# FOTA & WireGuard Update Automation (`update.sh`)

This document outlines the system requirements, expectations, and usage of the automated update script [`update.sh`](./update.sh).

---

## 1. Prerequisites on the Remote Device

The target remote device must meet the following requirements:

### **Operating System & Privileges**
- **Linux** OS with `systemd` as the init system.
- **Root / `sudo` privileges** to stop/restart services and write to `/usr/local/bin`.

### **Installed CLI Tools**
- `wget` (for downloading binaries over HTTPS/HTTP).
- `bash` (shell interpreter).
- `systemctl` (systemd service management).
- `wg` (`wireguard-tools` package, for checking tunnel status with `wg show`).

---

## 2. Expected System Services & Target Paths

The script expects the target device to already have the following paths and services configured:

| Component | Target File Location | Associated Systemd Service |
| :--- | :--- | :--- |
| **FOTA Updater** | `/usr/local/bin/fota-updater` | `fota-updater.service` |
| **WireGuard Client** | `/usr/local/bin/wg-client` | `wg-client.service` |

*(Note: The script uses `|| true` when stopping/status checking, so if a service does not exist yet or fails, the script will continue rather than abort abruptly).*

---

## 3. Remote Server File Expectations

The script expects the hosting server (`BASE_URL`) to provide direct HTTP/HTTPS downloads for:
- `${BASE_URL}/fota-updater`
- `${BASE_URL}/wg-client`

By default, `BASE_URL` points to:
```text
https://marichi.tailce278e.ts.net
```

---

## 4. How It Works (Step-by-Step)

1. **Creates a secure temporary directory** using `mktemp -d`.
2. **Downloads both binaries** to the temp directory using `wget -O` (guarantees old `.1` or `.2` files aren't created).
3. **Marks downloaded binaries as executable** (`chmod +x`).
4. **Updates `fota-updater`**:
   - Stops `fota-updater.service`.
   - Copies new binary to `/usr/local/bin/fota-updater`.
   - Sets executable permissions.
   - Restarts `fota-updater.service` and prints status without pagination (`--no-pager`).
5. **Updates `wg-client`**:
   - Stops `wg-client.service`.
   - Copies new binary to `/usr/local/bin/wg-client`.
   - Sets executable permissions.
   - Restarts `wg-client.service` and prints status.
6. **Displays WireGuard status** via `sudo wg show`.
7. **Cleans up**: Automatically deletes the temporary download directory upon exit (via `trap ... EXIT`).

---

## 5. Usage Commands

### **Option A: Default (Tailscale Funnel)**
One-line download and run:
```bash
wget -O update.sh https://marichi.tailce278e.ts.net/update.sh && chmod +x update.sh && ./update.sh
```

Or run via curl:
```bash
curl -sSL https://marichi.tailce278e.ts.net/update.sh | bash
```

### **Option B: Using Cloudflare Tunnel**
Use a variable so the URL is passed automatically to `update.sh`:
```bash
URL="https://<subdomain>.trycloudflare.com"; wget -O update.sh "$URL/update.sh" && chmod +x update.sh && ./update.sh "$URL"
```

Or via curl:
```bash
URL="https://<subdomain>.trycloudflare.com"; curl -sSL "$URL/update.sh" | bash -s -- "$URL"
```

### **Option C: Using Local LAN IP**
If the device is on the same local network:
```bash
./update.sh http://192.168.1.50:8888
```

---

## 6. Hosting / Serving from a Linux Machine

If you are running the host server on a **Linux machine** instead of Windows, use the commands below.

### **A. Quick One-Liner (Start Everything on Linux)**

From your files directory (e.g. `~/arm`):

```bash
# 1. Start Python server in background on port 8888
nohup python3 -m http.server 8888 --directory . > server.log 2>&1 &

# 2. Start Tailscale Funnel in background
tailscale funnel --bg 8888

# 3. (Optional) Start Cloudflare Tunnel in background
nohup cloudflared tunnel --url http://127.0.0.1:8888 --logfile cloudflared.log >/dev/null 2>&1 &
```

---

### **B. Check Active URLs on Linux**

```bash
# Tailscale Funnel Status & URL:
tailscale funnel status

# Cloudflare Tunnel URL:
grep -o "https://[a-zA-Z0-9-]\+\.trycloudflare\.com" cloudflared.log | tail -n 1
```

---

### **C. Stop Everything on Linux**

```bash
# Stop Python server & Cloudflare tunnel
pkill -f "python3 -m http.server 8888" || true
pkill -f "cloudflared" || true

# Stop Tailscale Funnel
tailscale funnel --https=443 off
```

---

### **D. Native Linux Tailscale Option (Direct Folder Serving)**

On Linux, Tailscale can serve a directory directly without needing a separate Python server:

```bash
# Serve current directory publicly via Tailscale Funnel
sudo tailscale funnel --bg .

# Check status
tailscale funnel status

# Turn off
tailscale funnel --https=443 off
```