mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-20 03:11:46 +00:00
Josh Siviour
eb53dc3396
* fix: reap orphaned nbdkit processes recovery cannot adopt recoverMountedVolumes already rebuilds MountedVolumes from surviving nbdkit processes, but an unadoptable backend (buildVB fails, most commonly a deleted volume) or a duplicate corroborated process for an already-adopted volume was logged and left running forever, with no later pass reconsidering it. Reap both classes, but only when a scan of every other process's /proc/<pid>/cmdline on the host finds no reference to the backend's NBD endpoint -- its socket path, or its 127.0.0.1:<port> pair, checked both joined and split across server.host=/server.port=. A referencing process, or a scan that could not complete, both leave the process running and log loudly instead, since signalling the wrong process destroys a running guest's data path. * fix: treat an unreadable /proc candidate as inconclusive, not absent endpointReferencer skipped any os.ReadFile failure on a candidate's cmdline, which silently counted a read it could not perform as evidence the candidate does not reference the endpoint. Under a /proc mounted with hidepid, a guest QEMU owned by another uid is invisible this way, so an in-use backend could be reaped. Only os.IsNotExist (the candidate exited between ReadDir and the read) continues the scan. Any other error now returns non-nil from endpointReferencer, which reapOrphanedNbdkit already treats as an inconclusive scan: leave the process running, log at WARN. * fix: stop orphan nbdkit reaping from killing live backends under hidepid=invisible hidepid=invisible hides another uid's /proc/<pid> directory entry outright, not just its contents, so a live QEMU referencer (owned by spinifex-daemon) never appeared in viperblockd's scan at all -- a clean "no referencer" result that was actually just a hidden one. reapOrphanedNbdkit now detects the hazardous mount via /proc/self/mountinfo and declines to reap rather than trust a scan that could be blind to a live guest. spinifex-viperblock.service drops ProtectProc=invisible (now default, same tradeoff already accepted by spinifex-qmp-collector.service) so the scan can actually see spinifex-daemon's processes again once it's safe to trust.
69 lines
2.2 KiB
Desktop File
69 lines
2.2 KiB
Desktop File
# spinifex-unit-version: 2
|
|
[Unit]
|
|
Description=Spinifex Viperblock (Block Storage)
|
|
PartOf=spinifex.target
|
|
After=spinifex-nats.service spinifex-predastore.service
|
|
Wants=spinifex-nats.service
|
|
|
|
[Service]
|
|
EnvironmentFile=-/etc/spinifex/telemetry.env
|
|
Type=simple
|
|
Slice=spinifex-system.slice
|
|
User=spinifex-viperblock
|
|
Group=spinifex
|
|
ExecStartPre=/var/lib/spinifex/wait-for-nats.sh
|
|
ExecStart=/usr/local/bin/spx service viperblock start
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
OOMScoreAdjust=-500
|
|
# Per-service ceiling bounds a leak in this service alone rather than
|
|
# tripping the slice-wide cap, which would pick an arbitrary victim.
|
|
MemoryHigh=15%
|
|
MemoryMax=25%
|
|
# KillMode=process: nbdkit still serving a guest survives a restart here, the
|
|
# way guest QEMU survives a daemon restart. Tearing one out mid-write corrupts
|
|
# that guest's filesystem; idle nbdkit is reaped explicitly on shutdown.
|
|
KillMode=process
|
|
# One worst-case nbdkit reap: killProcessGracePeriod (120s, utils.KillProcess)
|
|
# plus its own shutdownDrainTimeout (20s, viperblock/nbd) and headroom — must
|
|
# strictly exceed 120s now shutdownVolumes reaps concurrently, not serially.
|
|
TimeoutStopSec=150
|
|
EnvironmentFile=/etc/spinifex/systemd.env
|
|
Environment=SPINIFEX_CONFIG_PATH=/etc/spinifex/spinifex.toml
|
|
Environment=SPINIFEX_BASE_DIR=/var/lib/spinifex/viperblock/
|
|
|
|
# Filesystem access
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
PrivateDevices=yes
|
|
ReadOnlyPaths=/etc/spinifex/spinifex.toml /etc/spinifex/systemd.env /etc/spinifex/ca.pem
|
|
ReadWritePaths=/var/lib/spinifex/viperblock /var/log/spinifex /run/spinifex/nbd
|
|
|
|
# Hardening
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
RestrictRealtime=yes
|
|
RestrictNamespaces=yes
|
|
ProtectClock=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
# ProtectProc must stay default: hidepid=invisible hides spinifex-daemon's
|
|
# QEMU /proc entries (different uid) orphan nbdkit reaping must see.
|
|
SystemCallArchitectures=native
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
|
|
CapabilityBoundingSet=
|
|
ProtectHostname=yes
|
|
KeyringMode=private
|
|
RemoveIPC=yes
|
|
LimitCORE=0
|
|
LimitNOFILE=65536
|
|
LimitNPROC=4096
|
|
|
|
[Install]
|
|
WantedBy=spinifex.target
|