Hopefully fix some bugs.

install

@@ -8,30 +8,36 @@ DOKKU_LIB_ROOT=${DOKKU_LIB_ROOT:-/var/lib/dokku}
 DATA_ROOT="$DOKKU_LIB_ROOT/data/google-auth"
 
 mkdir -p "$DATA_ROOT/global" "$DATA_ROOT/apps"
+
+if command -v docker >/dev/null 2>&1; then
+  echo "-----> Building dokku-google-auth service image (first build can take a few minutes)"
+  docker image build -t dokku-google-auth:latest "$PLUGIN_DIR"
+  # Pick up the new image if the service is already running. This goes through
+  # fn-ga-service-start rather than its own `docker run` so an upgrade always
+  # rewrites service.env first: recreating the container from the file an older
+  # version left behind gives it stale settings — most damagingly a missing
+  # GOOGLE_AUTH_APP_CONFIG_DIR, which makes the service ignore every per-app
+  # access list and fall back to the global one.
+  if [[ "$(docker container inspect -f '{{.State.Running}}' dokku-google-auth 2>/dev/null)" == "true" ]]; then
+    echo "-----> Restarting google-auth service with the new image"
+    # shellcheck disable=SC1091
+    source "$PLUGIN_DIR/functions"
+    if fn-ga-configured; then
+      fn-ga-service-start
+    else
+      echo " !     google-auth is not fully configured; the running service keeps the old image" 1>&2
+      echo " !     run 'dokku google-auth:configure' then 'dokku google-auth:restart'" 1>&2
+    fi
+  fi
+else
+  echo " !     docker not found; the google-auth service image was not built" 1>&2
+fi
+
+# Ownership and modes last: the steps above can rewrite service.env as root,
+# and the dokku user has to be able to rewrite it from then on.
 chown -R dokku:dokku "$DATA_ROOT" 2>/dev/null || true
 chmod 700 "$DATA_ROOT"
 # apps/ is bind-mounted into the service container, which runs as an
 # unprivileged uid and must be able to traverse it to read per-app access
 # lists. The 0700 on DATA_ROOT still keeps other host users out.
 chmod 711 "$DATA_ROOT/apps"
-
-if command -v docker >/dev/null 2>&1; then
-  echo "-----> Building dokku-google-auth service image (first build can take a few minutes)"
-  docker image build -t dokku-google-auth:latest "$PLUGIN_DIR"
-  # Pick up the new image if the service is already running.
-  if [[ "$(docker container inspect -f '{{.State.Running}}' dokku-google-auth 2>/dev/null)" == "true" ]]; then
-    echo "-----> Restarting google-auth service with the new image"
-    port="$(head -n1 "$DATA_ROOT/global/port" 2>/dev/null || true)"
-    port="${port:-2999}"
-    docker container rm -f dokku-google-auth >/dev/null 2>&1 || true
-    docker container run -d \
-      --name dokku-google-auth \
-      --restart=unless-stopped \
-      -p "127.0.0.1:${port}:2999" \
-      --env-file "$DATA_ROOT/service.env" \
-      -v "$DATA_ROOT/apps:/data/apps:ro" \
-      dokku-google-auth:latest >/dev/null
-  fi
-else
-  echo " !     docker not found; the google-auth service image was not built" 1>&2
-fi