Add self-update support and improve install/update flow

Author: luizbizzio

README.md

@@ -16,23 +16,15 @@ It can automatically deploy certificates and reload supported services:
 
 It is officially supported on Debian-based distributions (Debian, Ubuntu, Raspberry Pi OS, Armbian). Other Linux distributions may work but are not officially supported.
 
-## 🚀 One-Step Automated Install
+## 🚀 One-Step Install / Update
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/luizbizzio/local-https/main/install.sh | sudo bash
 ```
 
-That installs the command to:
+The installer downloads and verifies the latest `local-https`, then installs it to `/usr/local/sbin/local-https`.
 
-- `/usr/local/sbin/local-https`
-
-Then it runs the setup flow (`local-https --install`) and offers auto-renew (systemd timer recommended).
-
-During the interactive install you are asked for a **domain name** to add to the certificate (default `pi.hole`). Pick whatever your network uses (e.g. `home.lan`, `dns.home`). To set it non-interactively, pass it as an environment variable:
-
-```bash
-curl -fsSL https://raw.githubusercontent.com/luizbizzio/local-https/main/install.sh | sudo LOCAL_HTTPS_DOMAIN=home.lan bash
-```
+On a new installation, or if the initial setup was never completed, it asks whether you want to start the setup. If `local-https` is already configured, running the same command only updates the program and keeps your existing certificates and configuration.
 
 -----
 
@@ -48,6 +40,7 @@ curl -fsSL https://raw.githubusercontent.com/luizbizzio/local-https/main/install
   - `server.pem` (cert + key, for services like Pi-hole)
   - `server.pfx` (password-protected, for services like Technitium)
 - 🔁 Can enable **automatic renewal** via **systemd timer** (or cron fallback)
+- ⬆️ Can check GitHub for a newer version and update itself with `--update`
 - 🧠 On renewal, it only “deploys/restarts” if a new cert was actually created (unless forced)
 
 -----
@@ -56,18 +49,50 @@ curl -fsSL https://raw.githubusercontent.com/luizbizzio/local-https/main/install
 
 | Command | What it does |
 |---|---|
-| `local-https --version` | Prints the installed `local-https` version |
+| `local-https --version` / `--v` / `-V` | Prints the installed `local-https` version |
+| `sudo local-https --update` | Checks GitHub for a newer version and asks before updating |
+| `sudo local-https --update --yes` | Updates without asking for confirmation |
 | `sudo local-https --install` | Full setup (Root CA, server cert, PEM/PFX, permissions, auto-renew, optional Pi-hole deploy, Technitium TLS if detected) |
 | `sudo local-https --renew` | Renew if needed (near expiry window). If nothing to do, exits fast |
 | `sudo local-https --renew --force-renew` | Forces a new server certificate + rebuilds PFX + restarts detected services |
-| `sudo local-https --status` | Shows current status and last run info |
+| `sudo local-https --status` | Shows the installed version, current status, and last run info |
 | `sudo local-https --check` | Exit code indicates if renewal is needed |
 | `sudo local-https --configure` | Re-run deploy steps for Pi-hole / Technitium without reinstalling everything |
 | `sudo local-https --print-ca` | Prints `rootCA.crt` (useful to copy to devices) |
 | `sudo local-https --print-pfx-pass` | Prints the PFX password (stored in a root-only file) |
 | `sudo local-https --rotate-pfx-pass` | Rotates PFX password, rebuilds PFX, updates Technitium TLS settings |
 | `sudo local-https --uninstall [--yes] [--purge-certs]` | Removes installed files and optionally deletes generated certs |
 
+### ⬆️ Updating later
+
+Once installed, you can check for a newer version without using the full `curl` command again:
+
+```bash
+sudo local-https --update
+```
+
+If a newer version is available, `local-https` shows the current and latest versions and asks before installing it. The update only replaces the program itself; your existing Root CA, certificates, state, and service configuration are kept.
+
+For non-interactive updates:
+
+```bash
+sudo local-https --update --yes
+```
+
+-----
+
+## ⚙️ Reconfigure services
+
+Use `--configure` when you want to re-detect and reapply supported service integrations without reinstalling `local-https`.
+
+```bash
+sudo local-https --configure
+```
+
+This re-checks Pi-hole and Technitium, reapplies certificate permissions and TLS deployment, and keeps your existing Root CA and installation.
+
+This is useful after installing or changing Pi-hole or Technitium, or when you want to run the integration setup again.
+
 -----
 
 ## 🌐 Custom domain
@@ -138,7 +163,7 @@ sudo systemd-run --unit=local-https-renew-force --service-type=oneshot   /usr/lo
 - If Technitium is detected, the script can configure Technitium Web UI TLS to use:
   - `server.pfx` + the stored password
 - Supports both legacy Technitium Linux installations running as root and newer non-root installations.
-- For non-root installations, the Technitium service user is automatically granted access to the `certs` group when required.
+- If the Technitium `dns-server` account exists, it is automatically granted access to the `certs` group. Custom non-root Technitium service users are supported as well.
 - If the Technitium systemd service restricts filesystem access, `local-https` automatically creates a systemd drop-in granting read-only access to `server.pfx`.
 - On renew (when a new cert is created), it restarts the Technitium service so the new cert is loaded.
 

install.sh

@@ -10,18 +10,18 @@ export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 
 REPO_RAW_BASE_DEFAULT="https://raw.githubusercontent.com/luizbizzio/local-https/main"
 REPO_RAW_BASE="${LOCAL_HTTPS_RAW_BASE:-$REPO_RAW_BASE_DEFAULT}"
-
 SCRIPT_NAME="local-https"
 INSTALL_PATH="/usr/local/sbin/local-https"
 SOURCE_URL_DEFAULT="${REPO_RAW_BASE}/local-https.sh"
 SOURCE_URL="${LOCAL_HTTPS_SOURCE_URL:-$SOURCE_URL_DEFAULT}"
 
-EXPECTED_SHA256_DEFAULT="dd9404dbdbfa30fc019a35688fed4e0134ce3a02e32387eb75df480217389e8a"
+EXPECTED_SHA256_DEFAULT="506f6d21061f80faba2aa7a8c8207f1b36485bd0c8ea9eaed7eb975b5b13abe8"
 EXPECTED_SHA256="${LOCAL_HTTPS_EXPECTED_SHA256:-$EXPECTED_SHA256_DEFAULT}"
 
 NONINTERACTIVE="${LOCAL_HTTPS_NONINTERACTIVE:-0}"
+UPDATE_ONLY="${LOCAL_HTTPS_UPDATE_ONLY:-0}"
 case "$NONINTERACTIVE" in 1|true|TRUE|yes|YES) NONINTERACTIVE=1 ;; *) NONINTERACTIVE=0 ;; esac
-
+case "$UPDATE_ONLY" in 1|true|TRUE|yes|YES) UPDATE_ONLY=1 ;; *) UPDATE_ONLY=0 ;; esac
 out() { printf '%b\n' "$1"; }
 die() { printf '%b\n' "\033[31m[ERROR]\033[0m $1\n" >&2; exit 1; }
 need_cmd() { command -v "$1" >/dev/null 2>&1 || die "Missing dependency: $1"; }
@@ -44,7 +44,6 @@ curl_fetch() {
     -o "$out_file" \
     "$url"
 }
-
 sha256_of_file() {
   local f="$1"
   if command -v sha256sum >/dev/null 2>&1; then
@@ -66,7 +65,6 @@ verify_sha256_if_set() {
   local f="$1"
 
   [ -n "$EXPECTED_SHA256" ] || return 0
-
   local got=""
   got="$(sha256_of_file "$f" 2>/dev/null || true)"
   [ -n "$got" ] || die "Cannot compute SHA-256."
@@ -84,13 +82,24 @@ sanity_check_script() {
   [ "$(wc -c < "$f")" -ge 2000 ] || die "Downloaded file too small."
 
   head -n 1 "$f" | grep -Eq '^#!' || die "Missing shebang."
-
   if head -n 5 "$f" | grep -Eqi '<!doctype html|<html|404'; then
     die "Downloaded content looks like HTML."
   fi
 
   grep -qE 'SCRIPT_CMD_NAME="local-https"|parse_cli' "$f" || \
     die "Downloaded file does not look like local-https.sh."
+
+  bash -n "$f" >/dev/null 2>&1 || die "Downloaded local-https.sh failed syntax validation."
+}
+
+script_version_from_file() {
+  local f="$1"
+  awk -F'"' '/^[[:space:]]*VERSION="[0-9]+\.[0-9]+\.[0-9]+"/ { print $2; exit }' "$f" 2>/dev/null || true
+}
+
+installed_version() {
+  [ -x "$INSTALL_PATH" ] || return 0
+  "$INSTALL_PATH" --version 2>/dev/null | awk '{ print $NF; exit }' || true
 }
 
 install_atomic() {
@@ -109,7 +118,6 @@ install_atomic() {
   mv -f "$tmpdst" "$dst"
 }
 
-
 run_installer_interactive() {
   out "\033[36m[INFO]\033[0m Running: local-https --install"
 
@@ -121,7 +129,6 @@ run_installer_interactive() {
       LOCAL_HTTPS_DOMAIN="${LOCAL_HTTPS_DOMAIN:-}" \
       "$INSTALL_PATH" --install
   fi
-
   exec env \
     LOCAL_HTTPS_BOOTSTRAP=1 \
     LOCAL_HTTPS_NONINTERACTIVE=1 \
@@ -130,6 +137,31 @@ run_installer_interactive() {
     "$INSTALL_PATH" --install
 }
 
+prompt_run_setup() {
+  if [ "$NONINTERACTIVE" -eq 1 ]; then
+    run_installer_interactive
+  fi
+
+  if [ ! -r /dev/tty ] || [ ! -w /dev/tty ]; then
+    out "\033[34m[INFO]\033[0m No interactive terminal detected. Running setup non-interactively."
+    run_installer_interactive
+  fi
+
+  local answer=""
+  printf '%b' "\033[36m[?]\033[0m Run the initial setup now? (Y/n): " >/dev/tty
+  read -r answer </dev/tty || answer=""
+
+  case "$answer" in
+    n|N|no|NO)
+      out "\033[34m[INFO]\033[0m Setup skipped."
+      out "\033[34m[INFO]\033[0m Run it later with: sudo local-https --install"
+      ;;
+    *)
+      run_installer_interactive
+      ;;
+  esac
+}
+
 main() {
   require_root
   need_cmd curl
@@ -143,11 +175,26 @@ main() {
   need_cmd mv
   need_cmd chmod
   need_cmd rm
-
+  need_cmd bash
   local tmp=""
-  cleanup() { [ -n "$tmp" ] && rm -f "$tmp" >/dev/null 2>&1 || true; }
+  cleanup() { [ -n "${tmp:-}" ] && rm -f "$tmp" >/dev/null 2>&1 || true; }
   trap cleanup EXIT
 
+  local had_binary=0
+  local was_configured=0
+  local current_version=""
+  local target_version=""
+
+  [ -f "$INSTALL_PATH" ] && had_binary=1
+
+  if [ -f "/var/lib/local-https/installed" ] || [ -f "/var/lib/local-https/state.env" ]; then
+    was_configured=1
+  fi
+
+  if [ "$had_binary" -eq 1 ]; then
+    current_version="$(installed_version)"
+  fi
+
   out "\033[36m[INFO]\033[0m Downloading: $SOURCE_URL"
 
   tmp="$(tmpfile_make)"
@@ -156,12 +203,58 @@ main() {
   verify_sha256_if_set "$tmp"
   sanity_check_script "$tmp"
 
-  out "\033[36m[INFO]\033[0m Installing: $INSTALL_PATH"
+  target_version="$(script_version_from_file "$tmp")"
+
+  if [ "$had_binary" -eq 1 ]; then
+    if [ -n "$current_version" ] && [ -n "$target_version" ] && [ "$current_version" = "$target_version" ]; then
+      out "\033[36m[INFO]\033[0m Reinstalling local-https v${target_version}..."
+    elif [ -n "$current_version" ] && [ -n "$target_version" ]; then
+      out "\033[36m[INFO]\033[0m Updating local-https v${current_version} -> v${target_version}..."
+    elif [ -n "$target_version" ]; then
+      out "\033[36m[INFO]\033[0m Updating local-https to v${target_version}..."
+    else
+      out "\033[36m[INFO]\033[0m Updating: $INSTALL_PATH"
+    fi
+  else
+    if [ -n "$target_version" ]; then
+      out "\033[36m[INFO]\033[0m Installing local-https v${target_version}..."
+    else
+      out "\033[36m[INFO]\033[0m Installing: $INSTALL_PATH"
+    fi
+  fi
+
   install_atomic "$tmp" "$INSTALL_PATH"
+  rm -f "$tmp" >/dev/null 2>&1 || true
+  tmp=""
+
+  if [ "$had_binary" -eq 1 ]; then
+    out "\033[32m[OK]\033[0m Updated: $INSTALL_PATH"
+  else
+    out "\033[32m[OK]\033[0m Installed: $INSTALL_PATH"
+  fi
 
-  out "\033[32m[OK]\033[0m Installed: $INSTALL_PATH"
+  "$INSTALL_PATH" --version 2>/dev/null || true
+
+  if [ "$UPDATE_ONLY" -eq 1 ]; then
+    if [ "$was_configured" -eq 1 ]; then
+      out "\033[34m[INFO]\033[0m Existing certificates and configuration were kept."
+    else
+      out "\033[34m[INFO]\033[0m Program updated. Initial setup was not changed."
+    fi
+    exit 0
+  fi
+
+  if [ "$was_configured" -eq 1 ]; then
+    out "\033[34m[INFO]\033[0m Existing certificates and configuration were kept."
+    exit 0
+  fi
+
+  if [ "$had_binary" -eq 1 ]; then
+    out "\033[34m[INFO]\033[0m No completed setup was detected."
+  fi
 
-  run_installer_interactive
+  echo ""
+  prompt_run_setup
 }
 
 main "$@"