nix: enable running update scripts

Update scripts are moved to `$out/libexec/bookwyrm/updates` and
`update.sh` is patched to use our `manage.py` instead of the `bw-dev`
wrapper.

The update scripts themselves are not patched in a generic manner; it
works for the one script that is there now, but future ones will require
manual review.

nix/default.nix

@@ -3,6 +3,7 @@
 , poetry2nix
 , python39
 , gettext
+, symlinkJoin
 }:
 let 
   bookwyrmSource = ./..;
@@ -21,12 +22,6 @@ let
       );
     });
 
-    postInstall = ''
-      mkdir -p $out/libexec/bookwyrm
-
-      cp ./manage.py $out/libexec/bookwyrm
-    '';
-
     meta = with lib; {
       homepage = "https://bookwyrm.social/";
       description = "Decentralized social reading and reviewing platform server";
@@ -37,4 +32,47 @@ let
       };
     }; 
   };
-in poetryApp.dependencyEnv
+  updateScripts = stdenv.mkDerivation {
+    name = "bookwyrm-update-scripts";
+    src = bookwyrmSource;
+
+    dontBuild = true;
+
+    buildInputs = [
+      poetryApp.dependencyEnv
+    ];
+
+    installPhase = ''
+      mkdir -p $out/libexec/bookwyrm
+
+      patchShebangs update.sh manage.py
+
+      cp ./manage.py $out/libexec/bookwyrm
+
+      cp ./update.sh $out/libexec/bookwyrm/
+      cp -r updates $out/libexec/bookwyrm/
+    '';
+
+    fixupPhase = ''
+      substituteInPlace $out/libexec/bookwyrm/update.sh \
+        --replace './bw-dev runweb python manage.py' "${poetryApp.dependencyEnv}/bin/python $out/libexec/bookwyrm/manage.py" \
+        --replace 'ls -A updates/' "ls -A $out/libexec/bookwyrm/updates" \
+        --replace './updates/$version' "$out/libexec/bookwyrm/updates/"'$version'
+
+      for f in $out/libexec/bookwyrm/updates/*; do
+        substituteInPlace $f \
+          --replace './bw-dev migrate' "${poetryApp.dependencyEnv}/bin/python $out/libexec/bookwyrm/manage.py migrate"
+      done
+    '';
+  };
+# The update scripts need to be able to run manage.py under the Bookwyrm
+# environment, but we don't have access to dependencyEnv when building
+# poetryApp. As an ugly workaround, we patch the scripts with the right paths 
+# separately, and symlinkJoin them with the original environment. 
+in symlinkJoin {
+  name = "bookwyrm";
+  paths = [
+    poetryApp.dependencyEnv
+    updateScripts
+  ];
+}

nix/moduleInner.nix

@@ -392,6 +392,7 @@ in
       preStart = ''
         ${concatStringsSep "\n" (mapAttrsToList (n: v: ''export ${n}="$(cat ${escapeShellArg v})"'') envSecrets)}
         ${bookwyrm}/libexec/bookwyrm/manage.py migrate --noinput
+        ${bookwyrm}/libexec/bookwyrm/update.sh
         ${bookwyrm}/libexec/bookwyrm/manage.py collectstatic --noinput --clear
         # --use-storage will output directly to STATIC_ROOT; without it, the sass processor 
         # will try to write to the Nix store