mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-22 12:16:52 +00:00
Josh Siviour
7d99705eff
* fix(e2e): kill the node-failure phase abruptly instead of draining it Phase 8 used `systemctl stop spinifex.target`, which now drains guests gracefully since the target-stop drain fix landed, so it tested an orderly shutdown rather than a failure. Since a target unit has no process of its own and cannot be signalled, and PartOf= only propagates stop/restart jobs rather than kill, SIGKILL each core service's main process directly instead, leaving orphaned guest qemu/nbdkit processes for recovery to reattach. Also fix a stale comment on spinifex-predastore.service's TimeoutStopSec: it claimed to match viperblock's drain budget, which is now 150s rather than 30s. The value was already correct; only the rationale was outdated. * fix(e2e): hold node2's outage open through Phase 8's assertions Restart=on-failure was respawning each killed unit within ~5s, so every Phase 8 assertion ran against an already-recovered node2 and DEGRADED_PEERS never actually dropped. Stop the same units right after the kill to cancel the queued restart and keep them down for the rest of the phase, and make the NATS degraded-peer count a real assertion (sized off NODE_COUNT) now that it can genuinely fail.
71 lines
2.4 KiB
Desktop File
71 lines
2.4 KiB
Desktop File
# spinifex-unit-version: 2
|
|
[Unit]
|
|
Description=Spinifex Predastore (S3-compatible Object Storage)
|
|
PartOf=spinifex.target
|
|
After=spinifex-nats.service
|
|
Wants=spinifex-nats.service
|
|
|
|
[Service]
|
|
EnvironmentFile=-/etc/spinifex/telemetry.env
|
|
# Guest block I/O arrives with no caller trace; sample those roots at 5% so
|
|
# they don't drown request traces. Request-linked spans are always kept.
|
|
Environment=MULGA_ROOT_TRACE_RATIO=0.05
|
|
Type=simple
|
|
Slice=spinifex-system.slice
|
|
User=spinifex-storage
|
|
Group=spinifex
|
|
ExecStartPre=/var/lib/spinifex/wait-for-nats.sh
|
|
ExecStart=/usr/local/bin/spx service predastore start
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
# Bounds predastore's own graceful stop. viperblock's WAL flush writes into
|
|
# predastore, but After= already stops viperblock first (within its own 150s
|
|
# budget); this is the backstop if that ordering is ever bypassed.
|
|
TimeoutStopSec=30
|
|
OOMScoreAdjust=-500
|
|
# Legitimately the most memory-hungry infra service (S3 buffering/caching);
|
|
# High/Max stay well above idle so normal load isn't throttled, while still
|
|
# bounding a leak short of the slice-wide cap.
|
|
MemoryHigh=40%
|
|
MemoryMax=55%
|
|
Environment=SPINIFEX_CONFIG_PATH=/etc/spinifex/spinifex.toml
|
|
Environment=SPINIFEX_PREDASTORE_CONFIG_PATH=/etc/spinifex/predastore/predastore.toml
|
|
Environment=SPINIFEX_PREDASTORE_BASE_PATH=/var/lib/spinifex/predastore/
|
|
Environment=SPINIFEX_PREDASTORE_TLS_CERT=/etc/spinifex/server.pem
|
|
Environment=SPINIFEX_PREDASTORE_TLS_KEY=/etc/spinifex/server.key
|
|
Environment=SPINIFEX_PREDASTORE_ENCRYPTION_KEY_FILE=/etc/spinifex/predastore/encryption.key
|
|
|
|
# Filesystem access
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
PrivateDevices=yes
|
|
ReadOnlyPaths=/etc/spinifex/predastore /etc/spinifex/spinifex.toml /etc/spinifex/master.key /etc/spinifex/server.pem /etc/spinifex/server.key /etc/spinifex/ca.pem
|
|
ReadWritePaths=/var/lib/spinifex/predastore /var/log/spinifex
|
|
|
|
# Hardening
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
RestrictRealtime=yes
|
|
RestrictNamespaces=yes
|
|
ProtectClock=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectProc=invisible
|
|
SystemCallArchitectures=native
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
|
|
CapabilityBoundingSet=
|
|
ProtectHostname=yes
|
|
KeyringMode=private
|
|
RemoveIPC=yes
|
|
LimitCORE=0
|
|
LimitNOFILE=65536
|
|
LimitNPROC=4096
|
|
|
|
[Install]
|
|
WantedBy=spinifex.target
|