fix(installer): make the record and rollback paths trustworthy (#2552)

fluxer_docs/src/content/docs/operator/configuration.mdx

@@ -647,6 +647,22 @@ Default empty. The LiveKit secret. Compose fills it from `LIVEKIT_API_SECRET`.
 
 Default empty. The client-facing LiveKit URL. When empty the API derives it from the public API origin as `wss://host/livekit`, or `ws://` under `http`, and keeps a non-default port. Set it only when LiveKit is served from another host. Compose forwards the `.env` value, empty by default.
 
+#### `FLUXER_LIVEKIT_USE_EXTERNAL_IP`
+
+Default `true`. Whether LiveKit discovers the address browsers dial by asking a STUN server. A host that cannot reach one over UDP fails to start with `could not resolve external IP: context deadline exceeded`. Set it to `false` and give `FLUXER_LIVEKIT_NODE_IP` the address instead. Read only by the `livekit` service.
+
+#### `FLUXER_LIVEKIT_NODE_IP`
+
+Default empty. The address LiveKit publishes in its ICE candidates. Empty leaves the choice to the discovery above, and with that discovery off LiveKit falls back to the container's own address, which no browser can reach. Set both together. `docker compose logs livekit` names the address in use as `nodeIP` on the starting line.
+
+#### `FLUXER_LIVEKIT_STUN_PRIMARY`
+
+Default `stun.l.google.com:19302`. The first STUN server the discovery asks. Point it at another server to keep the discovery without reaching Google.
+
+#### `FLUXER_LIVEKIT_STUN_SECONDARY`
+
+Default `stun1.l.google.com:19302`. The second STUN server, used the same way.
+
 #### `FLUXER_LIVEKIT_INTERNAL_URL`
 
 Default empty. The server-side LiveKit control API. Compose sets `http://livekit:7880`.

fluxer_docs/src/content/docs/operator/get-started.mdx

@@ -148,7 +148,7 @@ The run prints one line per phase and ends with the URL to open. It takes severa
 | --- | --- |
 | `--domain <host>` | Hostname the instance answers on. Prompted when absent |
 | `--email <address>` | Contact address written as `FLUXER_VAPID_EMAIL`. Prompted when absent |
-| `--dir <path>` | Working directory. Default `~/fluxer` |
+| `--dir <path>` | Working directory. Default `~/fluxer`, or the current directory when it holds an instance |
 | `--ref <git ref>` | Ref the stack files come from. Defaults to the image tag, and to `main` when that tag is `v1` or `latest` |
 | `--image-tag <tag>` | Image tag the stack runs. Default `v1` |
 | `--tls <mode>` | `bundled` or `proxy`. Default `bundled` |
@@ -255,14 +255,16 @@ A dump and a tarball in `backups`, and every service back to `running`, is the s
 
 ### Remove the instance
 
+:::danger[This deletes every account, message and upload]
+`-v` deletes all seven named volumes. Every account, message, upload, search index and certificate the instance holds is gone, and no `docker compose up -d` brings any of it back. Take the copies above first. To upgrade rather than delete, the command is `sh install.sh --update`, below.
+:::
+
 Take the instance down and delete its data:
 
 ```bash
 docker compose down -v
 ```
 
-`-v` deletes all seven named volumes, so every account, message, upload, search index and certificate the instance holds is gone, and no `docker compose up -d` brings them back. Take the copies above first.
-
 ## Upgrading
 
 The default tag `v1` tracks the latest compatible release. The same script upgrades the instance:
@@ -272,7 +274,7 @@ cd ~/fluxer
 sh install.sh --update
 ```
 
-`--update` records the running images, backs up the database and the uploads, refreshes the four stack files, pulls, recreates, and verifies. It leaves every secret in `.env` untouched. On Windows it is `.\install.ps1 -Update`. Run `sh install.sh --update --dry-run` first to see the plan.
+`--update` records the running images, backs up the database and the uploads, refreshes the five stack files, pulls, recreates, and verifies. It leaves every secret in `.env` untouched. On Windows it is `.\install.ps1 -Update`. Run `sh install.sh --update --dry-run` first to see the plan.
 
 [Upgrading](/operator/upgrading/) covers what the backup holds, rolling back, pinning a release and reclaiming disk.
 

fluxer_docs/src/content/docs/operator/upgrading.mdx

@@ -31,6 +31,7 @@ The repository holds no ref by the name of a pinned image tag. A release tags ea
 
 | Step | What it does |
 | --- | --- |
+| Mint | Writes any key the refreshed stack requires that `.env` does not hold, listed under [Run the upgrade](#run-the-upgrade) |
 | Record | Writes the image references, the image ID each container has, and the tag `.env` names, into a new record directory |
 | Save | Copies `.env` and the five stack files into that record |
 | Dump | Dumps the database with the stack still serving, and checks the custom-format header on the result |
@@ -46,6 +47,8 @@ A failed run leaves the instance running on the images it already had.
 
 `docker compose up -d` does not notice a changed `Caddyfile`. The script restarts `edge` by name to pick it up.
 
+An instance older than the `/livekit` routing needs one edit no upgrade can make for it. [Voice signalling moved to /livekit](#voice-signalling-moved-to-livekit) has it, and voice stays silent until it is made.
+
 The refreshed `docker-compose.yml` renames the `caddy` service to `edge`, and the two publish the same host ports. `--remove-orphans` takes the old container down in the same call, so the new one can bind them. Without it the step stops with `Bind for 0.0.0.0:443 failed`. It also removes any container in the project whose service the loaded Compose files no longer define, so keep `COMPOSE_FILE` the same across an upgrade. [Keep a local compose change](#keep-a-local-compose-change) has the file layout that survives one, and [When the compose file list names a missing file](#when-the-compose-file-list-names-a-missing-file) has the failure a line naming an absent file produces.
 
 The rename also moves the `caddy-data` and `caddy-config` volumes to `edge-data` and `edge-config`, so the old two are left unused and the edge requests its certificate again on the first start.
@@ -86,7 +89,7 @@ COMPOSE_FILE=docker-compose.yml:docker-compose.proxy.yml:local.compose.yml
 
 Compose merges the files left to right, so `local.compose.yml` wins over the ones before it. An upgrade refreshes the five stack files and nothing else, so a file outside that set survives every upgrade untouched. A record copies `.env` and those five files, and no other file from the working directory, so an override file is never backed up with them and belongs wherever the rest of the configuration lives.
 
-`.env` needs no such file. `FLUXER_IMAGE_TAG` is the only line either upgrade mode writes.
+`.env` needs no such file. The only value either upgrade mode replaces there is `FLUXER_IMAGE_TAG`, and the Mint step adds a required key the file does not hold at all.
 
 [Enable the overlay](/operator/reverse-proxy/#enable-the-overlay) has the overlay this is most often used for, and [Docker labels](/operator/reverse-proxy/#docker-labels) has a worked third file.