feat(updater): --check/--version, --force-update mit Rollback, --update-only, systemd-Timer + Windows-Task; VERSION+SHA-Marker; envsubst-Fallback

install.ps1

@@ -13,7 +13,12 @@ param(
   [string]$Collector = "",
   [string]$Token = "",
   [string]$Version = "1.40.0",
-  [switch]$Uninstall
+  [switch]$Uninstall,
+  [switch]$Check,          # nur Versionsvergleich
+  [switch]$ForceUpdate,    # Confs immer neu schreiben + Dienst neu starten
+  [switch]$InstallUpdateTask,  # geplante Aufgabe fuer Auto-Update
+  [switch]$RemoveUpdateTask,
+  [string]$UpdateInterval = "daily"
 )
 $ErrorActionPreference = "Stop"
 if (-not $Token -and -not $Collector) { throw "Kein Token: -Token <Bearer-Token> angeben (siehe README)." }
@@ -38,6 +43,29 @@ if ($Uninstall) {
 $arch = "amd64"
 if ($env:PROCESSOR_ARCHITECTURE -eq "ARM64") { $arch = "arm64" }
 elseif (-not [Environment]::Is64BitOperatingSystem) { $arch = "i386" }
+$RepoRaw = if ($env:REPO_RAW) { $env:REPO_RAW } else { "https://gitea.m-m.bio/mm/netbird-telegraf-installer/raw/branch/main" }
+$MarkerDir = "$env:ProgramData\netbird-telegraf"
+$VersionFile = Join-Path $MarkerDir "CONFIG_VERSION"
+
+function Get-RemoteVersion {
+  try { return (Invoke-WebRequest -UseBasicParsing -TimeoutSec 15 "$RepoRaw/VERSION").Content.Trim() }
+  catch { return "" }
+}
+
+# Reine Abfragen: kein Token, kein Dienst-Eingriff
+if ($Check -or (-not $Token -and -not $Uninstall -and -not $RemoveUpdateTask)) {
+  $local = if (Test-Path $VersionFile) { (Get-Content $VersionFile -Raw).Trim() } else { "nicht installiert" }
+  $remote = Get-RemoteVersion
+  if (-not $remote) { $remote = "nicht erreichbar" }
+  Write-Host "installiert: $local"
+  Write-Host "verfuegbar:  $remote"
+  if ($Check) {
+    if ($local -eq $remote -and $local -ne "nicht installiert") { Write-Host "Status: aktuell"; exit 0 }
+    Write-Host "Status: Update verfuegbar"; exit 10
+  }
+  if (-not $Token) { Write-Host "[netbird-telegraf] Kein Token angegeben (-Token)."; exit 2 }
+}
+
 Write-Host "[netbird-telegraf] Node=$Name Arch=$arch Collector=$Collector"
 
 try {
@@ -125,5 +153,69 @@ Stop-Service telegraf -ErrorAction SilentlyContinue
 Start-Service telegraf
 Start-Sleep -Seconds 3
 if ((Get-Service telegraf).Status -ne "Running") { throw "Dienst telegraf läuft nicht." }
+
+# --- Versionsmarker fuer den Auto-Updater ---
+New-Item -ItemType Directory -Force -Path $MarkerDir | Out-Null
+$rv = Get-RemoteVersion
+if (-not $rv) { $rv = "unbekannt" }
+Set-Content -Path $VersionFile -Value $rv -Encoding ASCII
+$iscript = Join-Path $env:TEMP "tg-installer.ps1"
+try {
+  Invoke-WebRequest -UseBasicParsing -TimeoutSec 25 "$RepoRaw/install.ps1" -OutFile $iscript
+  (Get-FileHash $iscript -Algorithm SHA256).Hash.ToLower() | Set-Content -Path (Join-Path $MarkerDir "INSTALLER_SHA") -Encoding ASCII
+} catch { }
+Set-Content -Path (Join-Path $MarkerDir "REPO_RAW") -Value $RepoRaw -Encoding ASCII
+
+# --- Auto-Update als geplante Aufgabe ---
+function Install-UpdateTask {
+  param([string]$Interval)
+  $upd = Join-Path $MarkerDir "update.ps1"
+  $body = @"
+`$ErrorActionPreference = 'Continue'
+`$log = '`$env:ProgramData\netbird-telegraf\update.log'
+function Say(`$m) { Add-Content -Path `$log -Value ("{0} {1}" -f (Get-Date -Format s), `$m) }
+`$repo = if (`$env:REPO_RAW) { `$env:REPO_RAW } else { (Get-Content '`$env:ProgramData\netbird-telegraf\REPO_RAW' -Raw).Trim() }
+`$vf = '`$env:ProgramData\netbird-telegraf\CONFIG_VERSION'
+`$local = if (Test-Path `$vf) { (Get-Content `$vf -Raw).Trim() } else { '' }
+`$remote = ''
+try { `$remote = (Invoke-WebRequest -UseBasicParsing -TimeoutSec 20 "`$repo/VERSION").Content.Trim() } catch { }
+if (-not `$remote) { Say 'Repo nicht erreichbar — kein Update.'; exit 0 }
+`$need = (`$local -ne `$remote)
+if (-not `$need) {
+  try {
+    `$t = Join-Path `$env:TEMP 'tg-i.ps1'
+    Invoke-WebRequest -UseBasicParsing -TimeoutSec 25 "`$repo/install.ps1" -OutFile `$t
+    `$rs = (Get-FileHash `$t -Algorithm SHA256).Hash.ToLower()
+    `$ls = (Get-Content '`$env:ProgramData\netbird-telegraf\INSTALLER_SHA' -Raw -ErrorAction SilentlyContinue).Trim()
+    if (`$rs -ne `$ls) { `$need = `$true }
+  } catch { }
+}
+if (-not `$need) { Say "aktuell (`$local) — nichts zu tun."; exit 0 }
+Say "Update `$local -> `$remote"
+`$i = Join-Path `$env:TEMP 'tg-i.ps1'
+try { Invoke-WebRequest -UseBasicParsing -TimeoutSec 60 "`$repo/install.ps1" -OutFile `$i } catch { Say 'Download fehlgeschlagen.'; exit 1 }
+`$nm = (Get-Content '`$env:ProgramData\netbird-telegraf\NODE_NAME' -Raw -ErrorAction SilentlyContinue).Trim()
+`$tk = (Get-Content '`$env:ProgramData\netbird-telegraf\TOKEN' -Raw -ErrorAction SilentlyContinue).Trim()
+try {
+  & powershell -NoProfile -ExecutionPolicy Bypass -File `$i -Name `$nm -Token `$tk *>> `$log
+  Say 'Update erfolgreich.'
+} catch { Say "Update FEHLGESCHLAGEN: `$_" }
+"@
+  Set-Content -Path $upd -Value $body -Encoding UTF8
+  $when = switch ($Interval) { "hourly" { (New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)) }
+                               "weekly" { (New-ScheduledTaskTrigger -Weekly -DaysOfWeek Monday -At 4:30am) }
+                               default  { (New-ScheduledTaskTrigger -Daily -At 4:30am) } }
+  $act = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -File `"$upd`""
+  $set = New-ScheduledTaskSettingsSet -StartWhenAvailable -DontStopOnIdleEnd
+  Register-ScheduledTask -TaskName "NetBirdTelegraf-Update" -TaskPath "\NetBirdTelegraf\" -Trigger $when -Action $act -Settings $set -Force | Out-Null
+  Write-Host "[netbird-telegraf] Auto-Update-Aufgabe aktiv ($Interval) — Log: $MarkerDir\update.log"
+}
+
+if ($ForceUpdate) { Write-Host "[netbird-telegraf] Force-Update: Konfiguration wurde neu geschrieben." }
+if ($InstallUpdateTask) { Install-UpdateTask -Interval $UpdateInterval }
+if ($RemoveUpdateTask) {
+  Unregister-ScheduledTask -TaskName "NetBirdTelegraf-Update" -TaskPath "\NetBirdTelegraf\" -Confirm:$false -ErrorAction SilentlyContinue
+  Write-Host "[netbird-telegraf] Auto-Update-Aufgabe entfernt."
+}
 Write-Host "[netbird-telegraf] OK — Node '$Name' liefert an $PromUrl (Metriken) und $LokiUrl (Eventlog Warn/Error)."
 Write-Host "[netbird-telegraf] Grafana: http://100.83.134.46:3000 (nur im NetBird)"