insin_anydesk/CLAUDE.md

insin_anydesk

Insin package that installs AnyDesk on Raspberry Pi devices (arm64) managed by a self-hosted Insin server.

The package is published to the Insin server and assigned to the raspberry pi device group in the admin panel. Each device's insin monitor picks it up on its next heartbeat, extracts the pkg, and runs postinst as root.

Package structure

insin_anydesk/
├── build.sh              # CI script: pull deb + CLI, pack, publish
├── src/                  # pkg contents — `cd src && insin pack anydesk@<ver>`
│   ├── postinst          # apt-installs bundled .deb, enables systemd unit
│   ├── prem              # stops + apt-removes anydesk on pkg removal
│   ├── install.cfg       # install_path=/opt/insin/anydesk
│   └── anydesk_arm64.deb # bundled at build time by build.sh (gitignored)
└── packages/             # `insin pack` output (gitignored)

Recognised files in the ZIP (per Insin's package manager):

File	Role
postinst	Bash script run as root after extraction. New installs and version bumps trigger it; same-version reassignments are skipped.
prem	Bash script run before removal, or before overlaying a new version on top of an existing install.
install.cfg	key=value overrides. Supported keys: install_path, run_postinst, run_prem.

Everything else in the ZIP (the .deb) is copied verbatim into the install directory (install_path) alongside the scripts, so postinst can reference it as ./anydesk_arm64.deb.

Metadata

There is no manifest inside the pkg — Insin derives name and version from the name@version.pkg filename. The version must parse as MAJOR.MINOR.PATCH (Version.Parse). The pkg version tracks the upstream AnyDesk version: anydesk@6.4.0 bundles the AnyDesk 6.4.0-1 arm64 .deb.

Republishing the same version is rejected server-side with 409. To force a retry after a failed install, bump the version.

Environment variables

Var	Where	Purpose
INSIN_URL	build	Base URL of the Insin server (no trailing slash, no /api).
INSIN_TOKEN	build	Service token minted in the Insin admin panel (Service Tokens → New token).
GIT_URL	repo host	Full clone URL of this repo on Gitea (already set globally).
GIT_USER	repo host	Gitea username for push/pull (already set globally).
GIT_KEY	repo host	Gitea personal access token (already set globally).
ANYDESK_VERSION	build (optional)	Full deb tag (e.g. 6.4.0-1). Default: 6.4.0-1.
PKG_VERSION	build (optional)	Insin pkg semver. Default: ANYDESK_VERSION with the -N suffix stripped.
INSIN_CLI_RID	build (optional)	Override CLI artifact rid. Default: derived from uname -m; only linux-arm64 is currently published, so the runner must be arm64.

Never echo INSIN_TOKEN, GIT_KEY, or GIT_USER to logs. build.sh pipes CLI stderr through a sed redactor as a safety net.

Build & publish

./build.sh
# or override the anydesk version
ANYDESK_VERSION=6.4.1-1 PKG_VERSION=6.4.1 ./build.sh

build.sh:

1. Downloads anydesk_${ANYDESK_VERSION}_arm64.deb from download.anydesk.com/rpi/ into src/.
2. Fetches the latest insin CLI (linux-arm64) from $INSIN_URL/api/v1/downloads/cli into /tmp/insin/.
3. cd src && insin pack anydesk@${PKG_VERSION} → packages/anydesk@${PKG_VERSION}.pkg.
4. insin publish packages/anydesk@${PKG_VERSION}.pkg.

Rolling out

Publishing puts the pkg on the server. It does not assign it to any device. After publish:

• Admin panel → Groups → raspberry pi → Assignments → add anydesk@<version>, OR
• PUT $INSIN_URL/api/v1/admin/groups/<piGroupId>/assignments with Authorization: AdminToken $INSIN_TOKEN and body { "packageName": "anydesk", "version": "<version>" }.

Each Pi picks up the assignment on its next heartbeat (default 10 min) and runs postinst.

On-device runtime

• postinst and prem run under /bin/bash -c "./<script>" as a single subshell — one shell invocation, not line-by-line. set -euxo pipefail is set at the top so failures surface loudly in the insin monitor journal.
• Exit codes are logged but ignored by the agent. A failed postinst still marks the package as installed. To force a retry, bump the version.
• On upgrade, old files are not wiped before the new pkg is overlaid — stale files in install_path persist unless prem cleans them. Irrelevant for AnyDesk itself (the deb owns /opt, /etc, /usr), but worth remembering if the pkg starts carrying additional state.

References

• Insin publishing skill: ~/.claude/skills/publishing-packages-to-insin/.
• AnyDesk RPi downloads: https://anydesk.com/en/downloads/raspberry-pi.