From d7ff642a389e47a4f38fa7c2fabbe71fbbb05f21 Mon Sep 17 00:00:00 2001
From: Christian Breunig <christian@breunig.cc>
Date: Fri, 18 Apr 2025 19:59:55 +0200
Subject: T1771: automatic reboot of system into previous image

If any part of the system boot fails, we set overall_status=1 in the vyos-router
startup script. When an error during the image upgrade is detected, the system
will automatically revert the default boot image to the previously used version,
if the CLI option "system option reboot-on-upgrade-failure" is set.

The user is informed via console messages:

  Booting failed, reverting to previous image
  Automatic reboot in 5 minutes
  Use "reboot cancel" to cancel

The user has time to log in and run reboot cancel to remain in the faulty image
for troubleshooting. Reboot timeout is defined by CLI: "system option
reboot-on-upgrade-failure"

Once the system boots into the previous image, the MOTD will display a
persistent warning message - cleared during next reboot.

  WARNING: Image update to "VyOS 1.5.xxxx" failed
  Please check the logs:
  /usr/lib/live/mount/persistence/boot/NAME/rw/var/log
  Message is cleared on next reboot!

Upgrade failure can be synthetically injected by booting with Kernel command
line option: vyos-fail-migration
---
 interface-definitions/system_option.xml.in | 13 +++++++++++++
 1 file changed, 13 insertions(+)

(limited to 'interface-definitions')

diff --git a/interface-definitions/system_option.xml.in b/interface-definitions/system_option.xml.in
index c0ea958a2..5d385e3d0 100644
--- a/interface-definitions/system_option.xml.in
+++ b/interface-definitions/system_option.xml.in
@@ -342,6 +342,19 @@
                <valueless/>
              </properties>
            </leafNode>
+           <leafNode name="reboot-on-upgrade-failure">
+             <properties>
+               <help>Automatic reboot into previous running image on upgrade failure</help>
+               <valueHelp>
+                 <format>u32:1-30</format>
+                 <description>Timeout before automatic reboot (minutes)</description>
+               </valueHelp>
+               <constraint>
+                 <validator name="numeric" argument="--range 5-30"/>
+               </constraint>
+               <constraintErrorMessage>Timeout out of range, must be 5 to 30 minutes</constraintErrorMessage>
+             </properties>
+           </leafNode>
            <node name="ssh-client">
              <properties>
                <help>Global options used for SSH client</help>
-- 
cgit v1.2.3