From 5433bfe1694a97e3a52e34e46c17b59d63bfbf0c Mon Sep 17 00:00:00 2001
From: Alex Van de Putte <alex@vndptt.com>
Date: Fri, 16 Oct 2026 22:03:30 -0400
Subject: [PATCH] 1.97.1: the Docker image starts Keepalived again on a volume
 from an older image

Debian 13 builds Keepalived reproducibly, which moves its build-options
string out of the binary into /etc/keepalived/keepalived.config-opts, and
Keepalived refuses to start without that file ("Unable to read build config
options file"). /etc/keepalived is a volume, and Docker only seeds a volume
from the image when it is created empty, so every node upgraded from 1.96.0
kept a volume without the file and lost its VIP.

The image now keeps a copy next to the binary, a location Keepalived also
accepts, and the entrypoint refreshes /etc/keepalived/keepalived.config-opts
from it on every start, so the file is there for the bare `keepalived -t`
the app runs and always matches the binary in the image.

Closes #6
---
 Dockerfile           | 10 +++++++++-
 VERSION              |  2 +-
 docker/entrypoint.sh | 10 ++++++++++
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 28f7d89..739e93b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -48,7 +48,15 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         procps \
         supervisor \
         tzdata \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* \
+    && cp /etc/keepalived/keepalived.config-opts /usr/sbin/keepalived.config-opts
+
+# Debian 13 builds Keepalived reproducibly, which moves its build-options
+# string out of the binary into /etc/keepalived/keepalived.config-opts, and
+# Keepalived refuses to start without that file. /etc/keepalived is a volume,
+# so the copy above keeps an image-only version next to the binary (a
+# location Keepalived also accepts) and the entrypoint puts it back into the
+# volume on every start -- a volume created by an older image never had it.
 
 # acme.sh is installed into an image-only directory. The entrypoint seeds
 # $HAM_ACME_HOME (a volume) from it, so account keys and issued certificates
diff --git a/VERSION b/VERSION
index acbb747..4d00f49 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.97.0
+1.97.1
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index 064b4c7..f251537 100755
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -11,6 +11,16 @@ mkdir -p "$DATA_DIR" "$CERT_DIR" "$ACME_HOME" /run/haproxy \
          "$(dirname "${HAM_KEEPALIVED_CFG:-/etc/keepalived/keepalived.conf}")"
 chmod 0700 "$DATA_DIR" "$ACME_HOME" "$CERT_DIR"
 
+# Keepalived (Debian 13's reproducible build) will not start without the
+# build-options file its package installs in /etc/keepalived -- a volume, so a
+# volume created by an older image hides it. Refresh it from the image copy on
+# every start so it always matches the binary. Keepalived reads this fixed
+# path regardless of HAM_KEEPALIVED_CFG.
+if [ -f /usr/sbin/keepalived.config-opts ]; then
+    mkdir -p /etc/keepalived
+    cp -f /usr/sbin/keepalived.config-opts /etc/keepalived/keepalived.config-opts
+fi
+
 # Refresh acme.sh's program files inside the (persisted) home on every start,
 # without touching account keys, issued certificates or account.conf.
 for item in acme.sh dnsapi deploy notify; do