Merge pull request #308 from rustfs/feature/Systemd.service

refactor(service): optimize systemd dependencies and notifications for Linux platform
2026-07-26 16:28:15 +00:00 · 2025-04-09 19:16:00 +08:00
parent 3201ad9315 f48d8fc65e
commit f4d8033138
10 changed files with 460 additions and 47 deletions
@@ -3035,7 +3035,7 @@ dependencies = [
 "madmin",
 "md-5",
 "netif",
- "nix",
+ "nix 0.29.0",
 "num",
 "num_cpus",
 "path-absolutize",
@@ -4698,6 +4698,24 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "libsystemd"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c592dc396b464005f78a5853555b9f240bc5378bf5221acc4e129910b2678869"
+dependencies = [
+ "hmac 0.12.1",
+ "libc",
+ "log",
+ "nix 0.27.1",
+ "nom",
+ "once_cell",
+ "serde",
+ "sha2 0.10.8",
+ "thiserror 1.0.69",
+ "uuid",
+]
+
 [[package]]
 name = "libxdo"
 version = "0.6.0"
@@ -5113,6 +5131,18 @@ version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"

+[[package]]
+name = "nix"
+version = "0.27.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
+dependencies = [
+ "bitflags 2.9.0",
+ "cfg-if",
+ "libc",
+ "memoffset",
+]
+
 [[package]]
 name = "nix"
 version = "0.29.0"
@@ -7125,6 +7155,7 @@ dependencies = [
 "iam",
 "jsonwebtoken",
 "lazy_static",
+ "libsystemd",
 "local-ip-address",
 "lock",
 "madmin",
@@ -9894,7 +9925,7 @@ dependencies = [
 "futures-sink",
 "futures-util",
 "hex",
- "nix",
+ "nix 0.29.0",
 "ordered-stream",
 "rand 0.8.5",
 "serde",
@@ -9925,7 +9956,7 @@ dependencies = [
 "futures-core",
 "futures-lite",
 "hex",
- "nix",
+ "nix 0.29.0",
 "ordered-stream",
 "serde",
 "serde_repr",
@@ -33,8 +33,12 @@ all = "warn"

 [workspace.dependencies]
 madmin = { path = "./madmin" }
+atoi = "2.0.0"
 async-recursion = "1.0.5"
 async-trait = "0.1.87"
+axum = "0.8.3"
+axum-extra = "0.10.1"
+axum-server = { version = "0.7.2", features = ["tls-rustls"] }
 backon = "1.3.0"
 bytes = "1.9.0"
 bytesize = "1.3.0"
@@ -64,7 +68,10 @@ humantime = "2.1.0"
 keyring = { version = "3.6.1", features = ["apple-native", "windows-native", "sync-secret-service"] }
 lock = { path = "./common/lock" }
 lazy_static = "1.5.0"
+libsystemd = { version = "0.7" }
 local-ip-address = "0.6.3"
+matchit = "0.8.4"
+md-5 = "0.10.6"
 mime = "0.3.17"
 netif = "0.1.6"
 once_cell = "1.21.1"
@@ -101,8 +108,11 @@ s3s-policy = { git = "https://github.com/Nugine/s3s.git", rev = "ab139f72fe768fb
 shadow-rs = { version = "0.38.0", default-features = false }
 serde = { version = "1.0.217", features = ["derive"] }
 serde_json = "1.0.138"
+serde_urlencoded = "0.7.1"
 sha2 = "0.10.8"
+snafu = "0.8.5"
 tempfile = "3.16.0"
+test-case = "3.3.1"
 thiserror = "2.0.12"
 time = { version = "0.3.41", features = [
    "std",
@@ -133,13 +143,7 @@ uuid = { version = "1.15.1", features = [
    "fast-rng",
    "macro-diagnostics",
 ] }
-axum = "0.8.3"
-axum-extra = "0.10.1"
-axum-server = { version = "0.7.2", features = ["tls-rustls"] }
-md-5 = "0.10.6"
 workers = { path = "./common/workers" }
-test-case = "3.3.1"
-snafu = "0.8.5"

 [profile.wasm-dev]
 inherits = "dev"
@@ -24,7 +24,8 @@ Or use Docker:

 # How to add Console web

-1. wget [http://dl.rustfs.com/console/console.latest.tar.gz](https://dl.rustfs.com/console/rustfs-console-latest.zip)
+1.
+wget [http://dl.rustfs.com/console/console.latest.tar.gz](https://dl.rustfs.com/artifacts/console/rustfs-console-latest.zip)

 2. mkdir in this repos folder `./rustfs/static`

@@ -0,0 +1,102 @@
+[Unit]
+Description=RustFS Object Storage Server
+# 定义服务的描述，说明这是一个 RustFS 对象存储服务器，显示在 systemctl status 中。
+Documentation=https://rustfs.com/docs/
+# 提供服务的官方文档链接，方便管理员查阅，占位符需替换为实际 URL。
+After=network-online.target
+# 指定服务在 network-online.target（网络就绪）之后启动，确保网络可用。
+Wants=network-online.target
+# 表示服务希望依赖 network-online.target，但不是强依赖，即使网络未就绪也尝试启动。
+# If you're using a database, you'll need to add the corresponding dependencies
+# 如果服务依赖数据库，可以添加数据库相关的依赖项（当前为注释，未启用）。
+# After=postgresql.service
+# 示例：若依赖 PostgreSQL，则在 PostgreSQL 服务后启动（当前未启用）。
+# Requires=postgresql.service
+# 示例：若强制依赖 PostgreSQL，则要求其启动成功（当前未启用）。
+
+[Service]
+Type=notify
+# 服务类型为 notify，表示服务通过 sd_notify 通知 systemd 其状态（如就绪）。
+NotifyAccess=main
+# 指定只有主进程可以发送通知给 systemd，避免子进程干扰。
+User=rustfs
+# 以 rustfs 用户身份运行服务，需预先创建此用户，提升安全性。
+Group=rustfs
+# 以 rustfs 组身份运行服务，与 User 配合使用。
+
+# environment variable configuration
+# 定义环境变量配置，用于传递给服务程序。
+Environment=RUST_LOG=info
+# 设置日志级别为 info，控制服务日志输出（需服务支持此变量）。
+Environment=RUSTFS_ACCESS_KEY=rustfsadmin
+# 设置访问密钥为 rustfsadmin，用于 RustFS 的认证。
+Environment=RUSTFS_SECRET_KEY=rustfsadmin
+# 设置秘密密钥为 rustfsadmin，与访问密钥配套使用。
+
+# working directory
+WorkingDirectory=/opt/rustfs
+# 设置服务的工作目录为 /opt/rustfs，影响相对路径的解析。
+
+# main program
+ExecStart=/usr/local/bin/rustfs \
+    --address 0.0.0.0:9000 \
+    --volumes /data/rustfs/vol1,/data/rustfs/vol2 \
+    --obs-config /etc/rustfs/obs.yaml \
+    --console-enable \
+    --console-address 0.0.0.0:9002
+# 定义启动命令，运行 /usr/local/bin/rustfs，带参数：
+# --address 0.0.0.0:9000：服务监听所有接口的 9000 端口。
+# --volumes：指定存储卷路径为 /data/rustfs/vol1 和 /data/rustfs/vol2。
+# --obs-config：指定配置文件路径为 /etc/rustfs/obs.yaml。
+# --console-enable：启用控制台功能。
+# --console-address 0.0.0.0:9002：控制台监听所有接口的 9002 端口。
+
+# resource constraints
+LimitNOFILE=1048576
+# 设置文件描述符上限为 1048576，支持高并发连接。
+LimitNPROC=32768
+# 设置进程数上限为 32768，限制子进程数量。
+TasksMax=infinity
+# 允许服务创建无限数量的线程（谨慎使用，可能耗尽资源）。
+
+# restart the policy
+Restart=always
+# 服务异常退出时总是重启，提高可用性。
+RestartSec=10s
+# 重启前等待 10 秒，避免频繁重启导致资源浪费。
+
+# graceful exit configuration
+TimeoutStartSec=30s
+# 启动超时时间为 30 秒，若超时则认为启动失败。
+TimeoutStopSec=30s
+# 停止超时时间为 30 秒，若超时则强制停止。
+
+# security settings
+NoNewPrivileges=true
+# 禁止服务提升权限，增强安全性。
+ProtectSystem=full
+# 保护系统目录（如 /usr、/boot、/etc）为只读，防止服务修改。
+ProtectHome=true
+# 保护用户主目录（如 /home、/root），禁止服务访问。
+PrivateTmp=true
+# 为服务提供私有 /tmp 目录，隔离临时文件。
+PrivateDevices=true
+# 禁止服务访问硬件设备（如 /dev），提升安全性。
+ProtectClock=true
+# 保护系统时钟，禁止服务修改时间。
+ProtectKernelTunables=true
+# 保护内核参数（/proc/sys），禁止服务修改。
+ProtectKernelModules=true
+# 禁止服务加载或卸载内核模块。
+ProtectControlGroups=true
+# 保护控制组（cgroups），禁止服务修改。
+RestrictSUIDSGID=true
+# 禁止服务使用 SUID/SGID 文件，提升安全性。
+RestrictRealtime=true
+# 禁止服务使用实时调度，防止资源滥用。
+ReadWritePaths=/data/rustfs
+# 允许服务对 /data/rustfs 目录读写，限制其他路径访问。
+
+[Install]
+WantedBy=multi-user.target
+# 服务在多用户模式下自动启动，配合 systemctl enable 使用。
@@ -0,0 +1,90 @@
+# RustFS 服务安装配置教程
+
+## 1. 准备工作
+
+### 1.1 创建系统用户
+
+```bash
+# 创建 rustfs 系统用户和用户组，禁止登录shell
+sudo useradd -r -s /sbin/nologin rustfs
+```
+
+### 1.2 创建必要目录
+
+```bash
+# 创建程序目录
+sudo mkdir -p /opt/rustfs
+
+# 创建数据目录
+sudo mkdir -p /data/rustfs/{vol1,vol2}
+
+# 创建配置目录
+sudo mkdir -p /etc/rustfs
+
+# 设置目录权限
+sudo chown -R rustfs:rustfs /opt/rustfs /data/rustfs
+sudo chmod 755 /opt/rustfs /data/rustfs
+```
+
+## 2. 安装 RustFS
+
+```bash
+# 复制 RustFS 二进制文件
+sudo cp rustfs /usr/local/bin/
+sudo chmod +x /usr/local/bin/rustfs
+
+# 复制配置文件
+sudo cp obs.yaml /etc/rustfs/
+sudo chown -R rustfs:rustfs /etc/rustfs
+```
+
+## 3. 配置 Systemd 服务
+
+```bash
+# 复制服务单元文件
+sudo cp rustfs.service /etc/systemd/system/
+
+# 重新加载 systemd 配置
+sudo systemctl daemon-reload
+```
+
+## 4. 服务管理
+
+### 4.1 启动服务
+
+```bash
+sudo systemctl start rustfs
+```
+
+### 4.2 查看服务状态
+
+```bash
+sudo systemctl status rustfs
+```
+
+### 4.3 启用开机自启
+
+```bash
+sudo systemctl enable rustfs
+```
+
+### 4.4 查看服务日志
+
+```bash
+# 查看实时日志
+sudo journalctl -u rustfs -f
+
+# 查看今天的日志
+sudo journalctl -u rustfs --since today
+```
+
+## 5. 验证安装
+
+```bash
+# 检查服务端口
+ss -tunlp | grep 9000
+ss -tunlp | grep 9002
+
+# 测试服务可用性
+curl -I http://localhost:9000
+```
@@ -0,0 +1,90 @@
+# RustFS Service Installation Guide
+
+## 1. Prerequisites
+
+### 1.1 Create System User
+
+```bash
+# Create rustfs system user and group without login shell
+sudo useradd -r -s /sbin/nologin rustfs
+```
+
+### 1.2 Create Required Directories
+
+```bash
+# Create program directory
+sudo mkdir -p /opt/rustfs
+
+# Create data directories
+sudo mkdir -p /data/rustfs/{vol1,vol2}
+
+# Create configuration directory
+sudo mkdir -p /etc/rustfs
+
+# Set directory permissions
+sudo chown -R rustfs:rustfs /opt/rustfs /data/rustfs
+sudo chmod 755 /opt/rustfs /data/rustfs
+```
+
+## 2. Install RustFS
+
+```bash
+# Copy RustFS binary
+sudo cp rustfs /usr/local/bin/
+sudo chmod +x /usr/local/bin/rustfs
+
+# Copy configuration file
+sudo cp obs.yaml /etc/rustfs/
+sudo chown -R rustfs:rustfs /etc/rustfs
+```
+
+## 3. Configure Systemd Service
+
+```bash
+# Copy service unit file
+sudo cp rustfs.service /etc/systemd/system/
+
+# Reload systemd configuration
+sudo systemctl daemon-reload
+```
+
+## 4. Service Management
+
+### 4.1 Start Service
+
+```bash
+sudo systemctl start rustfs
+```
+
+### 4.2 Check Service Status
+
+```bash
+sudo systemctl status rustfs
+```
+
+### 4.3 Enable Auto-start
+
+```bash
+sudo systemctl enable rustfs
+```
+
+### 4.4 View Service Logs
+
+```bash
+# View real-time logs
+sudo journalctl -u rustfs -f
+
+# View today's logs
+sudo journalctl -u rustfs --since today
+```
+
+## 5. Verify Installation
+
+```bash
+# Check service ports
+ss -tunlp | grep 9000
+ss -tunlp | grep 9002
+
+# Test service availability
+curl -I http://localhost:9000
+```
@@ -0,0 +1,60 @@
+[Unit]
+Description=RustFS Object Storage Server
+Documentation=https://rustfs.com/docs/
+After=network-online.target
+Wants=network-online.target
+# If you're using a database, you'll need to add the corresponding dependencies
+# After=postgresql.service
+# Requires=postgresql.service
+
+[Service]
+Type=notify
+NotifyAccess=main
+User=rustfs
+Group=rustfs
+
+# environment variable configuration
+Environment=RUST_LOG=info
+Environment=RUSTFS_ACCESS_KEY=rustfsadmin
+Environment=RUSTFS_SECRET_KEY=rustfsadmin
+
+# working directory
+WorkingDirectory=/opt/rustfs
+
+# main program
+ExecStart=/usr/local/bin/rustfs \
+    --address 0.0.0.0:9000 \
+    --volumes /data/rustfs/vol1,/data/rustfs/vol2 \
+    --obs-config /etc/rustfs/obs.yaml \
+    --console-enable \
+    --console-address 0.0.0.0:9002
+
+# resource constraints
+LimitNOFILE=1048576
+LimitNPROC=32768
+TasksMax=infinity
+
+# restart the policy
+Restart=always
+RestartSec=10s
+
+# graceful exit configuration
+TimeoutStartSec=30s
+TimeoutStopSec=30s
+
+# security settings
+NoNewPrivileges=true
+ProtectSystem=full
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+ReadWritePaths=/data/rustfs
+
+[Install]
+WantedBy=multi-user.target
@@ -16,12 +16,21 @@ workspace = true

 [dependencies]
 madmin.workspace = true
+api = { path = "../s3select/api" }
+appauth = { version = "0.0.1", path = "../appauth" }
+atoi = { workspace = true }
+axum.workspace = true
+axum-extra = { workspace = true }
+axum-server = { workspace = true }
 async-trait.workspace = true
 bytes.workspace = true
+chrono = { workspace = true }
 clap.workspace = true
 csv = "1.3.1"
+crypto = { path = "../crypto" }
 datafusion = { workspace = true }
 common.workspace = true
+const-str = { version = "0.6.1", features = ["std", "proc"] }
 ecstore.workspace = true
 policy.workspace = true
 flatbuffers.workspace = true
@@ -32,8 +41,14 @@ hyper.workspace = true
 hyper-util.workspace = true
 http.workspace = true
 http-body.workspace = true
+iam = { path = "../iam" }
+jsonwebtoken = "9.3.0"
+libsystemd = { workspace = true, optional = true }
 lock.workspace = true
+local-ip-address = { workspace = true }
+matchit = { workspace = true }
 mime.workspace = true
+mime_guess = "2.0.5"
 netif.workspace = true
 once_cell.workspace = true
 pin-project-lite.workspace = true
@@ -41,22 +56,22 @@ prost.workspace = true
 prost-types.workspace = true
 protos.workspace = true
 protobuf.workspace = true
+query = { path = "../s3select/query" }
 rmp-serde.workspace = true
+rustfs-obs = { workspace = true }
 rustls.workspace = true
 rustls-pemfile.workspace = true
 rustls-pki-types.workspace = true
+rust-embed = { workspace = true, features = ["interpolate-folder-path"] }
 s3s.workspace = true
 serde.workspace = true
 serde_json.workspace = true
+serde_urlencoded = { workspace = true }
+shadow-rs.workspace = true
 tracing.workspace = true
 time = { workspace = true, features = ["parsing", "formatting", "serde"] }
 tokio-util.workspace = true
-tokio = { workspace = true, features = [
-    "rt-multi-thread",
-    "macros",
-    "net",
-    "signal",
-] }
+tokio = { workspace = true, features = ["rt-multi-thread", "macros", "net", "signal"] }
 tokio-rustls.workspace = true
 lazy_static.workspace = true
 tokio-stream.workspace = true
@@ -67,28 +82,12 @@ tracing-core = { workspace = true }
 tracing-error.workspace = true
 tracing-subscriber.workspace = true
 transform-stream.workspace = true
-uuid = "1.15.1"
-url.workspace = true
-axum.workspace = true
-axum-extra = { workspace = true }
-axum-server = { workspace = true }
-matchit = "0.8.4"
-shadow-rs.workspace = true
-const-str = { version = "0.6.1", features = ["std", "proc"] }
-atoi = "2.0.0"
-serde_urlencoded = "0.7.1"
-crypto = { path = "../crypto" }
-query = { path = "../s3select/query" }
-api = { path = "../s3select/api" }
-iam = { path = "../iam" }
-jsonwebtoken = "9.3.0"
 tower-http.workspace = true
-mime_guess = "2.0.5"
-rust-embed = { workspace = true, features = ["interpolate-folder-path"] }
-local-ip-address = { workspace = true }
-chrono = { workspace = true }
-rustfs-obs = { workspace = true }
-appauth = { version = "0.0.1", path = "../appauth" }
+url.workspace = true
+uuid = "1.15.1"
+
+[target.'cfg(target_os = "linux")'.dependencies]
+libsystemd = "0.7"

 [build-dependencies]
 prost-build.workspace = true
@@ -101,13 +100,9 @@ futures-util.workspace = true
 ecstore = { path = "../ecstore" }
 s3s.workspace = true
 clap = { workspace = true }
-tracing-subscriber = { version = "0.3.19", features = ["env-filter", "time"] }
-hyper-util = { version = "0.1.10", features = [
-    "tokio",
-    "server-auto",
-    "server-graceful",
-] }
-transform-stream = "0.3.1"
+tracing-subscriber = { workspace = true, features = ["env-filter", "time"] }
+hyper-util = { workspace = true, features = ["tokio", "server-auto", "server-graceful"] }
+transform-stream = { workspace = true }
 netif = "0.1.6"
 shadow-rs.workspace = true
 # pin-utils = "0.1.0"
@@ -216,7 +216,7 @@ pub async fn start_static_file_server(
    let app = Router::new()
        .route("/license", get(license_handler))
        .route("/config.json", get(config_handler))
-        .nest_service("/", get(static_handler));
+        .fallback_service(get(static_handler));
    let local_addr: SocketAddr = addrs.parse().expect("Failed to parse socket address");
    info!("WebUI: http://{}:{} http://127.0.0.1:{}", local_ip, local_addr.port(), local_addr.port());
    info!("   RootUser: {}", access_key);
@@ -53,6 +53,30 @@ use tracing::{debug, error, info, info_span, warn};
 use tracing_error::ErrorLayer;
 use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};

+#[cfg(target_os = "linux")]
+fn notify_systemd(state: &str) {
+    use libsystemd::daemon::{notify, NotifyState};
+    let notify_state = match state {
+        "ready" => NotifyState::Ready,
+        "stopping" => NotifyState::Stopping,
+        _ => {
+            warn!("Unsupported state passed to notify_systemd: {}", state);
+            return;
+        },
+    };
+
+    if let Err(e) = notify(false, &[notify_state]) {
+        error!("Failed to notify systemd: {}", e);
+    } else {
+        debug!("Successfully notified systemd: {}", state);
+    }
+}
+
+#[cfg(not(target_os = "linux"))]
+fn notify_systemd(state: &str) {
+    debug!("Systemd notifications are not available on this platform (state: {})", state);
+}
+
 #[allow(dead_code)]
 fn setup_tracing() {
    use tracing_subscriber::EnvFilter;
@@ -260,6 +284,9 @@ async fn run(opt: config::Opt) -> Result<()> {
        None
    };

+    // Create a oneshot channel to wait for the service to start
+    let (tx, rx) = tokio::sync::oneshot::channel();
+
    tokio::spawn(async move {
        let hyper_service = service.into_shared();
        let hybrid_service = TowerToHyperService::new(
@@ -272,6 +299,10 @@ async fn run(opt: config::Opt) -> Result<()> {
        let mut ctrl_c = std::pin::pin!(tokio::signal::ctrl_c());
        let graceful = hyper_util::server::graceful::GracefulShutdown::new();
        debug!("graceful initiated");
+
+        // Send a message to the main thread to indicate that the server has started
+        let _ = tx.send(());
+
        loop {
            debug!("waiting for SIGINT or SIGTERM has_tls_certs: {}", has_tls_certs);
            // Wait for a connection
@@ -286,9 +317,12 @@ async fn run(opt: config::Opt) -> Result<()> {
                    }
                }
                _ = ctrl_c.as_mut() => {
+                    drop(listener);
+                    eprintln!("Ctrl-C received, starting shutdown");
                    break;
                }
            };
+
            if has_tls_certs {
                debug!("TLS certificates found, starting with SIGINT");
                let tls_socket = match tls_acceptor
@@ -353,7 +387,7 @@ async fn run(opt: config::Opt) -> Result<()> {
    })?;
    debug!("init store success!");

-    init_iam_sys(store.clone()).await.unwrap();
+    init_iam_sys(store.clone()).await?;

    new_global_notification_sys(endpoint_pools.clone()).await.map_err(|err| {
        error!("new_global_notification_sys failed {:?}", &err);
@@ -386,9 +420,15 @@ async fn run(opt: config::Opt) -> Result<()> {
        });
    }

+    // Wait for the HTTP service to finish starting
+    if rx.await.is_ok() {
+        notify_systemd("ready");
+    }
+
    tokio::select! {
        _ = tokio::signal::ctrl_c() => {
-
+            eprintln!("Ctrl-C received, starting shutdown");
+            notify_systemd("stopping");
        }
    }