I got tired of manually updating multiple FreeLLMAPI gateway containers on Proxmox, especially after realizing several copies had drifted and dependency audits were reporting vulnerabilities.

The problem with hardcoding container IDs is obvious: add another instance later, forget to update the script, and part of the fleet silently stops getting maintained.

So I built this as a self-discovering rolling updater.

What it does:

- Enumerates running Proxmox LXCs
- Searches likely filesystem roots for Git repositories
- Positively identifies FreeLLMAPI from the Git origin
- Does NOT depend on fixed CT numbers
- Checks the current Git worktree before touching anything
- Stops on unexpected local modifications
- Creates a Proxmox snapshot before each update
- Preserves local environment/data metadata where present
- Updates one container at a time
- Runs npm install
- Builds the application
- Starts the service
- Verifies systemd state
- Verifies TCP/3001
- Verifies the HTTP health endpoint
- Stops the rollout on failure
- Rolls back the current container on defined failures
- Writes a timestamped log

In my environment it dynamically discovered eight FreeLLMAPI gateways with no hardcoded CT list and successfully completed the rolling update.

The big lesson:

DO NOT MAINTAIN A STATIC LIST OF WORKLOADS IF THE INFRASTRUCTURE CAN IDENTIFY THEM ITSELF.

Let the updater discover the workload it is responsible for.

Security note: npm audit findings mean vulnerable dependency versions are present. That does not automatically prove a service is remotely exploitable, and I would NOT blindly run `npm audit fix --force` in production because it can introduce breaking changes.

The attached ZIP contains:
- tested Bash updater
- operating documentation
- change ticket from the verified run
- this post body
- checksum

Tested on Proxmox with LXC-based FreeLLMAPI gateways.

Credits:
Mikey_LikesIT + ChatGPT
