Skip to content
This repository was archived by the owner on Feb 18, 2025. It is now read-only.

Conversation

mateusduboli
Copy link
Contributor

Target issue: #229
Using systemd unit files allows us to do nifty things like auto restarts and managing logs via syslog and other features. So we found interesting to move with that.

Target issue: #117
Running as a privileged user has various security concerns with possible leaks and vulnerabilities when running in the wild, so this additions use fpm to create default "orchestrator" user and group on debs and rpm files.

Disclaimer
On this PR I'm actually covering 2 issues, which is not ideal, but since I'm relying on changes made on one commit, I'm actually creating them as a single PR, which can be split later on.

Copy link
Collaborator

@shlomi-noach shlomi-noach left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks good! Thank you for not breaking behavior and for providing a command line option to build the proper init setup.

I'll experiment with this a bit.

@sjmudd
Copy link
Collaborator

sjmudd commented Oct 16, 2018

A couple of things here:

  • previous experience with rpm has shown that it is often good (if possible) to use a standard uid. Not doing so can lead to issues if the resulting new user has different values and you start copying files from one system to another. With orchestrator it's likely that more than one orchestrator app is running on a system and it's likely that you want these uids to be consistent. Consequently if it's possible in the fpm packaging to provide a suggested (but overridable user/group id) that would be good.
  • Generally with the choice between using systemd or using older init scripts if possible I'd prefer the package to be able to figure out which version is appropriate depending on the target OS and version. How possible that is I'm not sure. So perhaps it's possible to recognise at least some OS/version combinations and auto-configure these accordingly. A simple example would be CentOS 6 and earlier uses init scripts, CentOS 7 and later uses systemd. I'd expect that for Debian and Ubuntu similar rules could be found. Others can probably provide support for their faviourite OS and if the combination can't be found force the user to specify the right value.

So it's nice to see support for systemd and also to move away from running as root. Given orchestrator's default port bindings are above port 1024 this change shouldn't make any big change. However, it may mean that scripts expected to run as root may no longer work or require the use of sudo or equivalent if root functionality is required. I guess people who have already written such scripts to deploy with orchestrator will need to be aware of this change as it might cause surprises during MySQL failover handling which would not be good. Maybe if orchestrator should/could log if it's not running as root to make this a bit more noticeable. An extra log line won't cause any harm.

@shlomi-noach
Copy link
Collaborator

This build fails on one of my boxes: ERROR: Unrecognised option '--user' in fpm execution.

Which means we depend on a specific version of fpm to build orchestrator, which is not a good thing. For a while now I've been considering replacing fpm with nfpm. fpm is a real hassle to install what with ruby versions, various gem dependencies, different OS versions.

So I'm inclined to look into nfpm and include it as a binary within orchestrator's repo.

@shlomi-noach
Copy link
Collaborator

@mateusduboli which version of fpm are you using? I'm using fpm-1.10.2

@mateusduboli
Copy link
Contributor Author

So @shlomi-noach, the problem was it needed package prefixes for user and groups.
It's fixed now :)

@shlomi-noach shlomi-noach self-assigned this Nov 15, 2018
@shlomi-noach
Copy link
Collaborator

Extremely sorry for dropping this. Looking into.

@shlomi-noach
Copy link
Collaborator

Generally with the choice between using systemd or using older init scripts if possible I'd prefer the package to be able to figure out which version is appropriate depending on the target OS and version.

@sjmudd I don't see that there's a generic way to do that. Solutions I see use Post-install scripts to copy either sysv or systemd script to the right place. I'ts not the prettiest.

So it's nice to see support for systemd and also to move away from running as root. Given orchestrator's default port bindings are above port 1024 this change shouldn't make any big change. However, it may mean that scripts expected to run as root may no longer work or require the use of sudo or equivalent if root functionality is required. I guess people who have already written such scripts to deploy with orchestrator will need to be aware of this change as it might cause surprises during MySQL failover handling which would not be good.

Oh yes, I agree. It's great that this PR moves away from root but we also need to consider existing installations. Thinking about this for a bit.

@shlomi-noach
Copy link
Collaborator

I'm pivoting at #915

@laurent-indermuehle
Copy link
Contributor

Nice work on systemd :)

Is it just me or you need to add :
[Install] WantedBy=multi-user.target
in order to enable this unit file ?
Before I done that, on RedHat reboot, systemd didn't reload orchestrator.service and the command systemctl enable orchestrator.service did nothing.

@john9x
Copy link

john9x commented Nov 6, 2019

Is it just me or you need to add :
[Install] WantedBy=multi-user.target
in order to enable this unit file ?
Before I done that, on RedHat reboot, systemd didn't reload orchestrator.service and the command systemctl enable orchestrator.service did nothing.

Same problem

@shlomi-noach
Copy link
Collaborator

@Honiix could you please open a PR?

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants