From 29c1c4c8afc41303d00cde10950d42129c7c0f33 Mon Sep 17 00:00:00 2001
From: Joe Carstairs <me@joeac.net>
Date: Wed, 26 Aug 2026 09:37:14 +0100
Subject: fcgiwrap is self-updating

---
 playbook.yml                             |  1 +
 roles/fcgiwrap/files/update_fcgiwrap     | 18 ++++++++++++++
 roles/fcgiwrap/tasks/main.yml            | 40 ++++++++++++++++++++++++++++++++
 roles/fcgiwrap/templates/conf.d/fcgiwrap |  3 +++
 roles/git/tasks/main.yml                 | 28 +---------------------
 roles/git/templates/conf.d/fcgiwrap      |  3 ---
 6 files changed, 63 insertions(+), 30 deletions(-)
 create mode 100644 roles/fcgiwrap/files/update_fcgiwrap
 create mode 100644 roles/fcgiwrap/tasks/main.yml
 create mode 100644 roles/fcgiwrap/templates/conf.d/fcgiwrap
 delete mode 100644 roles/git/templates/conf.d/fcgiwrap

diff --git a/playbook.yml b/playbook.yml
index 3657033..c9a1444 100644
--- a/playbook.yml
+++ b/playbook.yml
@@ -39,6 +39,7 @@
   become: true
   roles:
     - nginx
+    - fcgiwrap
     - git
   vars_files:
     - common.yml
diff --git a/roles/fcgiwrap/files/update_fcgiwrap b/roles/fcgiwrap/files/update_fcgiwrap
new file mode 100644
index 0000000..f371b5d
--- /dev/null
+++ b/roles/fcgiwrap/files/update_fcgiwrap
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+apk upgrade
+
+fcgiwrap_pid="$(pgrep fcgiwrap | head -n 1)"
+if [ -z "$fcgiwrap_pid" ]
+then
+  rc-service fcgiwrap restart
+  exit 0
+fi
+
+fcgiwrap_proc_start_time="$(stat -Lc %Y /proc/${fcgiwrap_pid})"
+fcgiwrap_file_mtime="$(stat -Lc %Y $(which fcgiwrap))"
+
+if [ "$fcgiwrap_file_mtime" -gt "$fcgiwrap_proc_start_time" ]
+then
+  rc-service fcgiwrap restart
+fi
diff --git a/roles/fcgiwrap/tasks/main.yml b/roles/fcgiwrap/tasks/main.yml
new file mode 100644
index 0000000..7435274
--- /dev/null
+++ b/roles/fcgiwrap/tasks/main.yml
@@ -0,0 +1,40 @@
+- name: Install fcgiwrap
+  community.general.apk:
+    name: fcgiwrap
+
+- name: Configure fcgiwrap daemon
+  register: fcgiwrap_conf
+  vars:
+    fcgiwrap_socket: /run/fcgiwrap.sock
+    fcgiwrap_user: nginx
+    fcgiwrap_group: nginx
+  ansible.builtin.template:
+    src: conf.d/fcgiwrap
+    dest: /etc/conf.d/fcgiwrap
+    mode: "644"
+
+- name: Restart fcgiwrap daemon and configure to start on boot
+  when: fcgiwrap_conf is changed
+  ansible.builtin.service:
+    name: fcgiwrap
+    enabled: true
+    state: restarted
+
+- name: Start fcgiwrap daemon and configure to start on boot
+  when: not ( fcgiwrap_conf is changed )
+  ansible.builtin.service:
+    name: fcgiwrap
+    enabled: true
+    state: started
+
+- name: Install script to update fcgiwrap
+  ansible.builtin.template:
+    src: update_fcgiwrap
+    dest: /usr/bin/update_fcgiwrap
+    mode: "755"
+
+- name: Install daily crontab to update fcgiwrap
+  ansible.builtin.cron:
+    special_time: daily
+    name: Update fcgiwrap
+    job: /usr/bin/update_fcgiwrap
diff --git a/roles/fcgiwrap/templates/conf.d/fcgiwrap b/roles/fcgiwrap/templates/conf.d/fcgiwrap
new file mode 100644
index 0000000..65a40e8
--- /dev/null
+++ b/roles/fcgiwrap/templates/conf.d/fcgiwrap
@@ -0,0 +1,3 @@
+socket=unix:{{ fcgiwrap_socket }}
+user={{ fcgiwrap_user }}
+group={{ fcgiwrap_group }}
diff --git a/roles/git/tasks/main.yml b/roles/git/tasks/main.yml
index fffca7c..da4bbf2 100644
--- a/roles/git/tasks/main.yml
+++ b/roles/git/tasks/main.yml
@@ -1,8 +1,7 @@
-- name: Install cgit, fcgiwrap, git, and shadow
+- name: Install cgit, git, and shadow
   community.general.apk:
     name:
       - cgit
-      - fcgiwrap
       - git
       - shadow
 
@@ -42,31 +41,6 @@
     state: link
     mode: "750"
 
-- name: Configure fcgiwrap daemon
-  register: fcgiwrap_conf
-  vars:
-    fcgiwrap_socket: /run/fcgiwrap.sock
-    fcgiwrap_user: nginx
-    fcgiwrap_group: nginx
-  ansible.builtin.template:
-    src: conf.d/fcgiwrap
-    dest: /etc/conf.d/fcgiwrap
-    mode: "644"
-
-- name: Restart fcgiwrap daemon and configure to start on boot
-  when: fcgiwrap_conf is changed
-  ansible.builtin.service:
-    name: fcgiwrap
-    enabled: true
-    state: restarted
-
-- name: Start fcgiwrap daemon and configure to start on boot
-  when: not ( fcgiwrap_conf is changed )
-  ansible.builtin.service:
-    name: fcgiwrap
-    enabled: true
-    state: started
-
 - name: Install htpasswd file
   ansible.builtin.copy:
     src: htpasswd
diff --git a/roles/git/templates/conf.d/fcgiwrap b/roles/git/templates/conf.d/fcgiwrap
deleted file mode 100644
index 65a40e8..0000000
--- a/roles/git/templates/conf.d/fcgiwrap
+++ /dev/null
@@ -1,3 +0,0 @@
-socket=unix:{{ fcgiwrap_socket }}
-user={{ fcgiwrap_user }}
-group={{ fcgiwrap_group }}
-- 
cgit v1.2.3