Merge pull request #1741 from denkfabrik-li/fix/zips-queue-check-reachable

ensure_worker_watches_zips() exists because a worker unit written before zip downloads had their own queue watches default only, and a zip enqueued to zips then waits forever with nothing to say why. It was called from exactly one place: inside the branch that reloads PHP-FPM, nested inside the branch that found a worker unit -- so it ran only when a PHP-FPM unit had been detected. A worker is a different unit from PHP-FPM, and not finding one says nothing about the other: a host running mod_php, or one whose FPM unit is named in a way this script does not recognise, still has a systemd worker that may predate the zips queue, and it got no check and no mention.

The check now also runs in the else branch, where it costs nothing -- its own first line returns immediately unless systemd and a worker unit are both present -- and the worker is restarted after it, paired exactly as the FPM branch pairs them. That pairing is the point: the new --queue argument reaches the worker only when systemd next starts it from ExecStart, and the queue:restart projectsend:update signals cannot deliver it, because that makes a worker pick up new code and it has already run by the time this block is reached. Editing the unit without a restart would leave the operator told that zip downloads were fixed while they still could not finish, which is worse than the silence it replaces: silence sends somebody looking and a success message does not.

Under --no-restart it is said rather than done. Editing a unit file is exactly what that flag asks us not to do, but a worker that cannot finish a zip is broken whether or not we may touch it, and this is the only place that knows to mention it.

Verified before merging: bash -n parses, and the restart block was driven through four host shapes with say, warn, systemctl and the check itself stubbed, on both this branch and main, rather than relying on the transcript in the PR. Before: fpm+worker reached; worker without fpm silent; --no-restart silent; no systemd silent. After: the first two both reached and restarted, --no-restart not reached but said so, no systemd reached and a no-op. That no-op rests on update.sh:330, which returns unless systemd and a worker unit are both present, so it was read rather than assumed.

Reported and fixed by @denkfabrik-li.

update.sh

@@ -698,6 +698,11 @@ Then reload PHP-FPM, and bring the site back with: php artisan up"
     if [[ "$NO_RESTART" == "1" ]]; then
         warn "Not touching systemd, as asked."
         warn "PHP is still running the old code until you reload it — ProjectSend will keep telling your staff so."
+        # Said rather than done: the check below edits a unit file, which is
+        # exactly what --no-restart asks us not to do. But a worker that
+        # predates the zips queue is broken whether or not we are allowed to
+        # touch it, and this is the only place that knows to mention it.
+        warn "Your worker's queues were not checked either. If it predates the zips queue, zip downloads never finish — run without --no-restart, or add 'zips' to its --queue list yourself."
     elif [[ "${SYSTEMD:-0}" == "1" && -n "${FPM_SERVICE:-}" ]]; then
         say "Reloading $FPM_SERVICE"
         systemctl reload "$FPM_SERVICE" 2>/dev/null || systemctl restart "$FPM_SERVICE" \
@@ -713,6 +718,29 @@ Then reload PHP-FPM, and bring the site back with: php artisan up"
         fi
     else
         warn "No PHP-FPM service was found to reload. Reload PHP yourself now, or it keeps serving the old code."
+
+        # The worker is a different unit from PHP-FPM, and not finding one
+        # says nothing about the other: a host running mod_php, or one where
+        # the FPM unit is named in a way this script does not recognise, can
+        # still have a systemd worker that predates the zips queue. The
+        # function returns immediately unless systemd and a worker unit are
+        # both there, so reaching it from here costs nothing and stops this
+        # branch being the one place the queue is never mentioned.
+        ensure_worker_watches_zips
+
+        # Paired with the edit, exactly as the FPM branch above pairs them,
+        # and for the reason its comment gives: the new --queue argument
+        # only reaches the worker when systemd next starts it from
+        # ExecStart. projectsend:update's queue:restart cannot deliver it —
+        # that makes a worker pick up new *code*, and it has already run by
+        # the time we get here, so the worker came back on the old command
+        # line. Without this, the unit is edited, the operator is told so,
+        # and zips still never finish: a false completion, which is worse
+        # than the silence this branch used to keep.
+        if [[ "${SYSTEMD:-0}" == "1" && -n "${WORKER_SERVICE:-}" ]]; then
+            say "Restarting $WORKER_SERVICE"
+            systemctl restart "$WORKER_SERVICE" || warn "Could not restart $WORKER_SERVICE."
+        fi
     fi
 
     say "Bringing the site back up"