#!/bin/sh
#
# cloudflared-update — upgrade cloudflared via apt and restart the tunnel only
# when the version actually changed. Run daily by cloudflared-update.timer.
#
# cloudflared's built-in autoupdate disables itself for apt installs, and the
# unprivileged, read-only service couldn't replace its own binary anyway.
set -eu

before=$(dpkg-query -W -f='${Version}' cloudflared)
# Refresh every source: cloudflared may come from Cloudflare's repo or from a
# mirror in your own. A broken unrelated source shouldn't block the upgrade.
apt-get update -qq || echo "apt-get update reported errors; continuing" >&2
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --only-upgrade \
  -o DPkg::Lock::Timeout=300 cloudflared
after=$(dpkg-query -W -f='${Version}' cloudflared)

if [ "$before" != "$after" ]; then
  echo "cloudflared upgraded ${before} -> ${after}; restarting tunnel"
  systemctl try-restart cloudflared-tunnel.service
else
  echo "cloudflared ${after} is up to date"
fi
