" "$LIB/python"
 rm -rf "$LIB/python.old"
 
-for bin in voxip-kiosk-agent voxip-kiosk-browser voxip-kiosk-healthcheck voxip-kiosk-helper voxip-kiosk-manager voxip-kiosk-x; do
+for bin in voxip-kiosk-agent voxip-kiosk-browser voxip-kiosk-healthcheck voxip-kiosk-helper voxip-kiosk-manager voxip-kiosk-updater voxip-kiosk-x; do
   install -m 0755 -o root -g root "$SRC/bin/$bin" "$LIB/$bin"
 done
-install -m 0755 -o root -g root "$SRC/bin/voxip-kiosk-ctl" /usr/local/sbin/voxip-kiosk-ctl
+install -m 0755 -o root -g root "$SRC/bin/daynivo-kiosk-ctl" /usr/local/sbin/daynivo-kiosk-ctl
+# The name from before the rename to Daynivo keeps working.
+ln -sfn daynivo-kiosk-ctl /usr/local/sbin/voxip-kiosk-ctl
 
 rm -rf "$SHARE/www"
 install -d -m 0755 "$SHARE/www"
@@ -319,7 +322,7 @@ say "Services starten"
 systemctl restart systemd-journald.service || true
 systemctl restart avahi-daemon.service || true
 systemctl restart voxip-kiosk-manager.service voxip-kiosk-agent.service
-systemctl start voxip-kiosk-healthcheck.timer
+systemctl start voxip-kiosk-healthcheck.timer voxip-kiosk-update.timer
 systemctl reset-failed voxip-kiosk-x.service voxip-kiosk-browser.service 2>/dev/null || true
 systemctl restart voxip-kiosk-x.service
 systemctl restart voxip-kiosk-browser.service
@@ -339,4 +342,4 @@ if [[ ! -f $ETC/admin.json ]]; then
     echo "    Setupcode:       $(cat "$ETC/setup-code")  (staat ook op het scherm)"
   fi
 fi
-echo "    Status:          sudo voxip-kiosk-ctl status"
+echo "    Status:          sudo daynivo-kiosk-ctl status"

src/voxip_kiosk/config.py

@@ -36,6 +36,7 @@ DEFAULTS: dict[str, Any] = {
     "admin_port": 8080,
     "admin_https": False,
     "admin_allow_public": False,
+    "auto_update": False,
 }
 
 
@@ -114,6 +115,7 @@ VALIDATORS: dict[str, Callable[[Any], Any]] = {
     "admin_port": _int_range(1024, 65535, "Poort moet tussen 1024 en 65535 liggen."),
     "admin_https": _bool,
     "admin_allow_public": _bool,
+    "auto_update": _bool,
 }
 
 

src/voxip_kiosk/ctl.py

@@ -1,4 +1,4 @@
-"""voxip-kiosk-ctl — command-line management over SSH (run with sudo)."""
+"""daynivo-kiosk-ctl — command-line management over SSH (run with sudo)."""
 
 from __future__ import annotations
 
@@ -33,7 +33,7 @@ def cmd_status(args) -> int:
     print(f"Apparaat:   {config['device_name']}")
     print(f"URL:        {config['url'] if args.show_secrets else mask_url(config['url'])}")
     print(f"Beheer:     {'https' if config['admin_https'] else 'http'}://{os.uname().nodename}.local:{config['admin_port']}")
-    print(f"Wachtwoord: {'ingesteld' if paths.admin_file.exists() else 'NOG NIET INGESTELD (setupcode: sudo voxip-kiosk-ctl setup-code)'}")
+    print(f"Wachtwoord: {'ingesteld' if paths.admin_file.exists() else 'NOG NIET INGESTELD (setupcode: sudo daynivo-kiosk-ctl setup-code)'}")
     for key, info in services.summary().items():
         print(f"{info['unit']:<34} {info['label']} (herstarts: {info['restarts']})")
     if agent:
@@ -138,7 +138,7 @@ def cmd_version(_args) -> int:
 
 
 def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser(prog="voxip-kiosk-ctl", description="Beheer van Daynivo Kiosk OS vanaf de commandoregel.")
+    parser = argparse.ArgumentParser(prog="daynivo-kiosk-ctl", description="Beheer van Daynivo Kiosk OS vanaf de commandoregel.")
     sub = parser.add_subparsers(dest="command", required=True)
     p = sub.add_parser("status", help="toon de status")
     p.add_argument("--show-secrets", action="store_true", help="toon de volledige URL inclusief token")

src/voxip_kiosk/helper.py

@@ -23,17 +23,21 @@ from pathlib import Path
 from typing import Any, Callable
 
 from . import config as cfg
-from . import netconfig
+from . import netconfig, updater
 from . import validation as v
 from .paths import Paths, default_paths
 
 HELPER_PATH = "/usr/lib/voxip-kiosk/voxip-kiosk-helper"
 ROLLBACK_UNIT = "voxip-network-rollback"
+UPDATE_UNIT = "voxip-kiosk-update-now"
+UPDATER_PATH = "/usr/lib/voxip-kiosk/voxip-kiosk-updater"
 ACTIVATE_UNIT = "voxip-network-activate"
 BOOT_DIRS = (Path("/boot/firmware"), Path("/boot"))
-RESET_TRIGGER = "voxip-network-reset"
+# Files on the boot partition. The voxip-* names are from before the rename to
-IMPORT_CONFIG = "voxip-config.json"
+# Daynivo and keep working, so existing SD cards and instructions stay valid.
-IMPORT_KEYS = "voxip-authorized_keys"
+RESET_TRIGGERS = ("daynivo-network-reset", "voxip-network-reset")
+IMPORT_CONFIGS = ("voxip-config.json", "daynivo-config.json")  # applied in this order: the Daynivo name wins
+IMPORT_KEYS = ("voxip-authorized_keys", "daynivo-authorized_keys")
 SSH_KEY_TYPES = ("ssh-ed25519", "ssh-rsa", "ecdsa-sha2-", "sk-ssh-ed25519@openssh.com", "sk-ecdsa-sha2-")
 
 # Verbs the web interface may call through sudo. Everything else is only
@@ -41,6 +45,7 @@ SSH_KEY_TYPES = ("ssh-ed25519", "ssh-rsa", "ecdsa-sha2-", "sk-ssh-ed25519@openss
 PUBLIC_VERBS = {
     "reboot", "poweroff", "restart-browser", "restart-manager", "set-hostname", "set-wifi-country",
     "wifi-scan", "network-apply", "network-confirm", "network-rollback", "network-pending",
+    "update-check", "update-install",
 }
 
 
@@ -99,6 +104,22 @@ class Helper:
         log(syslog.LOG_NOTICE, "Beheerinterface wordt herstart")
         return {"message": "De beheerinterface wordt herstart."}
 
+    # -- software updates -----------------------------------------------
+
+    def update_check(self) -> dict[str, Any]:
+        state, _ = updater.Updater(self.paths).check()
+        return {"update": state}
+
+    def update_install(self) -> dict[str, Any]:
+        # A transient unit of its own: install.sh restarts the web interface, which
+        # must not take the running update down with it.
+        proc = self.run(["systemd-run", f"--unit={UPDATE_UNIT}", "--collect", "--quiet",
+                         UPDATER_PATH, "--install"], check=False)
+        if proc.returncode != 0:
+            raise HelperError("Er loopt al een update, of die kon niet worden gestart.")
+        log(syslog.LOG_NOTICE, "Update gestart via beheerinterface")
+        return {"message": "De update is gestart. De beheerinterface is zo meteen even niet bereikbaar."}
+
     # -- hostname -------------------------------------------------------
 
     def set_hostname(self, name: str) -> dict[str, Any]:
@@ -287,15 +308,16 @@ class Helper:
             self.network_restore(boot=True)
             result["rolled_back"] = True
         boot = self._boot_dir()
-        trigger = boot / RESET_TRIGGER if boot else None
+        triggers = [boot / name for name in RESET_TRIGGERS if (boot / name).exists()] if boot else []
-        if trigger and trigger.exists():
+        if triggers:
             stash = self.paths.network_state_dir / f"disabled-{int(time.time())}"
             stash.mkdir(parents=True, mode=0o700)
             for iface in netconfig.INTERFACES:
                 src = self._keyfile_path(iface)
                 if src.exists():
                     shutil.move(str(src), str(stash / src.name))
-            trigger.unlink()
+            for trigger in triggers:
+                trigger.unlink()
             log(syslog.LOG_WARNING, f"Netwerk-reset uitgevoerd; Daynivo-profielen verplaatst naar {stash}")
             result["reset"] = True
         return result
@@ -316,12 +338,14 @@ class Helper:
         if boot is None:
             return {"imported": []}
         imported = []
-        conf = boot / IMPORT_CONFIG
+        for name in IMPORT_CONFIGS:
-        if conf.exists():
+            conf = boot / name
+            if not conf.exists():
+                continue
             try:
                 data = json.loads(conf.read_text(encoding="utf-8-sig"))
                 if not isinstance(data, dict):
-                    raise HelperError("voxip-config.json moet een JSON-object zijn")
+                    raise HelperError(f"{name} moet een JSON-object zijn")
                 data = dict(data)
                 host = data.pop("hostname", None)
                 country = data.pop("wifi_country", None)
@@ -332,22 +356,24 @@ class Helper:
                     self.set_hostname(str(host))
                 if country:
                     self.set_wifi_country(str(country))
-                conf.rename(conf.with_name(IMPORT_CONFIG + ".applied"))
+                conf.rename(conf.with_name(name + ".applied"))
-                imported.append(IMPORT_CONFIG)
+                imported.append(name)
-                log(syslog.LOG_NOTICE, "Configuratie geïmporteerd vanaf de bootpartitie")
+                log(syslog.LOG_NOTICE, f"Configuratie geïmporteerd vanaf de bootpartitie ({name})")
             except (HelperError, cfg.ConfigError, v.ValidationError, ValueError, OSError) as exc:
-                (boot / "voxip-config.error.txt").write_text(f"{exc}\n", encoding="utf-8")
+                (boot / name.replace(".json", ".error.txt")).write_text(f"{exc}\n", encoding="utf-8")
-                conf.rename(conf.with_name(IMPORT_CONFIG + ".rejected"))
+                conf.rename(conf.with_name(name + ".rejected"))
-                log(syslog.LOG_ERR, f"voxip-config.json geweigerd: {exc}")
+                log(syslog.LOG_ERR, f"{name} geweigerd: {exc}")
-        keys = boot / IMPORT_KEYS
+        for name in IMPORT_KEYS:
-        if keys.exists():
+            keys = boot / name
+            if not keys.exists():
+                continue
             try:
                 self._import_ssh_keys(keys.read_text(encoding="utf-8-sig"))
-                keys.rename(keys.with_name(IMPORT_KEYS + ".applied"))
+                keys.rename(keys.with_name(name + ".applied"))
-                imported.append(IMPORT_KEYS)
+                imported.append(name)
             except (HelperError, OSError) as exc:
-                keys.rename(keys.with_name(IMPORT_KEYS + ".rejected"))
+                keys.rename(keys.with_name(name + ".rejected"))
-                log(syslog.LOG_ERR, f"SSH-sleutels geweigerd: {exc}")
+                log(syslog.LOG_ERR, f"SSH-sleutels geweigerd ({name}): {exc}")
         return {"imported": imported}
 
     def _import_ssh_keys(self, text: str) -> None:
@@ -403,6 +429,8 @@ class Helper:
             "network-pending": lambda: (no_args(), self.network_pending())[1],
             "network-boot-guard": lambda: (no_args(), self.network_boot_guard())[1],
             "boot-import": lambda: (no_args(), self.boot_import())[1],
+            "update-check": lambda: (no_args(), self.update_check())[1],
+            "update-install": lambda: (no_args(), self.update_install())[1],
         }
         if verb not in table:
             raise HelperError(f"Onbekende opdracht: {verb}")

src/voxip_kiosk/paths.py

@@ -76,6 +76,10 @@ class Paths:
     def version_file(self) -> Path:
         return self.share_dir / "VERSION"
 
+    @property
+    def update_state_file(self) -> Path:
+        return self.state_dir / "update.json"
+
     @property
     def audit_log(self) -> Path:
         return self.log_dir / "audit.log"

src/voxip_kiosk/updater.py

@@ -0,0 +1,244 @@
+"""voxip-kiosk-updater — installs new Daynivo Kiosk OS releases (runs as root).
+
+A release is a tag ``vX.Y.Z`` on the Gitea repository with two assets:
+``daynivo-kiosk-os-X.Y.Z.tar.gz`` and its ``.sha256``. The updater
+
+* checks the latest release and records the result in ``update.json`` in the
+  state directory (the web interface shows it),
+* downloads and verifies a newer release, unpacks it under
+  ``/opt/daynivo-kiosk-os/<version>`` and runs that release's
+  ``update.sh --no-pull`` (config backup + ``install.sh --upgrade``).
+
+It never installs an older or equal version. Usage::
+
+    voxip-kiosk-updater --check     # only check
+    voxip-kiosk-updater --auto      # check; install when auto_update is on (daily timer)
+    voxip-kiosk-updater --install   # check and install when newer (button in the web interface)
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import logging
+import re
+import shutil
+import ssl
+import subprocess
+import tarfile
+import tempfile
+import time
+import urllib.error
+import urllib.request
+from dataclasses import dataclass
+from pathlib import Path, PurePosixPath
+from typing import Any, Callable
+
+from . import logutil
+from .config import atomic_write_json, load_config
+from .paths import Paths, default_paths, read_version
+
+log = logging.getLogger("voxip-kiosk-updater")
+
+RELEASE_API = "https://git.rothman.nl/api/v1/repos/rothman/daynivo-kiosk-os/releases/latest"
+ASSET_PREFIX = "daynivo-kiosk-os-"
+RELEASE_DIR = Path("/opt/daynivo-kiosk-os")
+CACHE_DIR = Path("/var/cache/voxip-kiosk")
+KEEP_RELEASES = 2
+MAX_DOWNLOAD = 64 * 1024 * 1024
+USER_AGENT = "Daynivo-Kiosk-OS/updater"
+_VERSION = re.compile(r"^v?(\d+)\.(\d+)\.(\d+)$")
+
+
+class UpdateError(Exception):
+    pass
+
+
+@dataclass(frozen=True)
+class Release:
+    version: str
+    tarball_url: str
+    checksum_url: str
+    page_url: str
+
+
+def parse_version(text: str) -> tuple[int, int, int] | None:
+    match = _VERSION.match(text.strip())
+    return (int(match[1]), int(match[2]), int(match[3])) if match else None
+
+
+def is_newer(candidate: str, current: str) -> bool:
+    new, old = parse_version(candidate), parse_version(current.removesuffix("-dev"))
+    return new is not None and (old is None or new > old)
+
+
+def http_get(url: str, limit: int = MAX_DOWNLOAD, timeout: float = 30) -> bytes:
+    if not url.startswith("https://"):
+        raise UpdateError(f"Alleen HTTPS-downloads: {url}")
+    request = urllib.request.Request(url, headers={"User-Agent": USER_AGENT, "Accept": "application/json, */*"})
+    try:
+        with urllib.request.urlopen(request, timeout=timeout, context=ssl.create_default_context()) as response:
+            data = response.read(limit + 1)
+    except urllib.error.HTTPError as exc:
+        if exc.code == 404 and url == RELEASE_API:
+            raise UpdateError("Er is nog geen release gepubliceerd") from exc
+        raise UpdateError(f"Downloaden mislukt ({url}): HTTP {exc.code}") from exc
+    except OSError as exc:
+        raise UpdateError(f"Downloaden mislukt ({url}): {exc}") from exc
+    if len(data) > limit:
+        raise UpdateError(f"Download te groot: {url}")
+    return data
+
+
+def parse_release(data: dict[str, Any]) -> Release:
+    version = str(data.get("tag_name", "")).removeprefix("v")
+    if parse_version(version) is None:
+        raise UpdateError(f"Onbekend versienummer in release: {data.get('tag_name')!r}")
+    assets = {a.get("name"): a.get("browser_download_url") for a in data.get("assets") or [] if isinstance(a, dict)}
+    tarball = assets.get(f"{ASSET_PREFIX}{version}.tar.gz")
+    checksum = assets.get(f"{ASSET_PREFIX}{version}.tar.gz.sha256")
+    if not tarball or not checksum:
+        raise UpdateError(f"Release {version} mist het installatiebestand of de checksum")
+    return Release(version, tarball, checksum, str(data.get("html_url") or ""))
+
+
+def fetch_latest(get: Callable[[str], bytes] = http_get, api: str = RELEASE_API) -> Release:
+    try:
+        data = json.loads(get(api))
+    except ValueError as exc:
+        raise UpdateError("Ongeldig antwoord van de releaseserver") from exc
+    if not isinstance(data, dict):
+        raise UpdateError("Ongeldig antwoord van de releaseserver")
+    return parse_release(data)
+
+
+def read_state(paths: Paths) -> dict[str, Any]:
+    try:
+        data = json.loads(paths.update_state_file.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def safe_extract(archive: Path, target: Path) -> None:
+    """Unpack only regular files and directories that stay inside ``target``."""
+    with tarfile.open(archive, "r:gz") as tar:
+        members = tar.getmembers()
+        for member in members:
+            path = PurePosixPath(member.name)
+            if path.is_absolute() or ".." in path.parts or not (member.isfile() or member.isdir()):
+                raise UpdateError(f"Onveilig bestand in release: {member.name}")
+        tar.extractall(target, members=members)  # noqa: S202 - members checked above
+
+
+class Updater:
+    def __init__(self, paths: Paths | None = None, get: Callable[[str], bytes] = http_get,
+                 run: Callable[..., Any] = subprocess.run, release_dir: Path = RELEASE_DIR,
+                 cache_dir: Path = CACHE_DIR, now: Callable[[], float] = time.time):
+        self.paths = paths or default_paths()
+        self.get = get
+        self.run = run
+        self.release_dir = release_dir
+        self.cache_dir = cache_dir
+        self.now = now
+
+    def _write_state(self, **values: Any) -> dict[str, Any]:
+        state = {**read_state(self.paths), **values}
+        try:
+            atomic_write_json(self.paths.update_state_file, state, mode=0o644, owner=(0, 0))
+        except PermissionError:
+            atomic_write_json(self.paths.update_state_file, state, mode=0o644)
+        except OSError as exc:
+            log.warning("Kon updatestatus niet opslaan: %s", exc)
+        return state
+
+    def check(self) -> tuple[dict[str, Any], Release | None]:
+        current = read_version(self.paths)
+        try:
+            release = fetch_latest(self.get)
+        except UpdateError as exc:
+            log.warning("Controleren op updates mislukt: %s", exc)
+            return self._write_state(checked_at=int(self.now()), current=current, check_error=str(exc)), None
+        available = is_newer(release.version, current)
+        state = self._write_state(checked_at=int(self.now()), current=current, latest=release.version,
+                                  available=available, release_url=release.page_url, check_error=None)
+        if available:
+            log.info("Nieuwe versie beschikbaar: %s (geïnstalleerd: %s)", release.version, current)
+        return state, release if available else None
+
+    def install(self, release: Release) -> dict[str, Any]:
+        current = read_version(self.paths)
+        if not is_newer(release.version, current):
+            raise UpdateError(f"Versie {release.version} is niet nieuwer dan {current}")
+        self._write_state(status="updating", target=release.version, started_at=int(self.now()), install_error=None)
+        log.info("Bijwerken naar %s", release.version)
+        try:
+            folder = self._download(release)
+            proc = self.run([str(folder / "update.sh"), "--no-pull"], capture_output=True, text=True, timeout=3600)
+            if proc.returncode != 0:
+                tail = (proc.stderr or proc.stdout or "").strip().splitlines()[-5:]
+                raise UpdateError("Installatie mislukt: " + " / ".join(tail))
+        except (UpdateError, OSError, subprocess.SubprocessError) as exc:
+            log.error("Bijwerken naar %s mislukt: %s", release.version, exc)
+            return self._write_state(status="failed", finished_at=int(self.now()), install_error=str(exc))
+        self._prune(keep=release.version)
+        log.info("Bijgewerkt naar %s", release.version)
+        return self._write_state(status="done", finished_at=int(self.now()), current=release.version,
+                                 available=False, install_error=None)
+
+    def _download(self, release: Release) -> Path:
+        tarball = self.get(release.tarball_url)
+        expected = self.get(release.checksum_url, limit=4096).decode("ascii", "replace").split()
+        actual = hashlib.sha256(tarball).hexdigest()
+        if not expected or expected[0].lower() != actual:
+            raise UpdateError("Checksum klopt niet; de download wordt niet geïnstalleerd")
+
+        self.cache_dir.mkdir(parents=True, exist_ok=True)
+        self.release_dir.mkdir(parents=True, exist_ok=True)
+        with tempfile.TemporaryDirectory(dir=self.cache_dir) as tmp:
+            archive = Path(tmp) / "release.tar.gz"
+            archive.write_bytes(tarball)
+            unpacked = Path(tmp) / "unpacked"
+            safe_extract(archive, unpacked)
+            source = unpacked / f"{ASSET_PREFIX}{release.version}"
+            found = (source / "VERSION").read_text(encoding="utf-8").strip() if (source / "VERSION").exists() else None
+            if found != release.version:
+                raise UpdateError(f"Release bevat versie {found!r} in plaats van {release.version}")
+            target = self.release_dir / release.version
+            shutil.rmtree(target, ignore_errors=True)
+            shutil.move(str(source), target)
+        return target
+
+    def _prune(self, keep: str) -> None:
+        versions = sorted((p for p in self.release_dir.iterdir() if p.is_dir() and parse_version(p.name)),
+                          key=lambda p: parse_version(p.name), reverse=True)
+        for old in versions[KEEP_RELEASES:]:
+            if old.name != keep:
+                shutil.rmtree(old, ignore_errors=True)
+
+
+def main(argv: list[str] | None = None, updater: Updater | None = None) -> int:
+    parser = argparse.ArgumentParser(prog="voxip-kiosk-updater", description="Daynivo Kiosk OS bijwerken.")
+    mode = parser.add_mutually_exclusive_group(required=True)
+    mode.add_argument("--check", action="store_true", help="alleen controleren")
+    mode.add_argument("--auto", action="store_true", help="controleren en bijwerken als automatisch bijwerken aan staat")
+    mode.add_argument("--install", action="store_true", help="controleren en een nieuwere versie installeren")
+    args = parser.parse_args(argv)
+    logutil.setup()
+    updater = updater or Updater()
+
+    state, release = updater.check()
+    if args.check or release is None:
+        print(json.dumps(state, ensure_ascii=False))
+        return 1 if state.get("check_error") else 0
+    if args.auto:
+        if not load_config(updater.paths.config_file)["auto_update"]:
+            log.info("Automatisch bijwerken staat uit; %s wordt niet geïnstalleerd", release.version)
+            return 0
+        if (updater.paths.health_run_dir / "maintenance").exists():
+            log.info("Onderhoudsmodus actief; bijwerken overgeslagen")
+            return 0
+    state = updater.install(release)
+    print(json.dumps(state, ensure_ascii=False))
+    return 0 if state.get("status") == "done" else 1

src/voxip_kiosk/web/static/app.css

@@ -28,6 +28,7 @@ code { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; fo
 h1 { font-size: 1.6rem; margin: 0 0 .25rem; }
 h2 { font-size: 1.1rem; margin: 0 0 .9rem; }
 .mt { margin-top: 1.6rem; }
+.mt-sm { margin-top: 1rem; }
 .muted { color: var(--muted); }
 .small { font-size: .875rem; }
 .break { overflow-wrap: anywhere; }

src/voxip_kiosk/web/templates/login.html

@@ -12,6 +12,6 @@
     </label>
     <button type="submit" class="btn btn-primary btn-block">Inloggen</button>
   </form>
-  <p class="muted small">Wachtwoord vergeten? Log via SSH in en voer <code>sudo voxip-kiosk-ctl reset-password</code> uit.</p>
+  <p class="muted small">Wachtwoord vergeten? Log via SSH in en voer <code>sudo daynivo-kiosk-ctl reset-password</code> uit.</p>
 </section>
 {% endblock %}

src/voxip_kiosk/web/templates/network.html

@@ -94,7 +94,7 @@
   <h2>Herstel bij een onbereikbare kiosk</h2>
   <ul class="plain">
     <li>Iedere wijziging wordt na {{ rollback_seconds // 60 }} minuten automatisch teruggedraaid als je hem niet bevestigt, ook als de stroom tussendoor uitvalt.</li>
-    <li>Noodherstel: zet een leeg bestand <code>voxip-network-reset</code> op de bootpartitie van de SD-kaart en start de Pi. Alle Daynivo-netwerkprofielen worden dan verwijderd (terug naar DHCP).</li>
+    <li>Noodherstel: zet een leeg bestand <code>daynivo-network-reset</code> op de bootpartitie van de SD-kaart en start de Pi. Alle Daynivo-netwerkprofielen worden dan verwijderd (terug naar DHCP).</li>
   </ul>
 </section>
 {% endblock %}

src/voxip_kiosk/web/templates/setup.html

@@ -4,7 +4,7 @@
 <section class="card card-narrow">
   <h1>Welkom bij Daynivo Kiosk Manager</h1>
   <p>Stel eerst een uniek beheerderswachtwoord in. Je hebt daarvoor de <strong>setupcode</strong> nodig die op het
-     scherm van de kiosk staat (of via SSH: <code>sudo voxip-kiosk-ctl setup-code</code>).</p>
+     scherm van de kiosk staat (of via SSH: <code>sudo daynivo-kiosk-ctl setup-code</code>).</p>
   {% if error %}<div class="alert alert-error" role="alert">{{ error }}</div>{% endif %}
   <form method="post" class="form">
     <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">

src/voxip_kiosk/web/templates/system.html

@@ -62,6 +62,40 @@
   </section>
 </div>
 
+<section class="card" id="updates">
+  <h2>Software-updates</h2>
+  <dl class="kv">
+    <dt>Geïnstalleerd</dt><dd>Daynivo Kiosk OS {{ s.version }}</dd>
+    <dt>Nieuwste versie</dt>
+    <dd>
+      {% if update.check_error %}<span class="muted">Onbekend — controleren mislukt: {{ update.check_error }}</span>
+      {% elif update.latest %}{{ update.latest }}{% if update.available %} <strong>— beschikbaar</strong>{% else %} <span class="muted">(je bent bij)</span>{% endif %}
+      {% else %}<span class="muted">Nog niet gecontroleerd</span>{% endif %}
+    </dd>
+    {% if update.checked %}<dt>Gecontroleerd</dt><dd>{{ update.checked }}</dd>{% endif %}
+    {% if update.running %}<dt>Status</dt><dd>Bezig met bijwerken naar {{ update.target }}…</dd>
+    {% elif update.status == 'failed' %}<dt>Laatste update</dt><dd>Mislukt{% if update.finished %} op {{ update.finished }}{% endif %}: {{ update.install_error }}</dd>
+    {% elif update.status == 'done' and update.finished %}<dt>Laatste update</dt><dd>Gelukt op {{ update.finished }}</dd>{% endif %}
+  </dl>
+
+  <form method="post" action="{{ url_for('ui.system_updates') }}" class="form mt-sm">
+    {{ csrf() }}
+    <label class="check"><input type="checkbox" name="auto_update" value="1" {% if conf.auto_update %}checked{% endif %}> Automatisch bijwerken <span class="muted">(elke nacht tussen 03:00 en 05:00, als er een nieuwe versie is)</span></label>
+    <button type="submit" class="btn btn-secondary">Opslaan</button>
+  </form>
+
+  <div class="actions-row mt-sm">
+    <form method="post" action="{{ url_for('ui.system_update_check') }}" class="inline-form">{{ csrf() }}<button type="submit" class="btn btn-secondary">Nu controleren</button></form>
+    {% if update.available and not update.running %}
+    <form method="post" action="{{ url_for('ui.system_update_install') }}" class="inline-form"
+          data-confirm="Daynivo Kiosk OS wordt bijgewerkt naar {{ update.latest }}. Het scherm en de beheerinterface zijn een paar minuten niet beschikbaar." data-confirm-title="Nu bijwerken">
+      {{ csrf() }}<button type="submit" class="btn btn-primary">Bijwerken naar {{ update.latest }}</button>
+    </form>
+    {% endif %}
+  </div>
+  <p class="muted small">De configuratie blijft behouden en wordt voor elke update eerst bewaard in <code>/var/backups</code>.</p>
+</section>
+
 <section class="card">
   <h2>Systeeminformatie</h2>
   <dl class="kv">

src/voxip_kiosk/web/views.py

@@ -13,6 +13,7 @@ from flask import (Blueprint, Response, abort, current_app, flash, g, jsonify, r
 
 from .. import netconfig, netinfo, services, sysinfo
 from ..agent import read_state
+from ..updater import read_state as read_update_state
 from ..cdp import CDPError
 from ..config import ConfigError, load_config, save_config
 from ..helper_client import HelperError
@@ -404,7 +405,25 @@ def system():
     outputs = info.get("outputs") or []
     modes = outputs[0]["modes"] if outputs else []
     return render_template("system.html", active="system", conf=cfg(), modes=modes,
-                           output=outputs[0] if outputs else None, s=collect_status())
+                           output=outputs[0] if outputs else None, s=collect_status(), update=update_view())
+
+
+def _when(timestamp: Any) -> str | None:
+    if not isinstance(timestamp, (int, float)):
+        return None
+    return time.strftime("%d-%m-%Y %H:%M", time.localtime(timestamp))
+
+
+def update_view() -> dict[str, Any]:
+    """The updater's last result (update.json, written by root) in display form."""
+    state = read_update_state(svc().paths)
+    return {
+        **state,
+        "checked": _when(state.get("checked_at")),
+        "finished": _when(state.get("finished_at")),
+        # A run that started more than two hours ago and never finished is reported as failed.
+        "running": state.get("status") == "updating" and time.time() - state.get("started_at", 0) < 7200,
+    }
 
 
 @bp.post("/system/display")
@@ -465,6 +484,34 @@ def system_admin():
     return redirect(url_for("ui.system"))
 
 
+@bp.post("/system/updates")
+def system_updates():
+    auto = _form_bool("auto_update")
+    if _save({"auto_update": auto}) is not None:
+        audit("update_settings", auto_update=auto)
+        flash("Automatisch bijwerken staat " + ("aan." if auto else "uit."), "success")
+    return redirect(url_for("ui.system") + "#updates")
+
+
+@bp.post("/system/update/check")
+def system_update_check():
+    back = url_for("ui.system") + "#updates"
+    try:
+        state = svc().helper.call("update-check", timeout=60).get("update", {})
+    except HelperError as exc:
+        return _action_response(False, str(exc), back)
+    if state.get("check_error"):
+        return _action_response(False, f"Controleren mislukt: {state['check_error']}", back)
+    if state.get("available"):
+        return _action_response(True, f"Versie {state.get('latest')} is beschikbaar.", back)
+    return _action_response(True, f"Je hebt de nieuwste versie ({state.get('current')}).", back)
+
+
+@bp.post("/system/update/install")
+def system_update_install():
+    return _helper_action("update_install", "update-install", back=url_for("ui.system") + "#updates")
+
+
 # -- logs ------------------------------------------------------------------------
 
 @bp.get("/logs")

systemd/voxip-boot-import.service

@@ -3,6 +3,10 @@ Description=Daynivo configuratie en SSH-sleutels importeren vanaf de bootpartiti
 Documentation=file:///usr/share/doc/voxip-kiosk/README.md
 After=local-fs.target
 Before=voxip-kiosk-manager.service voxip-kiosk-browser.service ssh.service
+ConditionPathExistsGlob=|/boot/firmware/daynivo-config.json
+ConditionPathExistsGlob=|/boot/firmware/daynivo-authorized_keys
+ConditionPathExistsGlob=|/boot/daynivo-config.json
+ConditionPathExistsGlob=|/boot/daynivo-authorized_keys
 ConditionPathExistsGlob=|/boot/firmware/voxip-config.json
 ConditionPathExistsGlob=|/boot/firmware/voxip-authorized_keys
 ConditionPathExistsGlob=|/boot/voxip-config.json

systemd/voxip-kiosk-update.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Daynivo Kiosk OS: controleren op updates (en installeren als dat aan staat)
+Documentation=file:///usr/share/doc/voxip-kiosk/README.md
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/lib/voxip-kiosk/voxip-kiosk-updater --auto
+TimeoutStartSec=1h
+SyslogIdentifier=voxip-kiosk-updater

systemd/voxip-kiosk-update.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Daynivo Kiosk OS: dagelijks controleren op updates
+
+[Timer]
+# Night-time, spread over two hours so a fleet doesn't hit the release server at once.
+OnCalendar=*-*-* 03:00
+RandomizedDelaySec=2h
+Persistent=false
+
+[Install]
+WantedBy=timers.target

tests/test_helper.py

@@ -169,33 +169,69 @@ def test_boot_guard_rolls_back_and_honours_reset(helper, paths, boot):
     assert not any(c[0] == "nmcli" for c in helper.run.commands), "NetworkManager is not running yet at boot"
 
     (paths.nm_connections_dir / "voxip-wlan0.nmconnection").write_text("x")
-    (boot / "voxip-network-reset").write_text("")
+    (boot / "daynivo-network-reset").write_text("")
     assert helper.network_boot_guard() == {"reset": True}
     assert not (paths.nm_connections_dir / "voxip-wlan0.nmconnection").exists()
-    assert not (boot / "voxip-network-reset").exists()
+    assert not (boot / "daynivo-network-reset").exists()
     assert old.exists()
 
 
+def test_boot_guard_still_honours_the_old_reset_name(helper, paths, boot):
+    (paths.nm_connections_dir / "voxip-eth0.nmconnection").write_text("x")
+    (boot / "voxip-network-reset").write_text("")
+    assert helper.network_boot_guard() == {"reset": True}
+    assert not (paths.nm_connections_dir / "voxip-eth0.nmconnection").exists()
+    assert not (boot / "voxip-network-reset").exists()
+
+
 def test_boot_import_applies_config(helper, paths, boot):
-    (boot / "voxip-config.json").write_text(json.dumps({"device_name": "Hal", "url": "https://klant.example.nl/display/hal?token=x",
+    (boot / "daynivo-config.json").write_text(json.dumps({"device_name": "Hal", "url": "https://klant.example.nl/display/hal?token=x",
-                                                         "hostname": "hal", "rotation": 90}))
+                                                           "hostname": "hal", "rotation": 90}))
-    assert helper.boot_import() == {"imported": ["voxip-config.json"]}
+    assert helper.boot_import() == {"imported": ["daynivo-config.json"]}
     conf = load_config(paths.config_file)
     assert conf["device_name"] == "Hal" and conf["rotation"] == 90 and conf["url"].startswith("https://klant")
     assert (helper.etc / "hostname").read_text() == "hal\n"
+    assert (boot / "daynivo-config.json.applied").exists()
+
+
+def test_boot_import_still_accepts_the_old_names(helper, paths, boot):
+    (boot / "voxip-config.json").write_text(json.dumps({"device_name": "Oud", "rotation": 180}))
+    (boot / "daynivo-config.json").write_text(json.dumps({"device_name": "Nieuw"}))
+    assert helper.boot_import() == {"imported": ["voxip-config.json", "daynivo-config.json"]}
+    conf = load_config(paths.config_file)
+    assert conf["device_name"] == "Nieuw" and conf["rotation"] == 180  # the Daynivo file is applied last
     assert (boot / "voxip-config.json.applied").exists()
 
 
 def test_boot_import_rejects_invalid_config(helper, paths, boot):
     before = paths.config_file.read_text()
-    (boot / "voxip-config.json").write_text(json.dumps({"url": "http://onveilig.example"}))
+    (boot / "daynivo-config.json").write_text(json.dumps({"url": "http://onveilig.example"}))
     helper.boot_import()
     assert paths.config_file.read_text() == before
-    assert (boot / "voxip-config.json.rejected").exists()
+    assert (boot / "daynivo-config.json.rejected").exists()
-    assert "HTTPS" in (boot / "voxip-config.error.txt").read_text()
+    assert "HTTPS" in (boot / "daynivo-config.error.txt").read_text()
 
 
 def test_boot_import_rejects_non_key_lines(helper, boot):
-    (boot / "voxip-authorized_keys").write_text("dit is geen sleutel\n")
+    (boot / "daynivo-authorized_keys").write_text("dit is geen sleutel\n")
+    (boot / "voxip-authorized_keys").write_text("ook geen sleutel\n")
     helper.boot_import()
+    assert (boot / "daynivo-authorized_keys.rejected").exists()
     assert (boot / "voxip-authorized_keys.rejected").exists()
+
+
+def test_update_verbs_are_public_and_install_runs_in_its_own_unit(helper):
+    assert {"update-check", "update-install"} <= h.PUBLIC_VERBS
+    result = helper.dispatch("update-install", [])
+    assert "gestart" in result["message"]
+    command = helper.run.ran("systemd-run")[-1]
+    assert f"--unit={h.UPDATE_UNIT}" in command and command[-2:] == [h.UPDATER_PATH, "--install"]
+
+
+def test_update_install_reports_a_running_update(helper):
+    def busy(args, timeout=30, check=True, input=None):
+        return subprocess.CompletedProcess(args, 1, stdout="", stderr="Unit voxip-kiosk-update-now.service already exists.")
+
+    helper.run = busy
+    with pytest.raises(h.HelperError, match="al een update"):
+        helper.dispatch("update-install", [])

tests/test_updater.py

@@ -0,0 +1,198 @@
+import hashlib
+import io
+import json
+import subprocess
+import tarfile
+
+import pytest
+
+from voxip_kiosk import updater as u
+from voxip_kiosk.config import save_config
+
+API = u.RELEASE_API
+BASE = "https://git.example.nl/rothman/daynivo-kiosk-os/releases/download"
+
+
+def make_tarball(version, files=None, top=None):
+    """A release archive like `git archive --prefix=daynivo-kiosk-os-<v>/` makes."""
+    top = top or f"daynivo-kiosk-os-{version}"
+    files = files or {"VERSION": f"{version}\n", "update.sh": "#!/bin/sh\n"}
+    buf = io.BytesIO()
+    with tarfile.open(fileobj=buf, mode="w:gz") as tar:
+        for name, content in files.items():
+            data = content.encode()
+            info = tarfile.TarInfo(f"{top}/{name}" if not name.startswith(("/", "..")) else name)
+            info.size = len(data)
+            info.mode = 0o755
+            tar.addfile(info, io.BytesIO(data))
+    return buf.getvalue()
+
+
+def release_json(version, assets=True):
+    names = [f"daynivo-kiosk-os-{version}.tar.gz", f"daynivo-kiosk-os-{version}.tar.gz.sha256"] if assets else []
+    return {
+        "tag_name": f"v{version}",
+        "html_url": f"https://git.example.nl/rothman/daynivo-kiosk-os/releases/tag/v{version}",
+        "assets": [{"name": n, "browser_download_url": f"{BASE}/v{version}/{n}"} for n in names],
+    }
+
+
+class Server:
+    """Stands in for the Gitea API and asset downloads."""
+
+    def __init__(self, version="1.2.0", tarball=None, checksum=None):
+        self.version = version
+        self.tarball = tarball if tarball is not None else make_tarball(version)
+        self.checksum = checksum or hashlib.sha256(self.tarball).hexdigest()
+        self.release = release_json(version)
+        self.down = False
+
+    def __call__(self, url, limit=u.MAX_DOWNLOAD, timeout=30):
+        if self.down:
+            raise u.UpdateError("Downloaden mislukt: geen verbinding")
+        if url == API:
+            return json.dumps(self.release).encode()
+        if url.endswith(".tar.gz"):
+            return self.tarball
+        if url.endswith(".sha256"):
+            return f"{self.checksum}  daynivo-kiosk-os-{self.version}.tar.gz\n".encode()
+        raise AssertionError(url)
+
+
+class Run:
+    def __init__(self, returncode=0, stderr=""):
+        self.calls = []
+        self.returncode = returncode
+        self.stderr = stderr
+
+    def __call__(self, args, **kwargs):
+        self.calls.append(args)
+        return subprocess.CompletedProcess(args, self.returncode, stdout="", stderr=self.stderr)
+
+
+@pytest.fixture
+def make(paths, tmp_path):
+    (paths.share_dir / "VERSION").write_text("1.1.0\n")
+
+    def factory(server=None, run=None):
+        server = server or Server()
+        run = run or Run()
+        updater = u.Updater(paths, get=server, run=run, release_dir=tmp_path / "opt", cache_dir=tmp_path / "cache",
+                            now=lambda: 1_800_000_000)
+        return updater, server, run
+
+    return factory
+
+
+def test_versions():
+    assert u.parse_version("v1.2.3") == (1, 2, 3)
+    assert u.parse_version("1.2") is None
+    assert u.is_newer("1.10.0", "1.9.9")
+    assert not u.is_newer("1.1.0", "1.1.0")
+    assert not u.is_newer("1.0.9", "1.1.0")
+    assert u.is_newer("1.1.0", "1.0.0-dev")
+
+
+def test_release_needs_both_assets():
+    with pytest.raises(u.UpdateError, match="mist"):
+        u.parse_release(release_json("1.2.0", assets=False))
+    with pytest.raises(u.UpdateError, match="versienummer"):
+        u.parse_release({**release_json("1.2.0"), "tag_name": "nightly"})
+
+
+def test_check_records_an_available_update(make, paths):
+    updater, _, run = make()
+    state, release = updater.check()
+    assert release.version == "1.2.0"
+    assert state["available"] is True and state["current"] == "1.1.0" and state["latest"] == "1.2.0"
+    assert json.loads(paths.update_state_file.read_text())["checked_at"] == 1_800_000_000
+    assert run.calls == []
+
+
+def test_check_when_up_to_date_or_offline(make):
+    updater, server, _ = make(Server(version="1.1.0"))
+    state, release = updater.check()
+    assert release is None and state["available"] is False
+
+    server.down = True
+    state, release = updater.check()
+    assert release is None and "geen verbinding" in state["check_error"]
+    assert state["latest"] == "1.1.0"  # the last known answer stays visible
+
+
+def test_install_unpacks_and_runs_update_sh(make, tmp_path, paths):
+    updater, _, run = make()
+    _, release = updater.check()
+    state = updater.install(release)
+    assert state["status"] == "done" and state["current"] == "1.2.0" and state["available"] is False
+    folder = tmp_path / "opt" / "1.2.0"
+    assert run.calls == [[str(folder / "update.sh"), "--no-pull"]]
+    assert (folder / "VERSION").read_text().strip() == "1.2.0"
+
+
+def test_install_refuses_a_bad_checksum(make, tmp_path):
+    updater, _, run = make(Server(checksum="0" * 64))
+    _, release = updater.check()
+    state = updater.install(release)
+    assert state["status"] == "failed" and "Checksum" in state["install_error"]
+    assert run.calls == []
+    assert not (tmp_path / "opt" / "1.2.0").exists()
+
+
+def test_install_refuses_paths_outside_the_release(make):
+    tarball = make_tarball("1.2.0", {"VERSION": "1.2.0\n", "../../etc/evil": "x"})
+    updater, _, run = make(Server(tarball=tarball))
+    _, release = updater.check()
+    state = updater.install(release)
+    assert state["status"] == "failed" and "Onveilig" in state["install_error"]
+    assert run.calls == []
+
+
+def test_install_refuses_a_mislabelled_release(make):
+    updater, _, run = make(Server(tarball=make_tarball("1.2.0", {"VERSION": "9.0.0\n"})))
+    _, release = updater.check()
+    assert updater.install(release)["status"] == "failed"
+    assert run.calls == []
+
+
+def test_install_reports_a_failing_installer(make):
+    updater, _, _ = make(run=Run(returncode=1, stderr="apt-get: kon niet verbinden"))
+    _, release = updater.check()
+    state = updater.install(release)
+    assert state["status"] == "failed" and "apt-get" in state["install_error"]
+
+
+def test_never_installs_an_older_version(make):
+    updater, _, _ = make()
+    with pytest.raises(u.UpdateError):
+        updater.install(u.Release("1.0.0", f"{BASE}/a.tar.gz", f"{BASE}/a.sha256", ""))
+
+
+def test_keeps_only_the_newest_releases(make, tmp_path):
+    updater, _, _ = make()
+    for old in ("1.0.0", "1.0.1", "1.1.0"):
+        (tmp_path / "opt" / old).mkdir(parents=True)
+    _, release = updater.check()
+    updater.install(release)
+    assert sorted(p.name for p in (tmp_path / "opt").iterdir()) == ["1.1.0", "1.2.0"]
+
+
+def test_auto_mode_installs_only_when_switched_on(make, paths):
+    updater, _, run = make()
+    assert u.main(["--auto"], updater=updater) == 0
+    assert run.calls == []
+
+    save_config(paths.config_file, {"auto_update": True})
+    (paths.health_run_dir / "maintenance").touch()
+    assert u.main(["--auto"], updater=updater) == 0
+    assert run.calls == []
+
+    (paths.health_run_dir / "maintenance").unlink()
+    assert u.main(["--auto"], updater=updater) == 0
+    assert len(run.calls) == 1
+
+
+def test_check_mode_never_installs(make):
+    updater, _, run = make()
+    assert u.main(["--check"], updater=updater) == 0
+    assert run.calls == []

tests/test_web.py

@@ -305,3 +305,24 @@ def test_actions_menu_on_every_page(logged_in, path):
     html = logged_in.get(path).get_data(as_text=True)
     for action in ("/kiosk/reload", "/kiosk/restart", "/system/reboot", "/system/poweroff"):
         assert f'action="{action}"' in html
+
+
+def test_system_page_shows_update_state(logged_in, paths):
+    paths.update_state_file.write_text(json.dumps({"current": "1.1.0", "latest": "1.2.0", "available": True, "checked_at": 1_800_000_000}))
+    body = logged_in.get("/system").get_data(as_text=True)
+    assert "Software-updates" in body and "Bijwerken naar 1.2.0" in body
+
+
+def test_auto_update_setting(logged_in, paths):
+    logged_in.post("/system/updates", data={"csrf_token": token(logged_in), "auto_update": "1"})
+    assert load_config(paths.config_file)["auto_update"] is True
+    logged_in.post("/system/updates", data={"csrf_token": token(logged_in)})
+    assert load_config(paths.config_file)["auto_update"] is False
+
+
+def test_update_check_and_install_go_through_the_helper(logged_in, fake_helper):
+    fake_helper.responses["update-check"] = {"update": {"current": "1.1.0", "latest": "1.2.0", "available": True}}
+    resp = logged_in.post("/system/update/check", data={"csrf_token": token(logged_in)}, follow_redirects=True)
+    assert "Versie 1.2.0 is beschikbaar" in resp.get_data(as_text=True)
+    logged_in.post("/system/update/install", data={"csrf_token": token(logged_in)})
+    assert [c[0] for c in fake_helper.calls] == ["update-check", "update-install"]

tools/release-upload.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+#
+# Attach files to the Gitea release of a tag, creating the release if needed.
+# Used by .github/workflows/release.yml (Gitea Actions).
+#
+#   GITEA_API=https://git.example.nl/api/v1/repos/owner/repo GITEA_TOKEN=… \
+#     tools/release-upload.sh v1.2.3 file…
+#
+# An asset that already exists under the same name is replaced, so a re-run
+# of the workflow (e.g. after a failed image build) is safe.
+
+set -euo pipefail
+
+TAG="${1:?tag vereist}"
+shift
+: "${GITEA_API:?GITEA_API vereist}" "${GITEA_TOKEN:?GITEA_TOKEN vereist}"
+AUTH=(-H "Authorization: token $GITEA_TOKEN")
+
+if ! release="$(curl -fsS "${AUTH[@]}" "$GITEA_API/releases/tags/$TAG")"; then
+  version="${TAG#v}"
+  body="$(python3 -I -c 'import json, sys; print(json.dumps({"tag_name": sys.argv[1], "name": "Daynivo Kiosk OS " + sys.argv[2], "body": sys.argv[3]}))' \
+    "$TAG" "$version" "Installeren of bijwerken: zie de README. Het SD-image volgt zodra het gebouwd is.")"
+  release="$(curl -fsS "${AUTH[@]}" -H "Content-Type: application/json" -d "$body" "$GITEA_API/releases")"
+fi
+id="$(python3 -I -c 'import json, sys; print(json.load(sys.stdin)["id"])' <<<"$release")"
+
+asset_id() {  # id of an existing asset with this name, or nothing
+  python3 -I -c '
+import json, sys
+release = json.load(sys.stdin)
+print(next((str(a["id"]) for a in release.get("assets") or [] if a["name"] == sys.argv[1]), ""))' "$1" <<<"$release"
+}
+
+for file in "$@"; do
+  name="$(basename "$file")"
+  old="$(asset_id "$name")"
+  if [[ -n $old ]]; then
+    curl -fsS "${AUTH[@]}" -X DELETE "$GITEA_API/releases/$id/assets/$old" >/dev/null
+  fi
+  echo "==> $name uploaden"
+  curl -fsS "${AUTH[@]}" -F "attachment=@$file" "$GITEA_API/releases/$id/assets?name=$name" >/dev/null
+done

uninstall.sh

@@ -17,7 +17,7 @@ PURGE=0
 
 UNITS=(voxip-kiosk-healthcheck.timer voxip-kiosk-healthcheck.service voxip-kiosk-agent.service
        voxip-kiosk-browser.service voxip-kiosk-x.service voxip-kiosk-manager.service
-       voxip-network-guard.service voxip-boot-import.service)
+       voxip-network-guard.service voxip-boot-import.service voxip-kiosk-update.timer voxip-kiosk-update.service)
 
 PREVIOUS_TARGET="$(cat /var/lib/voxip-kiosk/previous-default-target 2>/dev/null || true)"
 PREVIOUS_SPLASH="$(cat /var/lib/voxip-kiosk/previous-plymouth-theme 2>/dev/null || true)"
@@ -33,7 +33,7 @@ systemctl daemon-reload
 
 echo "==> Bestanden verwijderen"
 rm -rf /usr/lib/voxip-kiosk /usr/share/voxip-kiosk /usr/share/doc/voxip-kiosk
-rm -f /usr/local/sbin/voxip-kiosk-ctl
+rm -f /usr/local/sbin/daynivo-kiosk-ctl /usr/local/sbin/voxip-kiosk-ctl
 rm -f /etc/sudoers.d/voxip-kiosk
 rm -f /etc/systemd/journald.conf.d/voxip-kiosk.conf /etc/systemd/system.conf.d/voxip-watchdog.conf
 rm -f /etc/logrotate.d/voxip-kiosk /etc/avahi/services/voxip-kiosk.service
@@ -57,6 +57,8 @@ fi
 if [[ $PURGE -eq 1 ]]; then
   echo "==> Configuratie, status, logs en gebruikers verwijderen"
   rm -rf /etc/voxip-kiosk /var/lib/voxip-kiosk /var/lib/voxip-kiosk-network /var/lib/voxip-kiosk-browser /var/log/voxip-kiosk
+  # Downloaded releases (install-online.sh and the updater); safe even when running from there.
+  rm -rf /opt/daynivo-kiosk-os /var/cache/voxip-kiosk
   rm -f /etc/NetworkManager/system-connections/voxip-eth0.nmconnection /etc/NetworkManager/system-connections/voxip-wlan0.nmconnection
   nmcli connection reload 2>/dev/null || true
   userdel -r kiosk 2>/dev/null || true

www/setup.html

@@ -44,7 +44,7 @@
       li.textContent = u;
       list.appendChild(li);
     });
-    document.getElementById("code").textContent = params.get("code") || "zie: sudo voxip-kiosk-ctl setup-code";
+    document.getElementById("code").textContent = params.get("code") || "zie: sudo daynivo-kiosk-ctl setup-code";
   </script>
 </body>
 </html>