foto-portfolio/admin/maintenance.php

<?php
/**
 * Maintenance: backups and software updates, both driven by the manage client
 * in manage-client/ (reference: https://manage.med0.de/client-docs/).
 *
 * The page holds no update or backup logic of its own — every button calls the
 * same documented function the CLI calls, so `php manage-client/bin/manage-client.php
 * backup` and the button below do exactly the same thing. The client ships a
 * drop-in panel of its own; this page replaces it so the backoffice keeps one
 * look, one login and one CSRF token.
 *
 * Results are rendered on the POST itself rather than after a redirect: an
 * update reports several lines (files copied, migrations run, backup location)
 * and a flash message holds one.
 */
require dirname(__DIR__) . '/app/bootstrap.php';
auth_require();

// An installation may legitimately not carry the client — it is one folder,
// and deploying by FTP works without it. Say so instead of dying on a require.
if (!is_file(APP_ROOT . '/manage-client/lib/client.php')) {
    admin_header('Maintenance', 'maintenance');
    echo '<h1>Maintenance</h1><div class="card"><p class="help" style="margin:0">'
        . 'The backup and update client is not installed: <code>manage-client/</code> '
        . 'is missing. See <code>docs/SETUP.md</code>, section 5a.</p></div>';
    admin_footer();
    exit;
}
require_once APP_ROOT . '/manage-client/lib/client.php';

$messages = [];
$errors   = [];

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();
    // Archiving media/ and uploading it runs well past the default limit.
    @set_time_limit(0);

    $action = (string)($_POST['action'] ?? '');

    try {
        if ($action === 'download') {
            // Validates the filename itself and throws on anything that is not
            // a backup of this installation.
            $path = manageBackupPath((string)($_POST['filename'] ?? ''));
            $size = filesize($path);
            $fh   = fopen($path, 'rb');
            if ($size === false || $fh === false) {
                throw new RuntimeException('Backup file could not be opened.');
            }
            header('Content-Type: application/zip');
            header('Content-Disposition: attachment; filename="' . addcslashes(basename($path), '"\\') . '"');
            header('Content-Length: ' . $size);
            header('Cache-Control: private, no-store');
            header('X-Content-Type-Options: nosniff');
            fpassthru($fh);
            fclose($fh);
            exit;
        }

        if ($action === 'backup') {
            $messages = array_merge($messages, maintenance_backup('manual'));
            manageHeartbeatSendQuietly();
        } elseif ($action === 'update') {
            // Deliberately a line here rather than a feature of the client: it
            // stays visible that the update takes a backup first, and the
            // update stops if that backup cannot be written.
            if (!empty($_POST['backup_first'])) {
                $messages = array_merge($messages, maintenance_backup('update'));
            }

            $result = manageUpdateApply(['force' => !empty($_POST['force'])]);
            $messages[] = sprintf(
                'Update deployed: %s → %s. %d files copied, %d replaced files saved to %s.',
                $result['from_version'] !== '' ? $result['from_version'] : 'unknown',
                $result['to_version'],
                $result['copied'],
                $result['backed_up'],
                $result['backup_dir'],
            );

            // Files are deployed even when the hook failed; that difference is
            // the whole point of reporting it separately.
            $hook = is_array($result['hook'] ?? null) ? $result['hook'] : [];
            $applied = $hook['migrations']['applied'] ?? [];
            if ($applied !== []) {
                $messages[] = 'Migrations run: ' . implode(', ', $applied);
            }
            if ($hook !== [] && empty($hook['success'])) {
                $errors[] = empty($hook['failed_migration'])
                    ? 'The files are deployed, but the post-update step failed: '
                        . (string)($hook['error'] ?? 'unknown')
                    : 'The files are deployed, but migration "' . (string)$hook['failed_migration']
                        . '" failed: ' . (string)($hook['error'] ?? 'unknown')
                        . ' Remaining migrations were not attempted — fix the cause, then use "Run migrations" below.';
            }
            manageHeartbeatSendQuietly();
        } elseif ($action === 'migrate') {
            $report = manageUpdateRunMigrations();
            if ($report['applied'] !== []) {
                $messages[] = 'Migrations run: ' . implode(', ', $report['applied']);
            }
            if (!$report['success']) {
                $errors[] = 'Migration "' . (string)$report['failed'] . '" failed: ' . (string)$report['error'];
            } elseif ($report['applied'] === []) {
                $messages[] = 'No pending migrations.';
            }
        } elseif ($action === 'heartbeat') {
            $result = manageHeartbeatSend();
            $messages[] = 'Status reported. Current release: '
                . (($result['latest'] ?? '') !== '' ? (string)$result['latest'] : 'none') . '.';
        }
    } catch (Throwable $e) {
        $errors[] = $e->getMessage();
    }
}

/**
 * One backup, reported as message lines. A failed upload is a warning, not a
 * failure: the archive exists locally either way.
 */
function maintenance_backup(string $trigger): array
{
    $record = manageBackupCreate($trigger);
    $lines = [sprintf(
        'Backup created: %s — %d files, %s.',
        $record['filename'],
        $record['file_count'],
        manageFormatBytes((int)$record['size']),
    )];
    foreach ($record['remote_uploads'] as $upload) {
        if (empty($upload['success'])) {
            $lines[] = 'Upload to ' . (string)$upload['target'] . ' failed: '
                . (string)($upload['error'] ?? 'unknown') . ' The local copy is intact.';
        }
    }
    return $lines;
}

/** An interval as something readable: 604800 -> "every 7 days". */
function maintenance_interval_text(int $seconds): string
{
    if ($seconds % 86400 === 0) {
        $days = intdiv($seconds, 86400);
        return $days === 1 ? 'daily' : 'every ' . $days . ' days';
    }
    if ($seconds % 3600 === 0) {
        $hours = intdiv($seconds, 3600);
        return $hours === 1 ? 'hourly' : 'every ' . $hours . ' hours';
    }
    return 'every ' . max(1, intdiv($seconds, 60)) . ' minutes';
}

// The one place that asks the manage server whether a release is waiting: it is
// a network round trip, so it happens when this page is opened and nowhere else.
// Never throws — an unreachable server still renders the page.
$status = manageClientStatus();

// State of the schedule in app/manage.php.
$autoInterval = (int)MANAGE_BACKUP_AUTO_INTERVAL_SECONDS;
$due = manage_due();
$lastAutoBackup = 0;
foreach ($status['backups'] as $backup) {
    if (in_array($backup['trigger'] ?? '', ['automatic', 'cron'], true)) {
        $lastAutoBackup = max($lastAutoBackup, strtotime((string)($backup['created_at'] ?? '')) ?: 0);
    }
}
$lastHeartbeat = (int)(json_read(manage_state_file())['heartbeat_at'] ?? 0);

// State of the optional cronjob in app/cron.php. Its schedule lives in the
// crontab, so the only thing worth showing is whether it is actually running.
$cron = cron_state();
$cronNote = null;
if (!empty($cron['last_run_at'])) {
    $cronNote = 'Last ' . date('Y-m-d H:i', (int)$cron['last_run_at'])
        . ', ' . count($cron['jobs'] ?? []) . ' job(s) in ' . (float)($cron['duration'] ?? 0) . 's';
    if ((int)($cron['remaining'] ?? 0) > 0) {
        $cronNote .= ', ' . (int)$cron['remaining'] . ' gallery(s) still queued';
    }
}

// An instance whose server has no release yet answers the manifest with 404.
// That is a normal state — a new project, nothing published — and reads far
// too much like a broken connection when it is shown as a failed check.
$noReleaseYet = $status['update_error'] !== null
    && str_contains($status['update_error'], 'HTTP 404');
$update = $status['update'];
$capabilities = manageRemoteCapabilities();

admin_header('Maintenance', 'maintenance');
flash_render();
?>
<h1>Maintenance</h1>

<?php foreach ($messages as $line): ?>
    <div class="flash flash-ok"><?= e($line) ?></div>
<?php endforeach; ?>
<?php foreach ($errors as $line): ?>
    <div class="flash flash-error"><?= e($line) ?></div>
<?php endforeach; ?>

<?php if (!$status['configured']): ?>
    <div class="flash flash-error">
        Not connected to the manage server. Create an instance there, then fill in
        <code>MANAGE_INSTANCE</code> and <code>MANAGE_TOKEN</code> in
        <code>manage-client/config.php</code>. Backups can still be made locally.
    </div>
<?php endif; ?>

<div class="card">
    <table>
        <tr>
            <td>Installed version</td>
            <td><?= e($status['version'] !== '' ? $status['version'] : 'unknown') ?></td>
            <td class="help" style="margin:0">PHP <?= e($status['php_version']) ?></td>
        </tr>
        <tr>
            <td>Current release</td>
            <td>
                <?php if ($update !== null && $update['available']): ?>
                    <span class="tag tag-lock"><?= e($update['latest']) ?> available</span>
                <?php elseif ($update !== null): ?>
                    <?= e($update['latest'] !== '' ? $update['latest'] : '—') ?>
                <?php else: ?>
                    —
                <?php endif; ?>
            </td>
            <td class="help" style="margin:0">
                <?php if ($noReleaseYet): ?>
                    No release has been published on the manage server yet.
                <?php elseif ($status['update_error'] !== null): ?>
                    Check failed: <?= e($status['update_error']) ?>
                <?php elseif ($update !== null && $update['available']): ?>
                    Back up first, then deploy.
                <?php elseif ($update !== null): ?>
                    Up to date.
                <?php else: ?>
                    <?= e($status['instance'] !== '' ? $status['instance'] : 'no instance configured') ?>
                <?php endif; ?>
            </td>
        </tr>
        <tr>
            <td>Last backup</td>
            <td><?= e($status['last_backup_at'] ?? 'never') ?></td>
            <td class="help" style="margin:0"><?= count($status['backups']) ?> kept locally</td>
        </tr>
        <tr>
            <td>Release migrations</td>
            <td><?= count($status['pending_migrations']) ?> pending</td>
            <td class="help" style="margin:0">
                <?= $status['pending_migrations'] === []
                    ? 'Nothing to run.'
                    : e(implode(', ', array_column($status['pending_migrations'], 'id'))) ?>
            </td>
        </tr>
    </table>
</div>

<h2>Backup</h2>
<div class="card">
    <p class="help" style="margin-top:0">
        Archives <code>data/</code> and <code>media/</code> — galleries, showreel,
        front page, settings — and uploads it to the manage server. Gallery photos
        are not included: they live in the S3 bucket, which is their own backup.
        Nor are <code>config/</code> credentials, because a backup can be
        downloaded again from the server.
    </p>
    <form method="post">
        <?= csrf_field() ?>
        <input type="hidden" name="action" value="backup">
        <button type="submit" style="margin:0">Back up now</button>
    </form>
</div>

<h2>Schedule</h2>
<div class="card">
    <p class="help" style="margin-top:0">
        This host is assumed to have no cron, so the backoffice drives both jobs:
        opening any admin page past the interval starts them in the background
        (<code>manage-worker.php</code>). Updates are never part of that, and the
        release check runs only when this page is opened.
    </p>
    <table>
        <tr>
            <td>Automatic backup</td>
            <td><?= $autoInterval > 0 ? e(maintenance_interval_text($autoInterval)) : 'off' ?></td>
            <td class="help" style="margin:0">
                <?php if ($autoInterval <= 0): ?>
                    <code>MANAGE_BACKUP_AUTO_INTERVAL_SECONDS</code> is 0 — only cron or the button above make backups.
                <?php elseif (in_array('backup', $due, true)): ?>
                    Due now — starts on the next admin page load.
                <?php else: ?>
                    Next <?= e(date('Y-m-d H:i', $lastAutoBackup + $autoInterval)) ?>.
                <?php endif; ?>
            </td>
        </tr>
        <tr>
            <td>Heartbeat</td>
            <td><?= e(maintenance_interval_text(manage_heartbeat_interval())) ?></td>
            <td class="help" style="margin:0">
                <?php if ($lastHeartbeat === 0): ?>
                    Not sent yet.
                <?php else: ?>
                    Last <?= e(date('Y-m-d H:i', $lastHeartbeat)) ?>.
                <?php endif; ?>
            </td>
        </tr>
        <tr>
            <td>Cronjob</td>
            <td><?= cron_enabled() ? 'enabled' : 'not enabled' ?></td>
            <td class="help" style="margin:0">
                <?php if (!cron_enabled()): ?>
                    Optional. The jobs above and the gallery archives run without it.
                <?php elseif ($cronNote === null): ?>
                    Enabled, but <code>cron.php</code> has not run yet — check the crontab line.
                <?php else: ?>
                    <?= e($cronNote) ?>.
                <?php endif; ?>
            </td>
        </tr>
    </table>
    <p class="help">
        If the host does offer cron, one line is enough:
        <code>cron.php?key=…</code> every five minutes, or the same file from the
        shell. It drains every due gallery archive and whatever the schedule owes,
        and the web fallback above simply finds nothing left. The key is in
        <code>data/worker-key.json</code>; set <code>cron.enabled</code> in
        <code>config/config.php</code> and see <code>scripts/manage-client.cron</code>.
    </p>
</div>

<h2>Update</h2>
<div class="card">
    <?php if ($update !== null && $update['available']): ?>
        <p style="margin-top:0">
            Version <strong><?= e($update['latest']) ?></strong> is ready
            <?php if (!empty($update['manifest']['published_at'])): ?>
                (published <?= e($update['manifest']['published_at']) ?>)
            <?php endif; ?>.
        </p>
    <?php endif; ?>
    <p class="help" style="margin-top:0">
        Files are replaced while the site stays online, and there is no rollback:
        the replaced files are copied to <code>data/manage/updates/</code> for
        manual recovery. <code>config/</code>, <code>data/</code> and
        <code>media/</code> are never touched. Deleted files are not removed —
        an update overlays what is there.
        <?php if ($status['pending_migrations'] === []): ?>
            Afterwards, check <a href="migrate.php">Data migration</a>.
        <?php endif; ?>
    </p>
    <form method="post" onsubmit="return confirm('Deploy the update now? Files will be overwritten.');">
        <?= csrf_field() ?>
        <input type="hidden" name="action" value="update">
        <p class="help" style="margin-bottom:.4rem"><label style="display:inline;text-transform:none;letter-spacing:0">
            <input type="checkbox" name="backup_first" value="1" checked>
            Create a backup first
        </label></p>
        <p class="help" style="margin-bottom:.4rem"><label style="display:inline;text-transform:none;letter-spacing:0">
            <input type="checkbox" name="force" value="1">
            Deploy even if no newer version is offered
        </label></p>
        <button type="submit" style="margin-top:1rem"
            <?= $update !== null && !$update['available'] ? 'class="btn-ghost"' : '' ?>>
            Deploy update
        </button>
    </form>
</div>

<?php if ($status['pending_migrations'] !== []): ?>
<h2>Pending release migrations</h2>
<div class="card">
    <p class="help" style="margin-top:0">
        Shipped with a release and normally run by the update itself. These are
        left over — usually because one failed, or because the update ran with
        migrations skipped.
    </p>
    <table style="margin-bottom:1rem">
        <?php foreach ($status['pending_migrations'] as $migration): ?>
            <tr><td><?= e($migration['id']) ?></td></tr>
        <?php endforeach; ?>
    </table>
    <form method="post">
        <?= csrf_field() ?>
        <input type="hidden" name="action" value="migrate">
        <button type="submit" style="margin:0">Run migrations</button>
    </form>
</div>
<?php endif; ?>

<h2>Local backups</h2>
<div class="card">
    <?php if ($status['backups'] === []): ?>
        <p class="help" style="margin:0">No backup has been made yet.</p>
    <?php else: ?>
        <table>
            <tr>
                <th>File</th><th>Created</th><th>Trigger</th>
                <th>Files</th><th>Size</th><th>Upload</th><th></th>
            </tr>
            <?php foreach ($status['backups'] as $backup): ?>
                <tr>
                    <td><?= e((string)($backup['filename'] ?? '')) ?></td>
                    <td><?= e((string)($backup['created_at'] ?? '')) ?></td>
                    <td><?= e((string)($backup['trigger'] ?? '')) ?></td>
                    <td><?= (int)($backup['file_count'] ?? 0) ?></td>
                    <td><?= e(manageFormatBytes((int)($backup['size'] ?? 0))) ?></td>
                    <td>
                        <?php $uploads = is_array($backup['remote_uploads'] ?? null) ? $backup['remote_uploads'] : []; ?>
                        <?php if ($uploads === []): ?>
                            —
                        <?php else: foreach ($uploads as $upload): ?>
                            <span class="tag <?= empty($upload['success']) ? 'tag-expired' : 'tag-lock' ?>">
                                <?= e((string)($upload['target'] ?? '?')) ?><?= empty($upload['success']) ? ' failed' : '' ?>
                            </span>
                        <?php endforeach; endif; ?>
                    </td>
                    <td>
                        <form method="post">
                            <?= csrf_field() ?>
                            <input type="hidden" name="action" value="download">
                            <input type="hidden" name="filename" value="<?= e((string)($backup['filename'] ?? '')) ?>">
                            <button type="submit" class="btn-ghost" style="margin:0;padding:.4rem 1rem">Download</button>
                        </form>
                    </td>
                </tr>
            <?php endforeach; ?>
        </table>
    <?php endif; ?>
    <p class="help">
        Kept locally: <?= (int)MANAGE_BACKUP_LOCAL_RETENTION ?>. Older ones are
        deleted here after each new backup; the manage server keeps its own,
        longer history.
    </p>
</div>

<?php
$unsupported = [];
foreach ($capabilities as $type => $capability) {
    if ($capability['configured'] && !$capability['available']) {
        $unsupported[] = $type;
    }
}
?>
<?php if ($unsupported !== []): ?>
    <div class="flash flash-error">
        Configured backup targets this server cannot use:
        <?= e(implode(', ', $unsupported)) ?>. Those uploads will fail.
    </div>
<?php endif; ?>
<?php foreach ($status['errors'] as $line): ?>
    <div class="flash flash-error"><?= e($line) ?></div>
<?php endforeach; ?>

<div class="card">
    <h2 style="margin-top:0">Report status</h2>
    <p class="help" style="margin-top:0">
        Sends version, PHP version, free disk space and the time of the last
        backup to the manage server. Normally an hourly cron job; this is the
        manual version of it.
    </p>
    <form method="post">
        <?= csrf_field() ?>
        <input type="hidden" name="action" value="heartbeat">
        <button type="submit" class="btn-ghost" style="margin:0">Send heartbeat</button>
    </form>
</div>

<p class="help">
    Same operations from the shell:
    <code>php manage-client/bin/manage-client.php status|check|backup|update|migrate|heartbeat</code>.
    See <code>docs/SETUP.md</code>.
</p>
<?php admin_footer(); ?>