From 1fb93fddaeb646c78fdab55f686c21141fa5ffd3 Mon Sep 17 00:00:00 2001
From: dovholuknf <46322585+dovholuknf@users.noreply.github.com>
Date: Thu, 23 Jul 2026 16:27:05 -0400
Subject: [PATCH] require stop to succeed and verify it starts back up

---
 dist/dist-packages/linux/dangerous.upgrade.linux.test.bash  | 5 +++++
 .../linux/openziti-controller/postinstall.bash              | 6 ++++++
 dist/dist-packages/linux/openziti-router/postinstall.bash   | 6 ++++++
 3 files changed, 17 insertions(+)

diff --git a/dist/dist-packages/linux/dangerous.upgrade.linux.test.bash b/dist/dist-packages/linux/dangerous.upgrade.linux.test.bash
index 8eb93ac55..8502ac721 100755
--- a/dist/dist-packages/linux/dangerous.upgrade.linux.test.bash
+++ b/dist/dist-packages/linux/dangerous.upgrade.linux.test.bash
@@ -263,6 +263,11 @@ _rtr_svc_env_md5="$(md5sum /opt/openziti/etc/router/service.env | awk '{print $1
 # and the admin's original bootstrap answers in bootstrap.env are preserved.
 upgrade_local_debs "${TMPDIR}"
 
+# postinstall must bring the services back itself; check before our own
+# explicit restarts below so a failed restart isn't masked.
+wait_for_service ziti-controller.service 30
+wait_for_service ziti-router.service 20
+
 # ============================================================
 # Phase 5: Verify migration
 # ============================================================
diff --git a/dist/dist-packages/linux/openziti-controller/postinstall.bash b/dist/dist-packages/linux/openziti-controller/postinstall.bash
index 74981c2c7..c91443c2d 100755
--- a/dist/dist-packages/linux/openziti-controller/postinstall.bash
+++ b/dist/dist-packages/linux/openziti-controller/postinstall.bash
@@ -23,6 +23,12 @@ upgrade() {
   # persistent account. Stop it first.
   if detectDynamicUserState && systemctl is-active --quiet "${SVC_USER}.service" 2>/dev/null; then
     systemctl stop "${SVC_USER}.service" || true
+    # createUser + migration below assume the transient DynamicUser is gone;
+    # if it's somehow still up, bail rather than migrate live state.
+    if systemctl is-active --quiet "${SVC_USER}.service" 2>/dev/null; then
+      echo "ERROR: could not stop ${SVC_USER}.service; aborting upgrade" >&2
+      exit 1
+    fi
     _MIGRATION_STOPPED_SERVICE=true
   fi
   createUser
diff --git a/dist/dist-packages/linux/openziti-router/postinstall.bash b/dist/dist-packages/linux/openziti-router/postinstall.bash
index f5b328383..5bb3cd1bf 100755
--- a/dist/dist-packages/linux/openziti-router/postinstall.bash
+++ b/dist/dist-packages/linux/openziti-router/postinstall.bash
@@ -23,6 +23,12 @@ upgrade() {
   # persistent account. Stop it first.
   if detectDynamicUserState && systemctl is-active --quiet "${SVC_USER}.service" 2>/dev/null; then
     systemctl stop "${SVC_USER}.service" || true
+    # createUser + migration below assume the transient DynamicUser is gone;
+    # if it's somehow still up, bail rather than migrate live state.
+    if systemctl is-active --quiet "${SVC_USER}.service" 2>/dev/null; then
+      echo "ERROR: could not stop ${SVC_USER}.service; aborting upgrade" >&2
+      exit 1
+    fi
     _MIGRATION_STOPPED_SERVICE=true
   fi
   createUser