20260713 unify installer scripts and RTR registration

2026-07-13 12:46:40 +08:00
parent b66b425512
commit 9f4f4cf069
20 changed files with 346 additions and 100 deletions
--- a/deploy/docker-installer/scripts/cleanup.sh
+++ b/deploy/docker-installer/scripts/cleanup.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=common.sh
+source "$SCRIPT_DIR/common.sh"
+
+DRY_RUN=1
+KEEP_RUNS=""
+usage() {
+  cat <<'USAGE'
+Usage: ./scripts/cleanup.sh [--execute] [--keep-runs N]
+
+By default this is a dry-run. It removes old run_* directories beyond KEEP_RUNS
+and clears tmp contents.
+USAGE
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --execute)
+      DRY_RUN=0
+      shift
+      ;;
+    --keep-runs)
+      KEEP_RUNS="$2"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      die "unknown option: $1"
+      ;;
+  esac
+done
+
+load_env
+keep="${KEEP_RUNS:-${RETAIN_RUNS:-100}}"
+mapfile -t runs < <(find "$HOST_DATA_DIR/runs" -maxdepth 1 -type d -name 'run_*' 2>/dev/null | sort)
+delete_count=$(( ${#runs[@]} - keep ))
+if (( delete_count > 0 )); then
+  for ((i=0; i<delete_count; i++)); do
+    if [[ "$DRY_RUN" == "1" ]]; then
+      echo "DRY-RUN rm -rf ${runs[$i]}"
+    else
+      rm -rf "${runs[$i]}"
+    fi
+  done
+fi
+if [[ "$DRY_RUN" == "1" ]]; then
+  echo "DRY-RUN rm -rf $HOST_DATA_DIR/tmp/*"
+else
+  find "$HOST_DATA_DIR/tmp" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
+fi
+df -h "$HOST_DATA_DIR" 2>/dev/null || true
--- a/deploy/docker-installer/scripts/common.sh
+++ b/deploy/docker-installer/scripts/common.sh
@@ -224,6 +224,82 @@ validate_rtr_report_dir() {
  [[ -d "$RTR_REPORT_DIR" ]] || die "RTR_REPORT_DIR does not exist or is not a directory: $RTR_REPORT_DIR"
 }

+validate_rtr_registration_dir() {
+  local report_dir="$1"
+
+  [[ -n "$report_dir" ]] || die "--report-dir is required"
+  [[ "$report_dir" = /* ]] || die "--report-dir must be an absolute host path: $report_dir"
+  [[ "$report_dir" =~ ^/[A-Za-z0-9._/@:+,-]+$ ]] || die "--report-dir contains unsupported characters: $report_dir"
+  [[ -d "$report_dir" ]] || die "--report-dir does not exist: $report_dir"
+  [[ -r "$report_dir" ]] || die "--report-dir is not readable: $report_dir"
+}
+
+rtr_report_file_count() {
+  local report_dir="$1"
+  {
+    find "$report_dir" -maxdepth 1 -type f \( \
+      -name 'rtr-source-*.json' -o \
+      -name 'rtr-runtime-*.json' -o \
+      -name 'rtr-clients-*.json' \
+    \) -print 2>/dev/null || true
+  } | wc -l | tr -d '[:space:]'
+}
+
+latest_rtr_report_file() {
+  local report_dir="$1"
+  {
+    find "$report_dir" -maxdepth 1 -type f \( \
+      -name 'rtr-source-*.json' -o \
+      -name 'rtr-runtime-*.json' -o \
+      -name 'rtr-clients-*.json' \
+    \) -printf '%T@ %p\n' 2>/dev/null || true
+  } | sort -nr | awk 'NR == 1 { sub(/^[^ ]+ /, ""); print }'
+}
+
+replace_env_key_file() {
+  local env_path="$1"
+  local key="$2"
+  local value="$3"
+  local temp_path
+
+  [[ "$key" =~ ^[A-Z][A-Z0-9_]*$ ]] || die "invalid environment key: $key"
+  [[ "$value" != *$'\n'* && "$value" != *$'\r'* ]] || die "environment value must be single-line"
+
+  temp_path="$(mktemp "${env_path}.tmp.XXXXXX")"
+  awk -v key="$key" -v value="$value" '
+    BEGIN { replaced = 0 }
+    $0 ~ "^" key "=" {
+      print key "=" value
+      replaced = 1
+      next
+    }
+    { print }
+    END {
+      if (!replaced) {
+        print key "=" value
+      }
+    }
+  ' "$env_path" > "$temp_path"
+  chmod --reference="$env_path" "$temp_path" 2>/dev/null || true
+  mv "$temp_path" "$env_path"
+}
+
+wait_for_endpoint() {
+  local url="$1"
+  local timeout_secs="$2"
+  local elapsed=0
+
+  while (( elapsed < timeout_secs )); do
+    if endpoint_ok "$url"; then
+      return 0
+    fi
+    sleep 2
+    elapsed=$((elapsed + 2))
+  done
+
+  return 1
+}
+
 create_data_dirs() {
  load_env
  mkdir -p \
--- a/deploy/docker-installer/scripts/install.sh
+++ b/deploy/docker-installer/scripts/install.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=common.sh
+source "$SCRIPT_DIR/common.sh"
+
+usage() {
+  cat <<'USAGE'
+Usage: ./scripts/install.sh [--skip-dep-install]
+
+Install or update the ours RP Docker installer package idempotently.
+USAGE
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --skip-dep-install)
+      export SKIP_DEP_INSTALL=1
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      die "unknown option: $1"
+      ;;
+  esac
+done
+
+load_env
+assert_arch_compatibility
+install_docker_if_missing
+require_cmd curl
+require_cmd jq
+require_cmd rsync
+require_cmd gzip
+require_cmd tar
+create_data_dirs
+load_installer_images
+ensure_binfmt_if_needed
+verify_runtime_image
+verify_metrics_image
+verify_monitor_images
+compose_config_path="$(mktemp "${TMPDIR:-/tmp}/ours-rp-compose-config.XXXXXX.yml")"
+compose_cmd --profile core --profile sidecar --profile monitor config >"$compose_config_path"
+"$SCRIPT_DIR/self-check.sh" --quick
+rm -f "$compose_config_path"
+log "install complete"
--- a/deploy/docker-installer/scripts/logs.sh
+++ b/deploy/docker-installer/scripts/logs.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=common.sh
+source "$SCRIPT_DIR/common.sh"
+load_env
+compose_cmd --profile core --profile sidecar --profile monitor logs "$@"
--- a/deploy/docker-installer/scripts/register_rtr_monitor.sh
+++ b/deploy/docker-installer/scripts/register_rtr_monitor.sh
@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/common.sh"
+
+REPORT_DIR=""
+DRY_RUN=0
+CANDIDATE_ENV=""
+CONFIG_FILE=""
+ORIGINAL_ENV_FILE=""
+ENV_BACKUP=""
+REGISTRATION_APPLIED=0
+
+usage() {
+  cat <<'EOF'
+Usage: ./scripts/register_rtr_monitor.sh --report-dir <absolute-host-path> [--dry-run]
+
+Registers one local RTR report directory for the artifact metrics sidecar.
+The directory must be on the same host as this installer and may contain
+rtr-source-*.json, rtr-runtime-*.json, and rtr-clients-*.json report files.
+
+This command recreates only artifact-metrics, Prometheus, and Grafana. It does
+not restart or recreate the ours-rp-soak container.
+EOF
+}
+
+cleanup() {
+  [[ -n "$CANDIDATE_ENV" && -f "$CANDIDATE_ENV" ]] && rm -f "$CANDIDATE_ENV"
+  [[ -n "$CONFIG_FILE" && -f "$CONFIG_FILE" ]] && rm -f "$CONFIG_FILE"
+  return 0
+}
+trap cleanup EXIT
+
+restore_failed_registration() {
+  if (( REGISTRATION_APPLIED == 0 )) || [[ -z "$ENV_BACKUP" || ! -f "$ENV_BACKUP" ]]; then
+    return 0
+  fi
+
+  warn "registration failed after .env replacement; restoring previous metrics configuration"
+  cp -p "$ENV_BACKUP" "$ORIGINAL_ENV_FILE"
+  ENV_FILE="$ORIGINAL_ENV_FILE"
+  load_env || warn "unable to reload restored .env"
+  compose_cmd --profile sidecar up -d --force-recreate artifact-metrics \
+    || warn "unable to recreate artifact-metrics with restored configuration"
+}
+
+fail_after_apply() {
+  restore_failed_registration
+  die "$*"
+}
+
+while (( $# > 0 )); do
+  case "$1" in
+    --report-dir)
+      [[ $# -ge 2 ]] || die "--report-dir requires a value"
+      REPORT_DIR="$2"
+      shift 2
+      ;;
+    --dry-run)
+      DRY_RUN=1
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      die "unknown argument: $1"
+      ;;
+  esac
+done
+
+require_cmd docker
+require_cmd curl
+require_cmd grep
+require_cmd jq
+validate_rtr_registration_dir "$REPORT_DIR"
+load_env
+assert_arch_compatibility
+
+ORIGINAL_ENV_FILE="$ENV_FILE"
+REPORT_FILE_COUNT="$(rtr_report_file_count "$REPORT_DIR")"
+LATEST_REPORT_FILE="$(latest_rtr_report_file "$REPORT_DIR")"
+if (( REPORT_FILE_COUNT == 0 )); then
+  warn "no recognized RTR report JSON files are currently present in $REPORT_DIR"
+fi
+
+CANDIDATE_ENV="$(mktemp "$INSTALLER_ROOT/.env.rtr-register.XXXXXX")"
+cp -p "$ORIGINAL_ENV_FILE" "$CANDIDATE_ENV"
+replace_env_key_file "$CANDIDATE_ENV" "RTR_REPORT_DIR" "$REPORT_DIR"
+
+ENV_FILE="$CANDIDATE_ENV"
+load_env
+CONFIG_FILE="$(mktemp "$INSTALLER_ROOT/.rtr-compose-config.XXXXXX")"
+compose_cmd --profile sidecar --profile monitor config --format json > "$CONFIG_FILE"
+jq -e --arg source "$REPORT_DIR" --arg target "$RTR_REPORT_CONTAINER_DIR" '
+  .services["artifact-metrics"].volumes
+  | any(.[]; .type == "bind" and .source == $source and .target == $target and .read_only == true)
+' "$CONFIG_FILE" >/dev/null || die "candidate compose configuration is missing expected read-only RTR bind mount"
+
+if (( DRY_RUN == 1 )); then
+  printf 'dry_run=ok\n'
+  printf 'report_dir=%s\n' "$REPORT_DIR"
+  printf 'recognized_report_files=%s\n' "$REPORT_FILE_COUNT"
+  printf 'latest_report=%s\n' "${LATEST_REPORT_FILE:--}"
+  printf 'expected_mount_source=%s\n' "$REPORT_DIR"
+  printf 'expected_mount_target=%s\n' "$RTR_REPORT_CONTAINER_DIR"
+  exit 0
+fi
+
+ENV_FILE="$ORIGINAL_ENV_FILE"
+load_env
+soak_container_before="$(compose_cmd ps -q ours-rp-soak || true)"
+ENV_BACKUP="${ORIGINAL_ENV_FILE}.rtr-register-$(date -u +%Y%m%dT%H%M%SZ).bak"
+cp -p "$ORIGINAL_ENV_FILE" "$ENV_BACKUP"
+mv "$CANDIDATE_ENV" "$ORIGINAL_ENV_FILE"
+CANDIDATE_ENV=""
+REGISTRATION_APPLIED=1
+
+load_env
+compose_cmd --profile sidecar up -d --force-recreate artifact-metrics \
+  || fail_after_apply "unable to recreate artifact-metrics"
+compose_cmd --profile sidecar --profile monitor up -d prometheus grafana \
+  || fail_after_apply "unable to start Prometheus and Grafana"
+
+soak_container_after="$(compose_cmd ps -q ours-rp-soak || true)"
+if [[ -n "$soak_container_before" && "$soak_container_before" != "$soak_container_after" ]]; then
+  fail_after_apply "ours-rp-soak container changed during RTR registration; investigate before continuing"
+fi
+
+wait_for_endpoint "http://127.0.0.1:${METRICS_PORT:-9556}/metrics" 60 \
+  || fail_after_apply "artifact-metrics did not become ready"
+wait_for_endpoint "http://127.0.0.1:${PROMETHEUS_PORT:-9090}/-/ready" 60 \
+  || fail_after_apply "Prometheus did not become ready"
+wait_for_endpoint "http://127.0.0.1:${GRAFANA_PORT:-3000}/api/health" 60 \
+  || fail_after_apply "Grafana did not become ready"
+
+if (( REPORT_FILE_COUNT > 0 )); then
+  curl -fsS "http://127.0.0.1:${METRICS_PORT:-9556}/metrics" | grep -q '^ours_rp_rtr_' \
+    || fail_after_apply "artifact-metrics exposes no RTR metrics after registration"
+fi
+
+printf 'registration=ok\n'
+printf 'report_dir=%s\n' "$REPORT_DIR"
+printf 'recognized_report_files=%s\n' "$REPORT_FILE_COUNT"
+printf 'latest_report=%s\n' "${LATEST_REPORT_FILE:--}"
+printf 'env_backup=%s\n' "$ENV_BACKUP"
+printf 'ours_rp_soak_container_unchanged=%s\n' "${soak_container_before:-not-running}"
--- a/deploy/docker-installer/scripts/restart.sh
+++ b/deploy/docker-installer/scripts/restart.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+"$SCRIPT_DIR/stop.sh" || true
+"$SCRIPT_DIR/start.sh" "$@"
--- a/deploy/docker-installer/scripts/self-check.sh
+++ b/deploy/docker-installer/scripts/self-check.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=common.sh
+source "$SCRIPT_DIR/common.sh"
+
+QUICK=0
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --quick)
+      QUICK=1
+      shift
+      ;;
+    -h|--help)
+      echo "Usage: ./scripts/self-check.sh [--quick]"
+      exit 0
+      ;;
+    *)
+      die "unknown option: $1"
+      ;;
+  esac
+done
+
+load_env
+assert_arch_compatibility
+require_cmd docker
+require_cmd jq
+docker compose version >/dev/null
+[[ -f "$COMPOSE_FILE" ]] || die "missing compose file"
+[[ -f "$ENV_FILE" ]] || die "missing .env"
+create_data_dirs
+[[ -w "$HOST_DATA_DIR" ]] || die "data dir is not writable: $HOST_DATA_DIR"
+compose_cmd --profile core --profile sidecar --profile monitor config >/dev/null
+verify_image_platform "$RPKI_IMAGE" "$RPKI_PLATFORM" "runtime"
+verify_image_platform "$METRICS_IMAGE" "$METRICS_PLATFORM" "metrics"
+verify_monitor_images
+if [[ "$QUICK" == "0" ]]; then
+  verify_runtime_image
+  verify_metrics_image
+fi
+log "self-check ok"
--- a/deploy/docker-installer/scripts/start.sh
+++ b/deploy/docker-installer/scripts/start.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=common.sh
+source "$SCRIPT_DIR/common.sh"
+
+WAIT_FIRST_RUN=1
+TIMEOUT_SECS=""
+
+usage() {
+  cat <<'USAGE'
+Usage: ./scripts/start.sh [--no-wait-first-run] [--timeout-secs N]
+
+Start ours RP. If no successful run exists, wait for the first snapshot to succeed
+before starting metrics, Prometheus and Grafana.
+USAGE
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --no-wait-first-run)
+      WAIT_FIRST_RUN=0
+      shift
+      ;;
+    --timeout-secs)
+      TIMEOUT_SECS="$2"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      die "unknown option: $1"
+      ;;
+  esac
+done
+
+load_env
+assert_arch_compatibility
+create_data_dirs
+timeout_secs="${TIMEOUT_SECS:-$FIRST_RUN_WAIT_TIMEOUT_SECS}"
+before_latest="$(latest_run_dir || true)"
+had_success=0
+if has_success_run; then
+  had_success=1
+fi
+
+log "starting core soak service"
+compose_cmd --profile core up -d ours-rp-soak
+
+if [[ "$had_success" == "0" && "$WAIT_FIRST_RUN" == "1" ]]; then
+  log "no previous successful run found; waiting for first run timeout=${timeout_secs}s"
+  wait_for_new_success_run "$before_latest" "$timeout_secs"
+fi
+
+log "starting metrics and monitor services"
+compose_cmd --profile sidecar --profile monitor up -d artifact-metrics prometheus grafana
+"$SCRIPT_DIR/status.sh" --brief || true
--- a/deploy/docker-installer/scripts/status.sh
+++ b/deploy/docker-installer/scripts/status.sh
@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=common.sh
+source "$SCRIPT_DIR/common.sh"
+
+BRIEF=0
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --brief)
+      BRIEF=1
+      shift
+      ;;
+    -h|--help)
+      echo "Usage: ./scripts/status.sh [--brief]"
+      exit 0
+      ;;
+    *)
+      die "unknown option: $1"
+      ;;
+  esac
+done
+
+load_env
+host_arch="$(detect_host_arch)"
+mode="$(arch_mode)"
+echo "installer_root=$INSTALLER_ROOT"
+echo "manifest_file=$MANIFEST_FILE"
+echo "package_name=${package_name:-}"
+echo "source_commit=${source_commit:-${git_commit:-}}"
+echo "source_commit_short=${source_commit_short:-}"
+echo "source_dirty=${source_dirty:-}"
+echo "build_timestamp_utc=${build_timestamp_utc:-${created_at_utc:-}}"
+echo "host_data_dir=$HOST_DATA_DIR"
+echo "host_arch=$host_arch"
+echo "package_arch=$PACKAGE_ARCH"
+echo "package_platform=$PACKAGE_PLATFORM"
+echo "allow_cross_arch=$ALLOW_CROSS_ARCH"
+echo "arch_mode=$mode"
+echo "runtime_image=$RPKI_IMAGE"
+echo "runtime_platform=$RPKI_PLATFORM"
+echo "runtime_image_revision=${runtime_image_revision:-}"
+echo "runtime_image_dirty=${runtime_image_dirty:-}"
+echo "metrics_image=$METRICS_IMAGE"
+echo "metrics_platform=$METRICS_PLATFORM"
+echo "metrics_image_revision=${metrics_image_revision:-}"
+echo "metrics_image_dirty=${metrics_image_dirty:-}"
+echo "rtr_report_dir=$RTR_REPORT_DIR"
+echo "rtr_report_container_dir=$RTR_REPORT_CONTAINER_DIR"
+echo "monitor_platform=$MONITOR_PLATFORM"
+echo "rirs=${RIRS:-}"
+echo "max_runs=${MAX_RUNS:-}"
+echo "interval_secs=${INTERVAL_SECS:-}"
+echo "periodic_snapshot_reset=${PERIODIC_SNAPSHOT_RESET:-0}"
+echo "periodic_snapshot_max_deltas=${PERIODIC_SNAPSHOT_MAX_DELTAS:-100}"
+echo
+if command -v docker >/dev/null 2>&1; then
+  docker version --format 'docker={{.Server.Version}}' 2>/dev/null || echo "docker=unavailable"
+  docker compose version 2>/dev/null || true
+  compose_cmd --profile core --profile sidecar --profile monitor ps || true
+else
+  echo "docker=missing"
+fi
+echo
+df -h "$HOST_DATA_DIR" 2>/dev/null || true
+echo
+latest="$(latest_run_dir || true)"
+if [[ -n "$latest" ]]; then
+  echo "latest_run=$latest"
+  print_run_summary "$latest" || true
+else
+  echo "latest_run=none"
+fi
+if [[ "$BRIEF" == "0" ]]; then
+  echo
+  endpoint_ok "http://127.0.0.1:${METRICS_PORT:-9556}/metrics" && echo "metrics=ok" || echo "metrics=unavailable"
+  endpoint_ok "http://127.0.0.1:${PROMETHEUS_PORT:-9090}/-/ready" && echo "prometheus=ok" || echo "prometheus=unavailable"
+  endpoint_ok "http://127.0.0.1:${GRAFANA_PORT:-3000}/api/health" && echo "grafana=ok" || echo "grafana=unavailable"
+  echo
+  if [[ "$RTR_REPORT_DIR" == "$HOST_DATA_DIR/empty-rtr-report" ]]; then
+    echo "rtr_registration=fallback-empty-directory"
+  else
+    echo "rtr_registration=registered"
+  fi
+  echo "rtr_report_files=$(rtr_report_file_count "$RTR_REPORT_DIR")"
+  echo "rtr_latest_report=$(latest_rtr_report_file "$RTR_REPORT_DIR" || true)"
+fi
--- a/deploy/docker-installer/scripts/stop.sh
+++ b/deploy/docker-installer/scripts/stop.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=common.sh
+source "$SCRIPT_DIR/common.sh"
+load_env
+compose_cmd --profile core --profile sidecar --profile monitor stop "$@"
--- a/deploy/docker-installer/scripts/uninstall.sh
+++ b/deploy/docker-installer/scripts/uninstall.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=common.sh
+source "$SCRIPT_DIR/common.sh"
+
+PURGE_DATA=0
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --purge-data)
+      PURGE_DATA=1
+      shift
+      ;;
+    -h|--help)
+      echo "Usage: ./scripts/uninstall.sh [--purge-data]"
+      exit 0
+      ;;
+    *)
+      die "unknown option: $1"
+      ;;
+  esac
+done
+
+load_env
+compose_cmd --profile core --profile sidecar --profile monitor down --remove-orphans || true
+if [[ "$PURGE_DATA" == "1" ]]; then
+  [[ "$HOST_DATA_DIR" == "/" || -z "$HOST_DATA_DIR" ]] && die "refuse to purge unsafe HOST_DATA_DIR=$HOST_DATA_DIR"
+  rm -rf "$HOST_DATA_DIR"
+  log "purged data dir $HOST_DATA_DIR"
+else
+  log "containers removed; data kept at $HOST_DATA_DIR"
+fi
--- a/deploy/docker-installer/scripts/upgrade.sh
+++ b/deploy/docker-installer/scripts/upgrade.sh
@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=common.sh
+source "$SCRIPT_DIR/common.sh"
+
+REUSE_ENV_FROM=""
+UPDATE_PACKAGE_IMAGE=1
+
+usage() {
+  cat <<'USAGE'
+Usage: ./scripts/upgrade.sh [--reuse-env-from /path/to/.env] [--keep-reused-image]
+
+By default, --reuse-env-from creates the new .env from this package's
+.env.example first, then overlays existing user settings from the old .env.
+Image tags are intentionally kept from the new package so the upgraded service
+actually runs the new packaged runtime and monitor images. Use
+--keep-reused-image only when you intentionally want to keep previous image tags.
+USAGE
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --reuse-env-from)
+      REUSE_ENV_FROM="$2"
+      shift 2
+      ;;
+    --keep-reused-image)
+      UPDATE_PACKAGE_IMAGE=0
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      die "unknown option: $1"
+      ;;
+  esac
+done
+
+env_get_key() {
+  local env_path="$1"
+  local key="$2"
+  awk -F= -v key="$key" '$1 == key {sub(/^[^=]*=/, ""); print; exit}' "$env_path"
+}
+
+env_set_key() {
+  local env_path="$1"
+  local key="$2"
+  local value="$3"
+  local tmp_env
+  if grep -q "^${key}=" "$env_path"; then
+    tmp_env="$(mktemp)"
+    awk -v key="$key" -v value="$value" '
+      BEGIN { done=0 }
+      $0 ~ "^" key "=" { print key "=" value; done=1; next }
+      { print }
+      END { if (!done) print key "=" value }
+    ' "$env_path" > "$tmp_env"
+    mv "$tmp_env" "$env_path"
+  else
+    printf '%s=%s\n' "$key" "$value" >> "$env_path"
+  fi
+}
+
+overlay_reused_env() {
+  local source_env="$1"
+  local target_env="$2"
+  local key
+  local value
+  while IFS='=' read -r key _; do
+    [[ -n "$key" ]] || continue
+    [[ "$key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
+    case "$key" in
+      PACKAGE_ARCH|PACKAGE_PLATFORM|RPKI_PLATFORM|METRICS_PLATFORM|MONITOR_PLATFORM)
+        continue
+        ;;
+      RPKI_IMAGE|METRICS_IMAGE|PROMETHEUS_IMAGE|GRAFANA_IMAGE)
+        [[ "$UPDATE_PACKAGE_IMAGE" == "0" ]] || continue
+        ;;
+    esac
+    value="$(env_get_key "$source_env" "$key")"
+    env_set_key "$target_env" "$key" "$value"
+  done < <(grep -E '^[A-Za-z_][A-Za-z0-9_]*=' "$source_env" || true)
+}
+
+if [[ -n "$REUSE_ENV_FROM" ]]; then
+  [[ -f "$REUSE_ENV_FROM" ]] || die "missing reuse env file: $REUSE_ENV_FROM"
+  if [[ ! -f "$ENV_FILE" ]]; then
+    [[ -f "$ENV_EXAMPLE" ]] || die "missing $ENV_EXAMPLE"
+    cp "$ENV_EXAMPLE" "$ENV_FILE"
+    overlay_reused_env "$REUSE_ENV_FROM" "$ENV_FILE"
+    log "created new package env from .env.example and overlaid user settings from $REUSE_ENV_FROM"
+  else
+    log "keeping existing env at $ENV_FILE; reuse source ignored: $REUSE_ENV_FROM"
+  fi
+fi
+
+load_env
+assert_arch_compatibility
+create_data_dirs
+install_docker_if_missing
+load_installer_images
+ensure_binfmt_if_needed
+verify_runtime_image
+verify_metrics_image
+verify_monitor_images
+compose_cmd --profile core --profile sidecar --profile monitor up -d --force-recreate
+"$SCRIPT_DIR/status.sh" --brief || true