From 2fbfb934c4bc2f53b6409b2cd87cad71f811c07f Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 15 Apr 2024 17:34:16 -0400 Subject: [PATCH] use systemd overrides to avoid modifying service unit in /lib --- .../linux/nfpm-openziti-controller.yaml | 3 +++ .../linux/nfpm-openziti-router.yaml | 3 +++ .../linux/openziti-controller/postinstall.bash | 4 ++-- .../openziti-controller/ziti-controller.service | 7 ------- .../ziti-controller.service.override.conf | 17 +++++++++++++++++ .../linux/openziti-router/postinstall.bash | 2 +- .../linux/openziti-router/ziti-router.service | 12 ------------ .../ziti-router.service.override.conf | 14 ++++++++++++++ 8 files changed, 40 insertions(+), 22 deletions(-) create mode 100644 dist/dist-packages/linux/openziti-controller/ziti-controller.service.override.conf create mode 100644 dist/dist-packages/linux/openziti-router/ziti-router.service.override.conf diff --git a/dist/dist-packages/linux/nfpm-openziti-controller.yaml b/dist/dist-packages/linux/nfpm-openziti-controller.yaml index a41e6f6f8..819c71e31 100644 --- a/dist/dist-packages/linux/nfpm-openziti-controller.yaml +++ b/dist/dist-packages/linux/nfpm-openziti-controller.yaml @@ -18,6 +18,9 @@ contents: - dst: /lib/systemd/system/ src: ./dist/dist-packages/linux/openziti-controller/ziti-controller.service + - dst: /etc/systemd/system/ziti-controller.service.d/override.conf + src: ./dist/dist-packages/linux/openziti-controller/ziti-controller.service.override.conf + - dst: /opt/openziti/etc/controller type: dir file_info: diff --git a/dist/dist-packages/linux/nfpm-openziti-router.yaml b/dist/dist-packages/linux/nfpm-openziti-router.yaml index 1f64068f5..7183fac1f 100644 --- a/dist/dist-packages/linux/nfpm-openziti-router.yaml +++ b/dist/dist-packages/linux/nfpm-openziti-router.yaml @@ -18,6 +18,9 @@ contents: - dst: /lib/systemd/system/ src: ./dist/dist-packages/linux/openziti-router/ziti-router.service + - dst: /etc/systemd/system/ziti-router.service.d/override.conf + src: ./dist/dist-packages/linux/openziti-router/ziti-router.service.override.conf + - dst: /opt/openziti/etc/router type: dir file_info: diff --git a/dist/dist-packages/linux/openziti-controller/postinstall.bash b/dist/dist-packages/linux/openziti-controller/postinstall.bash index feec88c69..96e4076ce 100755 --- a/dist/dist-packages/linux/openziti-controller/postinstall.bash +++ b/dist/dist-packages/linux/openziti-controller/postinstall.bash @@ -98,7 +98,7 @@ promptPwd() { # prompt for password token if interactive, unless already answered else if ! [[ "${ZITI_BOOTSTRAP_DATABASE:-}" == true ]]; then - echo "INFO: ZITI_BOOTSTRAP_DATABASE is not true in ${ZITI_CTRL_SVC_FILE}" >&2 + echo "INFO: ZITI_BOOTSTRAP_DATABASE is not true in ${ZITI_CTRL_SVC_ENV_FILE}" >&2 # do nothing if enrollment token is already defined in env file elif [[ -n "${ZITI_PWD:-}" ]]; then echo "INFO: ZITI_PWD is defined in ${ZITI_CTRL_BOOT_ENV_FILE} and will be used to init db during"\ @@ -173,7 +173,7 @@ DEFAULT_ADDR=localhost ZITI_PWD_FILE=/opt/openziti/etc/controller/.pwd ZITI_CTRL_SVC_ENV_FILE=/opt/openziti/etc/controller/service.env ZITI_CTRL_BOOT_ENV_FILE=/opt/openziti/etc/controller/bootstrap.env -ZITI_CTRL_SVC_FILE=/lib/systemd/system/ziti-controller.service +ZITI_CTRL_SVC_FILE=/etc/systemd/system/ziti-controller.service.d/override.conf # initialize a file descriptor for debug output : "${DEBUG:=0}" diff --git a/dist/dist-packages/linux/openziti-controller/ziti-controller.service b/dist/dist-packages/linux/openziti-controller/ziti-controller.service index e67f436c4..9baeb4634 100644 --- a/dist/dist-packages/linux/openziti-controller/ziti-controller.service +++ b/dist/dist-packages/linux/openziti-controller/ziti-controller.service @@ -4,13 +4,6 @@ After=network-online.target [Service] -# you must set the admin password to bootstrap the database; the bootstrapping script will initialize the default admin -# username and password by loading the password from a file or env var; for security, set permissions to allow read only -# by root only and remove the file after the bootstrapping that occurs on the first run or set ZITI_PWD in -# /opt/openziti/etc/controller/bootstrap.env -# -LoadCredential=ZITI_PWD:/opt/openziti/etc/controller/.pwd - # ## Optional Permissions # diff --git a/dist/dist-packages/linux/openziti-controller/ziti-controller.service.override.conf b/dist/dist-packages/linux/openziti-controller/ziti-controller.service.override.conf new file mode 100644 index 000000000..fcc1c3375 --- /dev/null +++ b/dist/dist-packages/linux/openziti-controller/ziti-controller.service.override.conf @@ -0,0 +1,17 @@ +[Service] + +# you must set the admin password to bootstrap the database; the bootstrapping script will initialize the default admin +# username and password by loading the password from a file or env var; for security, set permissions to allow read only +# by root only and remove the file after the bootstrapping that occurs on the first run or set ZITI_PWD in +# /opt/openziti/etc/controller/bootstrap.env +# +LoadCredential=ZITI_PWD:/opt/openziti/etc/controller/.pwd + +# +## Optional Permissions +# + +# allow binding low ports, e.g., 443/tcp; NOTE: use TLS passthrough if fronting with a reverse proxy, i.e., "raw" TCP +# proxy +# AmbientCapabilities=CAP_NET_BIND_SERVICE + diff --git a/dist/dist-packages/linux/openziti-router/postinstall.bash b/dist/dist-packages/linux/openziti-router/postinstall.bash index b05c2fb33..afd55fc99 100755 --- a/dist/dist-packages/linux/openziti-router/postinstall.bash +++ b/dist/dist-packages/linux/openziti-router/postinstall.bash @@ -222,7 +222,7 @@ DEFAULT_ADDR=localhost ZITI_ENROLL_TOKEN_FILE=/opt/openziti/etc/router/.token ZITI_ROUTER_BOOT_ENV_FILE=/opt/openziti/etc/router/bootstrap.env ZITI_ROUTER_SVC_ENV_FILE=/opt/openziti/etc/router/service.env -ZITI_ROUTER_SVC_FILE=/lib/systemd/system/ziti-router.service +ZITI_ROUTER_SVC_FILE=/etc/systemd/system/ziti-router.service.d/override.conf # initialize a file descriptor for debug output : "${DEBUG:=0}" diff --git a/dist/dist-packages/linux/openziti-router/ziti-router.service b/dist/dist-packages/linux/openziti-router/ziti-router.service index 3a8b3774e..69e1aab17 100644 --- a/dist/dist-packages/linux/openziti-router/ziti-router.service +++ b/dist/dist-packages/linux/openziti-router/ziti-router.service @@ -4,18 +4,6 @@ After=network-online.target [Service] -# you must provide an enrollment token to enroll the router at first startup -LoadCredential=ZITI_ENROLL_TOKEN:/opt/openziti/etc/router/.token - -# -## extra permissions -# - -# allow binding low ports, e.g., 443/tcp; required when ZITI_ROUTER_MODE=tproxy or ZITI_ROUTER_PORT <= 1024 -# AmbientCapabilities=CAP_NET_BIND_SERVICE -# allow adding IP routes and iptables rules; required when ZITI_ROUTER_MODE=tproxy -# AmbientCapabilities=CAP_NET_ADMIN - # ## options # diff --git a/dist/dist-packages/linux/openziti-router/ziti-router.service.override.conf b/dist/dist-packages/linux/openziti-router/ziti-router.service.override.conf new file mode 100644 index 000000000..8f824dda8 --- /dev/null +++ b/dist/dist-packages/linux/openziti-router/ziti-router.service.override.conf @@ -0,0 +1,14 @@ +[Service] + +# you must provide an enrollment token to enroll the router at first startup +LoadCredential=ZITI_ENROLL_TOKEN:/opt/openziti/etc/router/.token + +# +## extra permissions +# + +# allow binding low ports, e.g., 443/tcp; required when ZITI_ROUTER_MODE=tproxy or ZITI_ROUTER_PORT <= 1024 +# AmbientCapabilities=CAP_NET_BIND_SERVICE +# allow adding IP routes and iptables rules; required when ZITI_ROUTER_MODE=tproxy +# AmbientCapabilities=CAP_NET_ADMIN +