From 94dfcf6e43bf4fa7c07494ef14efd20f9992d744 Mon Sep 17 00:00:00 2001
From: Benjamin Toby <devops@tben.me>
Date: Sun, 13 Sep 2026 07:23:40 +0100
Subject: [PATCH] Untrack runtime sqlite DB files and harden idempotent install
 updates

---
 .gitignore                   |   2 ++
 db/bmp                       | Bin 49152 -> 0 bytes
 db/wgui                      | Bin 65536 -> 0 bytes
 src/scripts/install-wg-ui.sh |  19 ++++++++++++++++++-
 4 files changed, 20 insertions(+), 1 deletion(-)
 delete mode 100644 db/bmp
 delete mode 100644 db/wgui

diff --git a/.gitignore b/.gitignore
index 66dc3fe..6bd91c3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,6 +39,8 @@ report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
 /.bunext
 /db/.backups
 /db/.exports
+/db/wgui
+/db/bmp
 .bun-sqlite
 /assets
 
diff --git a/db/bmp b/db/bmp
deleted file mode 100644
index f27ec6387b5087e7a7dfe7307f7452e47e1b2ad5..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 49152
zcmeI(y>H`W9Kdm>%}d*~7Z^^FSo+jcOar3aa05C)=($HlF1e<OL?_El+|(#>a<+3X
zV_ONaqnqImU}I(FMM&M4*%(-1W8(2+H)+xqB-C4?ucbKl<HwKv`~03KiS2fOuj+=5
zI2!nUI~4b{H?&kr`$z~))AI7QDqj~<RxYG3R^)r?((+A<dF|a-Kd%**wfxe#R(Nym
z$2-5>`ED&-{VD&;>X*yE=D(K3Ob8%=00IagfWZG3I8Ens#m&vs*@vNh*mL?$$F;4Y
z?b{u<+Ye?|SGOBxrD=+0<>RU;^qH-?D7hW6TWgw+%!YW<*nM1S9EeZN15s%;>$^3%
z^JBBtEQ_}9*rC(0<gcfsc3F&uohxN=`;#`yV)}@pX?`Y~+o?Cq-A6Tbq*8KHZbvsn
z!`v|&W^LQtPtH{@>1sp0CLWqqQ%15~+25`_G>x-QmUG2oG4;h@!k`Yea!ts$9_T1=
zeCu+Yp&Ry`B)pCjw0(CNx&tpM2}b?C?Y~UcVw3RY@M4F!;JGh<q{>W&$J6zWNBu+3
zc6-*<3U1%AF0~UnFG8z5@IuE6lQ!JI8v3p}_&9U2%(uIi>vf$#W_6O%xbicZ)=8P|
zw~yUtmuqd;Yx~VcMK&k&y61?Nv=GDSl^kg34~|@^ArISibkVBq?zK!&(i1ejEcD4~
z>4ssfWQz}qDb4jd&Wqq_FJiDq;XtihG0v8H%b$FZQ=R|x9hLPU7+AeQ*Y#x7QhjE1
zX}TxOY<=B*B8giL9(igi8^(jBY;kY%ra))T&)S+PSU!0>n=5W?q)yjW@QO3aelS_e
zO@}<$@VcXwp9j&97<WeFNhTY8N*%;`ijx{RPe+c|c9I-ltY)W9dS+wEv-?h2Ry9sO
zUr;0d?A|zh6?w2YwZH0S!L7%8<oZEqMJJPtte!o+?)2ptRoljyk4VOQj7tyQLDIzR
z*pi=dJC#<oDc&=T^uLXXsNukRU%h3F#s99lrK(03woB1B&q*(pE8f4KI(@DvEvs{A
z1?^)Qg4MS@Icj}NPS+GJOi^E3MU+;=%oHDFB2lY1MXgn>mao*j`b8sdu6*?yXk2-!
zVPj2(oGFA_;g7<3;oHJ1xyXb70tg_000IagfB*srAb<b@w;-^dNpEH{@y)yO-Raaf
zU;X~qLOj2lP8X93QNf>o$Mf~YXup|TUux5NJb!B;y^+a8_cPSpra+bc5YO+XqBhmN
z4ps1dJddvb<wJia1Q0*~0R#|0009ILKmY**5SU|ul_)l@|K~WvgoXeD2q1s}0tg_0
z00IagfPkiP{ZB7I009ILKmY**5I_I{1Q0-A{ss8^|M|}`5h8#90tg_000IagfB*sr
zAi(uMeE<Oj5I_I{1Q0*~0R#|00D<`z;QD|5b4-K?Ab<b@2q1s}0tg_000Ic`|Nry>
z1Q0*~0R#|0009ILKmY**=3jv4|MQ<?B18ZI1Q0*~0R#|0009ILK!E4}^Z^7AKmY**
o5I_I{1Q0*~0R-k>fam}7pJO6K009ILKmY**5I_I{1Q0;rA2fiN<NyEw

diff --git a/db/wgui b/db/wgui
deleted file mode 100644
index 733412a460d216a79e34882cd4b5b8ef2f24cc25..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 65536
zcmeI*O-$QX00(fpiSxmrrjt;%(JCgTD;ZhUP<508TLT!%ph*c~8{NTj5<}c3PHH<)
zx&ul;+qCP{oqO4B(hil@Q`Or(Dos01nzTcuO4W{=gepxt?D^T`6A+W=RM6kTPW=4*
z{QP^*@A(7F{M@W+D#B7xFUY2Ff$3&gmbokl48z<fV>cOjGP=mPPDVEww+D9n%O0Qi
znR9o4?DA|eou0=Gf1=Ag-s5@f`?m9kj(>cc{w?2c-bY@6`^&TDncpK7EP?<8j*h@4
zJLwIKj<TQim~uL=6qKyGq1i#77HdJWWGaP{6dk@aGIU`mI&$&S#i$i^r*QvxQjDcU
zAr%{&6@?Iu77_;3tS}u<iBn=yxR#v08cQw;GvcBUTSz6Q<7AbqVmuWQGP)w0N>(Bb
zpc6YHluOz6FhkL$dXf>rRL#61q{NR%B3Z@A=xWJSi<%Q+lnVt}UvuW1oUfIv6{>U7
z-astIZoW<THj`JC>bp*mw-%(CMjOG%kQI67C6!O!r>q-(nnbQ>v?nlfzOpdm4TvIJ
zwYR+@>#9`<ZJQby8s2M}w^@9zs0UsUH<fMG6**tFOCTH`_XI`*ETd{!<+gDvPr5Zp
zE}KO<FO^Bz8B&yfbas8u3<fG=j)M)p%MMgdl32kYTWyI|i@uw~|FhGTF;e7#09(z}
zi=37_*IYa_?7*{RX*L}YtILvFlH_bwR}90c_$6IkA%~JwFSJrQomVrpfN*$fuadJ5
z9Q(+BB|NcLRJ)Le=tp<;HF7}p_OhEz2b6R4xSM&L&=(J6l|zG=Fd<IH7G_hz`G}y&
zh3&RvM@Ad%zw<@}IiD}ClJ-q4*<}*0y03TxgM;kGd$iWr!X;Ukv+8oeXqoM3rfOMw
z;AD3Cjje3+7M)r(nMjJ$Q*qjy57_NJaSerqq&O)i#rU{5zugTCgy@1qoM_LAq>~tr
z&5y?>#PG%y(&vzar?JnW8#`pZiPinsNUOTl>Xl?O*WBym%7wHht9hwCf?7}{)9#h5
zbWG*8DP@Y9N%|Nk4b_myF-*I%TK7o8beSCN+OlGhuCv~6+L5gTz8)s)nVh=P7;8Kc
zpHC%YBsn3J&=g^TG$caF8l4T5^x~3A`c|^pWhEpm#HZ&LL}4K0v^b%N5UOV@6b@J3
z61{=GKDHX9HJV1V_R6S#^EKDw`ho+m!cHdZ0JUvV(eO3SV;y~qG^<WeWhl4Gik4AY
zW<5=rZdo{BH5n1IW|*8BCajvgaiO;Rbk7afc+zvyL(d$;0n&6<gJbq7!dyLK+c`$G
zvPNQA$u-2X_Q5#blpR_c#)0!KsXA#S8=Aws+&r%oNL8kkPQ@UnYb1BIHEN+H*)Ud%
zde*7PX|?ElYps#>b~s$gv);h)Fk4-vLXwnCOGYL~wkZ{4jnqb6BEt@W$C_+*j3Nwl
z2rYxXk$TqSiIfmun4OKZ#cV%I6?Tu@e)?LA+>~&*i~ol4@|PL@5B_KVE^qQ5^WTwK
z3=n_-1Rwwb2tWV=5P$##AOHafGzh%za|b!D_B4RK_th5<KC`C*kGq%SoLkEzX#VLF
zdm7~2gB;g<Thn0gefjLz347Y(b_bjYG{A39$!0q^&M=BnkJpMoZ|ajI&A)%Kr*9l{
z_i<e9ZWB$DeQvGHKJQ_zRp?zD8t|(<?Xvd8ddiOh0uX=z1Rwwb2tWV=5P$##AOL|Q
zD}d|&BU`lCF$h2a0uX=z1Rwwb2tWV=5P(2U0N4LD3VeY81Rwwb2tWV=5P$##AOHaf
z99aSD`rpfc&G66oKl$JJpZJITeKLyy0uX=z1Rwwb2tWV=5P$##AOL|EBygtRHRme?
z&$>ik?S%sL<&2$YUBP;g?@d?0NB{P}<BY4<=e%Ix)qdBYujQQrzSATo4fFN60)G0(
z|6L(hAN@w(`f1?#{|hQiBntruKmY;|fB*y_009U<00Izri3F_cf0lp3kRJ>XfB*y_
z009U<00Izz00bZa0SFvcfm5u9;W+<k_TJq`pFgyxMw$GtP4aJg3#x|a|A)0;k#7h<
z00Izz00bZa0SG_<0uX?}{snOTzke&lga8B}009U<00Izz00bZa0SFvcfetI<-G?>z
z$TtKa009U<00Izz00bZa0SG_<0{aoLuK!v7DMNmaldrD*tb;fZfB*y_009U<00Izz
z00bZa0SLT&0==$Le_GLsrh3khwM<UAb9uQStNC-8Vgb+pU%v7}jvxR52tWV=5P$##
zAOHafKmY;<EnvU@f1Tmi4?1O}2LT8`00Izz00bZa0SG_<0uX?JBe2ePlDG4p>KW~=
zaEy<>o&SM79aFR$GI>FNs+eBe?cu$wXL4j&|4_O=I@F)Jo}Y-y+S1yGW@06)WRmLq
z(mUnF>~c(>xiR&@o#^<@+|@gZmd;M5hOb|mnbl@evXhTv<kPwpVEz8T-wDG91Rwwb
z2tWV=5P$##AOHafKmY=VS)jw!>v!%Q*nj`O#qe8)d54g92tWV=5P$##AOHafKmY;|
NfB*#A1RAdY{{`-$bqfFh

diff --git a/src/scripts/install-wg-ui.sh b/src/scripts/install-wg-ui.sh
index d015c5a..8c1e709 100755
--- a/src/scripts/install-wg-ui.sh
+++ b/src/scripts/install-wg-ui.sh
@@ -16,6 +16,7 @@ REPO_URL="${REPO_URL:-}"
 BRANCH="${BRANCH:-main}"
 BUN_INSTALL_DIR="${BUN_INSTALL_DIR:-/opt/bun}"
 BUN_BIN="/usr/local/bin/bun"
+UPDATE=false
 
 log() { echo "==> $*"; }
 fail() { echo "error: $*" >&2; exit 1; }
@@ -99,9 +100,17 @@ setup_service_user() {
 clone_or_update() {
     mkdir -p "$(dirname "$INSTALL_DIR")"
     if [ -d "$INSTALL_DIR/.git" ]; then
+        UPDATE=true
         log "updating existing install at $INSTALL_DIR ..."
         git -C "$INSTALL_DIR" fetch --depth 1 origin "$BRANCH"
+        local db_backup="$INSTALL_DIR/db/.wgui-pre-update.db"
+        if [ -f "$INSTALL_DIR/db/wgui" ]; then
+            cp -a "$INSTALL_DIR/db/wgui" "$db_backup"
+        fi
         git -C "$INSTALL_DIR" reset --hard "origin/$BRANCH"
+        if [ -f "$db_backup" ]; then
+            mv -f "$db_backup" "$INSTALL_DIR/db/wgui"
+        fi
     else
         log "cloning wg-ui ($REPO_URL, branch $BRANCH) ..."
         git clone --depth 1 --branch "$BRANCH" "$REPO_URL" "$INSTALL_DIR"
@@ -180,6 +189,10 @@ EOF
     systemctl daemon-reload
     log "enabling and starting $SERVICE_NAME ..."
     systemctl enable --now "$SERVICE_NAME.service"
+    if [ "$UPDATE" = true ]; then
+        log "restarting $SERVICE_NAME to load updated code ..."
+        systemctl restart "$SERVICE_NAME.service"
+    fi
 }
 
 install_openrc_unit() {
@@ -209,7 +222,11 @@ EOF
     chmod +x "$init_script"
     log "adding $SERVICE_NAME to default runlevel and starting ..."
     rc-update add "$SERVICE_NAME" default
-    rc-service "$SERVICE_NAME" start
+    if [ "$UPDATE" = true ]; then
+        rc-service "$SERVICE_NAME" restart
+    else
+        rc-service "$SERVICE_NAME" start
+    fi
 }
 
 grab_port() {