From c872901269746fc53ef1ea1c0fbb9064b92fb3dd Mon Sep 17 00:00:00 2001 From: houseme Date: Wed, 9 Apr 2025 18:36:17 +0800 Subject: [PATCH 1/4] improve Cargo.toml and modify README.md conosel web static url --- Cargo.lock | 37 ++++++++++++++++++++++++++--- Cargo.toml | 16 ++++++++----- README.md | 3 ++- rustfs/Cargo.toml | 60 ++++++++++++++++++++--------------------------- 4 files changed, 72 insertions(+), 44 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index ca4e5b4e9..68b1892ce 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3035,7 +3035,7 @@ dependencies = [ "madmin", "md-5", "netif", - "nix", + "nix 0.29.0", "num", "num_cpus", "path-absolutize", @@ -4698,6 +4698,24 @@ dependencies = [ "libc", ] +[[package]] +name = "libsystemd" +version = "0.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c592dc396b464005f78a5853555b9f240bc5378bf5221acc4e129910b2678869" +dependencies = [ + "hmac 0.12.1", + "libc", + "log", + "nix 0.27.1", + "nom", + "once_cell", + "serde", + "sha2 0.10.8", + "thiserror 1.0.69", + "uuid", +] + [[package]] name = "libxdo" version = "0.6.0" @@ -5113,6 +5131,18 @@ version = "1.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086" +[[package]] +name = "nix" +version = "0.27.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053" +dependencies = [ + "bitflags 2.9.0", + "cfg-if", + "libc", + "memoffset", +] + [[package]] name = "nix" version = "0.29.0" @@ -7125,6 +7155,7 @@ dependencies = [ "iam", "jsonwebtoken", "lazy_static", + "libsystemd", "local-ip-address", "lock", "madmin", @@ -9894,7 +9925,7 @@ dependencies = [ "futures-sink", "futures-util", "hex", - "nix", + "nix 0.29.0", "ordered-stream", "rand 0.8.5", "serde", @@ -9925,7 +9956,7 @@ dependencies = [ "futures-core", "futures-lite", "hex", - "nix", + "nix 0.29.0", "ordered-stream", "serde", "serde_repr", diff --git a/Cargo.toml b/Cargo.toml index 83e25a062..5a126ae34 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -33,8 +33,12 @@ all = "warn" [workspace.dependencies] madmin = { path = "./madmin" } +atoi = "2.0.0" async-recursion = "1.0.5" async-trait = "0.1.87" +axum = "0.8.3" +axum-extra = "0.10.1" +axum-server = { version = "0.7.2", features = ["tls-rustls"] } backon = "1.3.0" bytes = "1.9.0" bytesize = "1.3.0" @@ -64,7 +68,10 @@ humantime = "2.1.0" keyring = { version = "3.6.1", features = ["apple-native", "windows-native", "sync-secret-service"] } lock = { path = "./common/lock" } lazy_static = "1.5.0" +libsystemd = "0.7.0" local-ip-address = "0.6.3" +matchit = "0.8.4" +md-5 = "0.10.6" mime = "0.3.17" netif = "0.1.6" once_cell = "1.21.1" @@ -101,8 +108,11 @@ s3s-policy = { git = "https://github.com/Nugine/s3s.git", rev = "ab139f72fe768fb shadow-rs = { version = "0.38.0", default-features = false } serde = { version = "1.0.217", features = ["derive"] } serde_json = "1.0.138" +serde_urlencoded = "0.7.1" sha2 = "0.10.8" +snafu = "0.8.5" tempfile = "3.16.0" +test-case = "3.3.1" thiserror = "2.0.12" time = { version = "0.3.41", features = [ "std", @@ -133,13 +143,7 @@ uuid = { version = "1.15.1", features = [ "fast-rng", "macro-diagnostics", ] } -axum = "0.8.3" -axum-extra = "0.10.1" -axum-server = { version = "0.7.2", features = ["tls-rustls"] } -md-5 = "0.10.6" workers = { path = "./common/workers" } -test-case = "3.3.1" -snafu = "0.8.5" [profile.wasm-dev] inherits = "dev" diff --git a/README.md b/README.md index 217ab3c14..9882ae927 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,8 @@ Or use Docker: # How to add Console web -1. wget [http://dl.rustfs.com/console/console.latest.tar.gz](https://dl.rustfs.com/console/rustfs-console-latest.zip) +1. +wget [http://dl.rustfs.com/console/console.latest.tar.gz](https://dl.rustfs.com/artifacts/console/rustfs-console-latest.zip) 2. mkdir in this repos folder `./rustfs/static` diff --git a/rustfs/Cargo.toml b/rustfs/Cargo.toml index 1ab8beb8a..902e0053c 100644 --- a/rustfs/Cargo.toml +++ b/rustfs/Cargo.toml @@ -16,12 +16,21 @@ workspace = true [dependencies] madmin.workspace = true +api = { path = "../s3select/api" } +appauth = { version = "0.0.1", path = "../appauth" } +atoi = { workspace = true } +axum.workspace = true +axum-extra = { workspace = true } +axum-server = { workspace = true } async-trait.workspace = true bytes.workspace = true +chrono = { workspace = true } clap.workspace = true csv = "1.3.1" +crypto = { path = "../crypto" } datafusion = { workspace = true } common.workspace = true +const-str = { version = "0.6.1", features = ["std", "proc"] } ecstore.workspace = true policy.workspace = true flatbuffers.workspace = true @@ -32,8 +41,14 @@ hyper.workspace = true hyper-util.workspace = true http.workspace = true http-body.workspace = true +iam = { path = "../iam" } +jsonwebtoken = "9.3.0" +libsystemd = { workspace = true } lock.workspace = true +local-ip-address = { workspace = true } +matchit = { workspace = true } mime.workspace = true +mime_guess = "2.0.5" netif.workspace = true once_cell.workspace = true pin-project-lite.workspace = true @@ -41,22 +56,22 @@ prost.workspace = true prost-types.workspace = true protos.workspace = true protobuf.workspace = true +query = { path = "../s3select/query" } rmp-serde.workspace = true +rustfs-obs = { workspace = true } rustls.workspace = true rustls-pemfile.workspace = true rustls-pki-types.workspace = true +rust-embed = { workspace = true, features = ["interpolate-folder-path"] } s3s.workspace = true serde.workspace = true serde_json.workspace = true +serde_urlencoded = { workspace = true } +shadow-rs.workspace = true tracing.workspace = true time = { workspace = true, features = ["parsing", "formatting", "serde"] } tokio-util.workspace = true -tokio = { workspace = true, features = [ - "rt-multi-thread", - "macros", - "net", - "signal", -] } +tokio = { workspace = true, features = ["rt-multi-thread", "macros", "net", "signal"] } tokio-rustls.workspace = true lazy_static.workspace = true tokio-stream.workspace = true @@ -67,28 +82,9 @@ tracing-core = { workspace = true } tracing-error.workspace = true tracing-subscriber.workspace = true transform-stream.workspace = true -uuid = "1.15.1" -url.workspace = true -axum.workspace = true -axum-extra = { workspace = true } -axum-server = { workspace = true } -matchit = "0.8.4" -shadow-rs.workspace = true -const-str = { version = "0.6.1", features = ["std", "proc"] } -atoi = "2.0.0" -serde_urlencoded = "0.7.1" -crypto = { path = "../crypto" } -query = { path = "../s3select/query" } -api = { path = "../s3select/api" } -iam = { path = "../iam" } -jsonwebtoken = "9.3.0" tower-http.workspace = true -mime_guess = "2.0.5" -rust-embed = { workspace = true, features = ["interpolate-folder-path"] } -local-ip-address = { workspace = true } -chrono = { workspace = true } -rustfs-obs = { workspace = true } -appauth = { version = "0.0.1", path = "../appauth" } +url.workspace = true +uuid = "1.15.1" [build-dependencies] prost-build.workspace = true @@ -101,13 +97,9 @@ futures-util.workspace = true ecstore = { path = "../ecstore" } s3s.workspace = true clap = { workspace = true } -tracing-subscriber = { version = "0.3.19", features = ["env-filter", "time"] } -hyper-util = { version = "0.1.10", features = [ - "tokio", - "server-auto", - "server-graceful", -] } -transform-stream = "0.3.1" +tracing-subscriber = { workspace = true, features = ["env-filter", "time"] } +hyper-util = { workspace = true, features = ["tokio", "server-auto", "server-graceful"] } +transform-stream = { workspace = true } netif = "0.1.6" shadow-rs.workspace = true # pin-utils = "0.1.0" From 952f04149f7ddd8203a2dcbc8578019af2df3c69 Mon Sep 17 00:00:00 2001 From: houseme Date: Wed, 9 Apr 2025 19:11:31 +0800 Subject: [PATCH 2/4] add notify systemd --- Cargo.toml | 2 +- rustfs/Cargo.toml | 5 ++++- rustfs/src/console.rs | 2 +- rustfs/src/main.rs | 41 +++++++++++++++++++++++++++++++++++++++-- 4 files changed, 45 insertions(+), 5 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 5a126ae34..9f1b721ce 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -68,7 +68,7 @@ humantime = "2.1.0" keyring = { version = "3.6.1", features = ["apple-native", "windows-native", "sync-secret-service"] } lock = { path = "./common/lock" } lazy_static = "1.5.0" -libsystemd = "0.7.0" +libsystemd = { version = "0.7" } local-ip-address = "0.6.3" matchit = "0.8.4" md-5 = "0.10.6" diff --git a/rustfs/Cargo.toml b/rustfs/Cargo.toml index 902e0053c..00c10bebd 100644 --- a/rustfs/Cargo.toml +++ b/rustfs/Cargo.toml @@ -43,7 +43,7 @@ http.workspace = true http-body.workspace = true iam = { path = "../iam" } jsonwebtoken = "9.3.0" -libsystemd = { workspace = true } +libsystemd = { workspace = true, optional = true } lock.workspace = true local-ip-address = { workspace = true } matchit = { workspace = true } @@ -86,6 +86,9 @@ tower-http.workspace = true url.workspace = true uuid = "1.15.1" +[target.'cfg(target_os = "linux")'.dependencies] +libsystemd = "0.7" + [build-dependencies] prost-build.workspace = true tonic-build.workspace = true diff --git a/rustfs/src/console.rs b/rustfs/src/console.rs index 6b3e507fd..1eff0e906 100644 --- a/rustfs/src/console.rs +++ b/rustfs/src/console.rs @@ -216,7 +216,7 @@ pub async fn start_static_file_server( let app = Router::new() .route("/license", get(license_handler)) .route("/config.json", get(config_handler)) - .nest_service("/", get(static_handler)); + .fallback_service(get(static_handler)); let local_addr: SocketAddr = addrs.parse().expect("Failed to parse socket address"); info!("WebUI: http://{}:{} http://127.0.0.1:{}", local_ip, local_addr.port(), local_addr.port()); info!(" RootUser: {}", access_key); diff --git a/rustfs/src/main.rs b/rustfs/src/main.rs index 4481525bb..bd6d66d06 100644 --- a/rustfs/src/main.rs +++ b/rustfs/src/main.rs @@ -53,6 +53,27 @@ use tracing::{debug, error, info, info_span, warn}; use tracing_error::ErrorLayer; use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt}; +#[cfg(target_os = "linux")] +fn notify_systemd(state: &str) { + use libsystemd::daemon::{notify, NotifyState}; + let notify_state = match state { + "ready" => NotifyState::Ready, + "stopping" => NotifyState::Stopping, + _ => return, + }; + + if let Err(e) = notify(false, &[notify_state]) { + error!("Failed to notify systemd: {}", e); + } else { + debug!("Successfully notified systemd: {}", state); + } +} + +#[cfg(not(target_os = "linux"))] +fn notify_systemd(state: &str) { + debug!("Systemd notifications are not available on this platform (state: {})", state); +} + #[allow(dead_code)] fn setup_tracing() { use tracing_subscriber::EnvFilter; @@ -260,6 +281,9 @@ async fn run(opt: config::Opt) -> Result<()> { None }; + // Create a oneshot channel to wait for the service to start + let (tx, rx) = tokio::sync::oneshot::channel(); + tokio::spawn(async move { let hyper_service = service.into_shared(); let hybrid_service = TowerToHyperService::new( @@ -272,6 +296,10 @@ async fn run(opt: config::Opt) -> Result<()> { let mut ctrl_c = std::pin::pin!(tokio::signal::ctrl_c()); let graceful = hyper_util::server::graceful::GracefulShutdown::new(); debug!("graceful initiated"); + + // Send a message to the main thread to indicate that the server has started + let _ = tx.send(()); + loop { debug!("waiting for SIGINT or SIGTERM has_tls_certs: {}", has_tls_certs); // Wait for a connection @@ -286,9 +314,12 @@ async fn run(opt: config::Opt) -> Result<()> { } } _ = ctrl_c.as_mut() => { + drop(listener); + eprintln!("Ctrl-C received, starting shutdown"); break; } }; + if has_tls_certs { debug!("TLS certificates found, starting with SIGINT"); let tls_socket = match tls_acceptor @@ -353,7 +384,7 @@ async fn run(opt: config::Opt) -> Result<()> { })?; debug!("init store success!"); - init_iam_sys(store.clone()).await.unwrap(); + init_iam_sys(store.clone()).await?; new_global_notification_sys(endpoint_pools.clone()).await.map_err(|err| { error!("new_global_notification_sys failed {:?}", &err); @@ -386,9 +417,15 @@ async fn run(opt: config::Opt) -> Result<()> { }); } + // Wait for the HTTP service to finish starting + if rx.await.is_ok() { + notify_systemd("ready"); + } + tokio::select! { _ = tokio::signal::ctrl_c() => { - + eprintln!("Ctrl-C received, starting shutdown"); + notify_systemd("stopping"); } } From f73bc6a82b9077dc6b12f7f20e6a7fe8574f2a80 Mon Sep 17 00:00:00 2001 From: houseme Date: Wed, 9 Apr 2025 19:11:56 +0800 Subject: [PATCH 3/4] add rsutfs.service and run.md --- rustfs-zh.service | 102 ++++++++++++++++++++++++++++++++++++++++++++++ rustfs.run-zh.md | 90 ++++++++++++++++++++++++++++++++++++++++ rustfs.run.md | 90 ++++++++++++++++++++++++++++++++++++++++ rustfs.service | 60 +++++++++++++++++++++++++++ 4 files changed, 342 insertions(+) create mode 100644 rustfs-zh.service create mode 100644 rustfs.run-zh.md create mode 100644 rustfs.run.md create mode 100644 rustfs.service diff --git a/rustfs-zh.service b/rustfs-zh.service new file mode 100644 index 000000000..2541ec77c --- /dev/null +++ b/rustfs-zh.service @@ -0,0 +1,102 @@ +[Unit] +Description=RustFS Object Storage Server +# 定义服务的描述，说明这是一个 RustFS 对象存储服务器，显示在 systemctl status 中。 +Documentation=https://rustfs.com/docs/ +# 提供服务的官方文档链接，方便管理员查阅，占位符需替换为实际 URL。 +After=network-online.target +# 指定服务在 network-online.target（网络就绪）之后启动，确保网络可用。 +Wants=network-online.target +# 表示服务希望依赖 network-online.target，但不是强依赖，即使网络未就绪也尝试启动。 +# If you're using a database, you'll need to add the corresponding dependencies +# 如果服务依赖数据库，可以添加数据库相关的依赖项（当前为注释，未启用）。 +# After=postgresql.service +# 示例：若依赖 PostgreSQL，则在 PostgreSQL 服务后启动（当前未启用）。 +# Requires=postgresql.service +# 示例：若强制依赖 PostgreSQL，则要求其启动成功（当前未启用）。 + +[Service] +Type=notify +# 服务类型为 notify，表示服务通过 sd_notify 通知 systemd 其状态（如就绪）。 +NotifyAccess=main +# 指定只有主进程可以发送通知给 systemd，避免子进程干扰。 +User=rustfs +# 以 rustfs 用户身份运行服务，需预先创建此用户，提升安全性。 +Group=rustfs +# 以 rustfs 组身份运行服务，与 User 配合使用。 + +# environment variable configuration +# 定义环境变量配置，用于传递给服务程序。 +Environment=RUST_LOG=info +# 设置日志级别为 info，控制服务日志输出（需服务支持此变量）。 +Environment=RUSTFS_ACCESS_KEY=rustfsadmin +# 设置访问密钥为 rustfsadmin，用于 RustFS 的认证。 +Environment=RUSTFS_SECRET_KEY=rustfsadmin +# 设置秘密密钥为 rustfsadmin，与访问密钥配套使用。 + +# working directory +WorkingDirectory=/opt/rustfs +# 设置服务的工作目录为 /opt/rustfs，影响相对路径的解析。 + +# main program +ExecStart=/usr/local/bin/rustfs \ + --address 0.0.0.0:9000 \ + --volumes /data/rustfs/vol1,/data/rustfs/vol2 \ + --obs-config /etc/rustfs/obs.yaml \ + --console-enable \ + --console-address 0.0.0.0:9002 +# 定义启动命令，运行 /usr/local/bin/rustfs，带参数： +# --address 0.0.0.0:9000：服务监听所有接口的 9000 端口。 +# --volumes：指定存储卷路径为 /data/rustfs/vol1 和 /data/rustfs/vol2。 +# --obs-config：指定配置文件路径为 /etc/rustfs/obs.yaml。 +# --console-enable：启用控制台功能。 +# --console-address 0.0.0.0:9002：控制台监听所有接口的 9002 端口。 + +# resource constraints +LimitNOFILE=1048576 +# 设置文件描述符上限为 1048576，支持高并发连接。 +LimitNPROC=32768 +# 设置进程数上限为 32768，限制子进程数量。 +TasksMax=infinity +# 允许服务创建无限数量的线程（谨慎使用，可能耗尽资源）。 + +# restart the policy +Restart=always +# 服务异常退出时总是重启，提高可用性。 +RestartSec=10s +# 重启前等待 10 秒，避免频繁重启导致资源浪费。 + +# graceful exit configuration +TimeoutStartSec=30s +# 启动超时时间为 30 秒，若超时则认为启动失败。 +TimeoutStopSec=30s +# 停止超时时间为 30 秒，若超时则强制停止。 + +# security settings +NoNewPrivileges=true +# 禁止服务提升权限，增强安全性。 +ProtectSystem=full +# 保护系统目录（如 /usr、/boot、/etc）为只读，防止服务修改。 +ProtectHome=true +# 保护用户主目录（如 /home、/root），禁止服务访问。 +PrivateTmp=true +# 为服务提供私有 /tmp 目录，隔离临时文件。 +PrivateDevices=true +# 禁止服务访问硬件设备（如 /dev），提升安全性。 +ProtectClock=true +# 保护系统时钟，禁止服务修改时间。 +ProtectKernelTunables=true +# 保护内核参数（/proc/sys），禁止服务修改。 +ProtectKernelModules=true +# 禁止服务加载或卸载内核模块。 +ProtectControlGroups=true +# 保护控制组（cgroups），禁止服务修改。 +RestrictSUIDSGID=true +# 禁止服务使用 SUID/SGID 文件，提升安全性。 +RestrictRealtime=true +# 禁止服务使用实时调度，防止资源滥用。 +ReadWritePaths=/data/rustfs +# 允许服务对 /data/rustfs 目录读写，限制其他路径访问。 + +[Install] +WantedBy=multi-user.target +# 服务在多用户模式下自动启动，配合 systemctl enable 使用。 \ No newline at end of file diff --git a/rustfs.run-zh.md b/rustfs.run-zh.md new file mode 100644 index 000000000..85def56e7 --- /dev/null +++ b/rustfs.run-zh.md @@ -0,0 +1,90 @@ +# RustFS 服务安装配置教程 + +## 1. 准备工作 + +### 1.1 创建系统用户 + +```bash +# 创建 rustfs 系统用户和用户组，禁止登录shell +sudo useradd -r -s /sbin/nologin rustfs +``` + +### 1.2 创建必要目录 + +```bash +# 创建程序目录 +sudo mkdir -p /opt/rustfs + +# 创建数据目录 +sudo mkdir -p /data/rustfs/{vol1,vol2} + +# 创建配置目录 +sudo mkdir -p /etc/rustfs + +# 设置目录权限 +sudo chown -R rustfs:rustfs /opt/rustfs /data/rustfs +sudo chmod 755 /opt/rustfs /data/rustfs +``` + +## 2. 安装 RustFS + +```bash +# 复制 RustFS 二进制文件 +sudo cp rustfs /usr/local/bin/ +sudo chmod +x /usr/local/bin/rustfs + +# 复制配置文件 +sudo cp obs.yaml /etc/rustfs/ +sudo chown -R rustfs:rustfs /etc/rustfs +``` + +## 3. 配置 Systemd 服务 + +```bash +# 复制服务单元文件 +sudo cp rustfs.service /etc/systemd/system/ + +# 重新加载 systemd 配置 +sudo systemctl daemon-reload +``` + +## 4. 服务管理 + +### 4.1 启动服务 + +```bash +sudo systemctl start rustfs +``` + +### 4.2 查看服务状态 + +```bash +sudo systemctl status rustfs +``` + +### 4.3 启用开机自启 + +```bash +sudo systemctl enable rustfs +``` + +### 4.4 查看服务日志 + +```bash +# 查看实时日志 +sudo journalctl -u rustfs -f + +# 查看今天的日志 +sudo journalctl -u rustfs --since today +``` + +## 5. 验证安装 + +```bash +# 检查服务端口 +ss -tunlp | grep 9000 +ss -tunlp | grep 9002 + +# 测试服务可用性 +curl -I http://localhost:9000 +``` diff --git a/rustfs.run.md b/rustfs.run.md new file mode 100644 index 000000000..2e26ea31a --- /dev/null +++ b/rustfs.run.md @@ -0,0 +1,90 @@ +# RustFS Service Installation Guide + +## 1. Prerequisites + +### 1.1 Create System User + +```bash +# Create rustfs system user and group without login shell +sudo useradd -r -s /sbin/nologin rustfs +``` + +### 1.2 Create Required Directories + +```bash +# Create program directory +sudo mkdir -p /opt/rustfs + +# Create data directories +sudo mkdir -p /data/rustfs/{vol1,vol2} + +# Create configuration directory +sudo mkdir -p /etc/rustfs + +# Set directory permissions +sudo chown -R rustfs:rustfs /opt/rustfs /data/rustfs +sudo chmod 755 /opt/rustfs /data/rustfs +``` + +## 2. Install RustFS + +```bash +# Copy RustFS binary +sudo cp rustfs /usr/local/bin/ +sudo chmod +x /usr/local/bin/rustfs + +# Copy configuration file +sudo cp obs.yaml /etc/rustfs/ +sudo chown -R rustfs:rustfs /etc/rustfs +``` + +## 3. Configure Systemd Service + +```bash +# Copy service unit file +sudo cp rustfs.service /etc/systemd/system/ + +# Reload systemd configuration +sudo systemctl daemon-reload +``` + +## 4. Service Management + +### 4.1 Start Service + +```bash +sudo systemctl start rustfs +``` + +### 4.2 Check Service Status + +```bash +sudo systemctl status rustfs +``` + +### 4.3 Enable Auto-start + +```bash +sudo systemctl enable rustfs +``` + +### 4.4 View Service Logs + +```bash +# View real-time logs +sudo journalctl -u rustfs -f + +# View today's logs +sudo journalctl -u rustfs --since today +``` + +## 5. Verify Installation + +```bash +# Check service ports +ss -tunlp | grep 9000 +ss -tunlp | grep 9002 + +# Test service availability +curl -I http://localhost:9000 +``` diff --git a/rustfs.service b/rustfs.service new file mode 100644 index 000000000..53db8a64a --- /dev/null +++ b/rustfs.service @@ -0,0 +1,60 @@ +[Unit] +Description=RustFS Object Storage Server +Documentation=https://rustfs.com/docs/ +After=network-online.target +Wants=network-online.target +# If you're using a database, you'll need to add the corresponding dependencies +# After=postgresql.service +# Requires=postgresql.service + +[Service] +Type=notify +NotifyAccess=main +User=rustfs +Group=rustfs + +# environment variable configuration +Environment=RUST_LOG=info +Environment=RUSTFS_ACCESS_KEY=rustfsadmin +Environment=RUSTFS_SECRET_KEY=rustfsadmin + +# working directory +WorkingDirectory=/opt/rustfs + +# main program +ExecStart=/usr/local/bin/rustfs \ + --address 0.0.0.0:9000 \ + --volumes /data/rustfs/vol1,/data/rustfs/vol2 \ + --obs-config /etc/rustfs/obs.yaml \ + --console-enable \ + --console-address 0.0.0.0:9002 + +# resource constraints +LimitNOFILE=1048576 +LimitNPROC=32768 +TasksMax=infinity + +# restart the policy +Restart=always +RestartSec=10s + +# graceful exit configuration +TimeoutStartSec=30s +TimeoutStopSec=30s + +# security settings +NoNewPrivileges=true +ProtectSystem=full +ProtectHome=true +PrivateTmp=true +PrivateDevices=true +ProtectClock=true +ProtectKernelTunables=true +ProtectKernelModules=true +ProtectControlGroups=true +RestrictSUIDSGID=true +RestrictRealtime=true +ReadWritePaths=/data/rustfs + +[Install] +WantedBy=multi-user.target \ No newline at end of file From f48d8fc65e7ee7405bd592e20968d7855e1ed751 Mon Sep 17 00:00:00 2001 From: houseme Date: Wed, 9 Apr 2025 19:15:49 +0800 Subject: [PATCH 4/4] Update rustfs/src/main.rs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- rustfs/src/main.rs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rustfs/src/main.rs b/rustfs/src/main.rs index bd6d66d06..2e6760ed4 100644 --- a/rustfs/src/main.rs +++ b/rustfs/src/main.rs @@ -59,7 +59,10 @@ fn notify_systemd(state: &str) { let notify_state = match state { "ready" => NotifyState::Ready, "stopping" => NotifyState::Stopping, - _ => return, + _ => { + warn!("Unsupported state passed to notify_systemd: {}", state); + return; + }, }; if let Err(e) = notify(false, &[notify_state]) {