fix(yacy): postinst always systemctl restart (deb-systemd-invoke refuses disabled units) + HISTORY

dh_installsystemd's deb-systemd-invoke restart won't start a disabled unit, so
an upgrade on a board where secubox-yacy.service was disabled left
/run/secubox/yacy.sock gone and nginx 502. postinst now does an unconditional
plain systemctl restart (host uvicorn API has no LXC dependency, safe on fresh
installs). Documents the live nginx drift root-cause + Phase-2 detection fix.

.claude/HISTORY.md

@@ -23,6 +23,31 @@ Page admin `https://admin.gk2.secubox.in/yacy/` cassée sur deux points, corrig
 Déployé live sur gk2 (`/usr/share/secubox/www/yacy/index.html`, backup `.bak-pre-fix`),
 copie debian stagée synchronisée, bump 1.0.11 → 1.0.12. Assets `/shared/*` 200, JS
 `node --check` OK.
+
+**Cause racine réelle des cartes « unavailable » + « no search results »** : drift nginx
+live. `/etc/nginx/secubox-routes.d/yacy.conf` (inclus par le vhost admin) avait dérivé vers
+`proxy_pass …/aggregator.sock` en gardant le `rewrite` qui dénude le préfixe → l'aggregator
+(modules montés sur le chemin **complet** `/api/v1/yacy/*`) recevait `/access` nu → 404 →
+`.catch()` du JS → iframe jamais construit → pas d'UI YaCy. Réaligné sur la config livrée
+(`yacy.sock`, ~0,2 s vs 11-20 s via l'aggregator qui bloquait sa boucle). YaCy jamais cassé
+(freeworld, 352 global / 466 local pour « debian »). Même pattern que Lyrion #763 ci-dessous.
+
+**Phase 2 — yacyctl detection + sudoers + postinst + .deb** :
+- `yacyctl` reportait lxc « absent » / daemon « stopped » / overall **red** alors que tout
+  tournait : `secubox-yacy.service` tourne en `User=secubox` + `NoNewPrivileges=true`, et
+  `lxc-info`/`lxc-attach` exigent root (NNP bloque sudo). Remplacé par une **sonde réseau
+  privilège-free** (`curl http://$LXC_IP:$HTTP_PORT/`) — préserve le durcissement, signal
+  plus vrai. `lxc-info` gardé en enrichissement best-effort root-only. → vert via l'API.
+- Ship `/etc/sudoers.d/secubox-yacy` (lxc-*) pour `yacyctl reload` (restart daemon in-LXC).
+- `postinst` : `systemctl restart` inconditionnel — `deb-systemd-invoke restart` de
+  dh_installsystemd **refuse** de démarrer une unité *disabled* → upgrade laissait
+  `yacy.sock` absent → 502. (Piège de test : dpkg s'arrête sur un **prompt conffile** quand
+  on a édité les `/etc` à la main → `--force-confnew` pour aligner.)
+- Construit + installé `secubox-yacy_1.0.12-1~bookworm1_all.deb` (output/debs/). Upgrade
+  propre validé : service active+enabled, dashboard vert, recherche 466, route `yacy.sock`.
+
+---
+
 ## 2026-06-30 — Lyrion admin 404 → dedicated-socket extraction (#763)
 
 Page `https://admin.gk2.secubox.in/lyrion/` : tous les widgets en **HTTP 404**.

packages/secubox-yacy/debian/changelog

@@ -23,6 +23,14 @@ secubox-yacy (1.0.12-1~bookworm1) bookworm; urgency=medium
   * Ship /etc/sudoers.d/secubox-yacy (lxc-info/attach/start/stop) for
     `yacyctl reload`, which restarts the in-container daemon. Sibling
     pattern: secubox-streamlit, secubox-lxc.
+  * postinst: always `systemctl restart secubox-yacy.service`. The
+    maintainer scripts SIGTERM the unit on upgrade, but postinst only ran
+    `enable` — and dh_installsystemd's `deb-systemd-invoke restart` REFUSES
+    to start a disabled unit ("disabled ... not starting it"). On a board
+    where the unit was disabled, an upgrade left /run/secubox/yacy.sock gone
+    and nginx serving 502 until a manual restart. Plain systemctl restart
+    starts it regardless of enabled state; the host API does not need the
+    LXC, so it is safe on fresh installs too.
   * NOTE (live board drift, not a packaging change): on gk2 the installed
     /etc/nginx/secubox-routes.d/yacy.conf had drifted to
     `proxy_pass .../aggregator.sock` while keeping the prefix-stripping

packages/secubox-yacy/debian/postinst

@@ -24,7 +24,16 @@ case "$1" in
 
         systemctl daemon-reload 2>/dev/null || true
         systemctl enable secubox-yacy.service 2>/dev/null || true
-        # yacyctl install will start the FastAPI after the LXC is provisioned.
+        # Always (re)start the host API. The maintainer scripts SIGTERM the
+        # unit on upgrade, and the dh_installsystemd snippet below uses
+        # `deb-systemd-invoke restart`, which REFUSES to start a disabled
+        # unit ("disabled ... not starting it") — so on any board where the
+        # unit ended up disabled, an upgrade would leave /run/secubox/
+        # yacy.sock gone and nginx serving 502. Plain `systemctl restart`
+        # starts the unit regardless of enabled state (CSPN guideline:
+        # postinst must preserve runtime state). The host API (uvicorn) does
+        # not depend on the LXC, so this is safe on fresh installs too.
+        systemctl restart secubox-yacy.service 2>/dev/null || true
         ;;
 esac