feat(selfhost): start full updates from administration

scripts/update/tests/test_updater.py

@@ -449,6 +449,26 @@ class UpdateTests(unittest.TestCase):
             self.run_update()
         self.assert_untouched()
 
+    def test_first_update_can_add_only_the_readonly_control_directory(self):
+        control_line = b'      - /run/fedeo-updater:/run/fedeo-updater:ro\n'
+        self.assertIn(control_line, self.original_compose)
+        (self.root / 'docker-compose.yml').write_bytes(self.original_compose.replace(control_line, b'      []\n'))
+        result = self.run_update()
+        self.assertEqual(result['status'], 'succeeded')
+        self.assertIn(control_line, (self.root / 'docker-compose.yml').read_bytes())
+
+    def test_control_mount_bootstrap_rejects_write_access_or_another_host_directory(self):
+        control_line = b'      - /run/fedeo-updater:/run/fedeo-updater:ro\n'
+        (self.root / 'docker-compose.yml').write_bytes(self.original_compose.replace(control_line, b'      []\n'))
+        for replacement in (b'      - /run/fedeo-updater:/run/fedeo-updater:rw\n',
+                            b'      - /var/run/docker.sock:/run/fedeo-updater:ro\n'):
+            with self.subTest(replacement=replacement):
+                self.http.files['docker-compose.selfhost.yml'] = self.original_compose.replace(control_line, replacement)
+                self.http.refresh()
+                with self.assertRaisesRegex(u.UpdateError, 'Datenpfade'):
+                    self.run_update()
+                self.assertFalse(self.called('stop'))
+
     def test_external_storage_fails_before_maintenance(self):
         (self.root / '.env').write_bytes(self.original_env.replace(b'http://minio:9000', b'https://storage.example.test'))
         with self.assertRaisesRegex(u.UpdateError, 'Backup-Adapter'):