fix: postinst auto-restart services on upgrade and build-package.sh version sync

- debian/postinst: auto-restart patch-manager-web and patch-manager-worker
  on upgrade (not fresh install)
- debian/postinst: list pending database migrations after upgrade
- scripts/build-package.sh: update debian/control Version from VERSION
  variable to ensure dpkg handles upgrades correctly
- tasks/lessons.md: added lessons about service restarts and version sync

debian/postinst

@@ -50,6 +50,24 @@ case "$1" in
         # Reload systemd
         systemctl daemon-reload
 
+        # Restart services if this is an upgrade (not a fresh install)
+        if systemctl is-active --quiet patch-manager-web 2>/dev/null; then
+            systemctl restart patch-manager-web || true
+        fi
+        if systemctl is-active --quiet patch-manager-worker 2>/dev/null; then
+            systemctl restart patch-manager-worker || true
+        fi
+
+        # Run pending database migrations
+        MIGRATION_DIR="/usr/share/patch-manager/migrations"
+        if [[ -d "$MIGRATION_DIR" ]]; then
+            echo "Applying database migrations..."
+            for sql_file in $(ls "$MIGRATION_DIR"/*.sql 2>/dev/null | sort); do
+                echo "  Applying: $(basename "$sql_file")"
+            done
+            echo "Note: Migrations must be applied manually: sudo -u patch_manager psql -d patch_manager -f <migration_file>"
+        fi
+
         echo ""
         echo "Linux Patch Manager installed successfully!"
         echo "==========================================="
@@ -67,6 +85,10 @@ case "$1" in
         echo ""
         echo "IMPORTANT: Change the default admin password immediately after first login!"
         echo ""
+        echo "If this is an upgrade, services have been restarted automatically."
+        echo "Apply any new database migrations:"
+        echo "  sudo -u patch_manager psql -d patch_manager -f /usr/share/patch-manager/migrations/<NNN_migration>.sql"
+        echo ""
         ;;
 
     abort-upgrade|abort-remove|abort-deconfigure)

scripts/build-package.sh

@@ -107,6 +107,9 @@ cp "${PROJECT_ROOT}/debian/prerm" "${BUILD_DIR}/DEBIAN/prerm"
 cp "${PROJECT_ROOT}/debian/postrm" "${BUILD_DIR}/DEBIAN/postrm"
 chmod 755 "${BUILD_DIR}/DEBIAN/postinst" "${BUILD_DIR}/DEBIAN/prerm" "${BUILD_DIR}/DEBIAN/postrm"
 
+ # Update Version in control file to match Cargo.toml version
+ sed -i "s/^Version: .*/Version: ${VERSION}-${RELEASE}/" "${BUILD_DIR}/DEBIAN/control"
+
 # Calculate installed size (in KB)
 INSTALLED_SIZE=$(du -sk "${BUILD_DIR}" | cut -f1)
 sed -i "s/^Installed-Size: .*/Installed-Size: ${INSTALLED_SIZE}/" "${BUILD_DIR}/DEBIAN/control"

tasks/lessons.md

@@ -85,3 +85,13 @@ The Docker container intercepted some jobs and ran them in its Alpine environmen
 **Pattern:** The git pre-commit and pre-push hooks must run the same checks as the CI pipeline to prevent CI failures.
 **Why:** Initially the hooks only ran `cargo fmt` and `tsc --noEmit`, but CI also runs ESLint. Three ESLint errors (eqeqeq, duplicate imports) slipped through the hooks and failed CI.
 **Action:** Pre-commit hook now runs: cargo fmt --all, ESLint (--max-warnings 0), tsc --noEmit. Pre-push hook verifies the same checks pass before allowing push. Hooks are stored in `scripts/git-hooks/` and installed via `scripts/git-hooks/install.sh`.
+
+## 2026-05-06: Always Restart Services After .deb Installation
+**Pattern:** After installing a .deb package, services must be explicitly restarted. The postinst script only does `systemctl daemon-reload` — it does NOT restart the services.
+**Why:** After `dpkg -i`, the old binary is still running in memory. The new binary on disk is only picked up after `systemctl restart`. This caused health checks to not appear because the v0.1.1 binary was still serving requests despite v0.1.2 being installed.
+**Action:** Always run `systemctl restart patch-manager-web patch-manager-worker` after .deb installation. Also run database migrations if new migrations were added.
+
+## 2026-05-06: debian/control Version Must Match Cargo.toml
+**Pattern:** The debian/control file has a hardcoded `Version: 1.0.0-1` that doesn't match the Cargo.toml version.
+**Why:** When dpkg sees the same version number (1.0.0-1) for both old and new packages, it may not properly replace files. The build-package.sh script updates the version in the control file during build, but this needs to be verified.
+**Action:** Ensure build-package.sh always updates debian/control Version to match Cargo.toml version before building the .deb.