opn

opnsense/plugin/+POST_INSTALL.pre

@@ -0,0 +1,47 @@
+#!/bin/sh
+
+# Keep the historical service account so package downgrades remain possible,
+# but current OPNsense runtime executes RustProxy as root (see rc.d script).
+if ! /usr/sbin/pw groupshow rustproxy >/dev/null 2>&1; then
+    /usr/sbin/pw groupadd rustproxy
+fi
+
+if ! /usr/sbin/pw usershow rustproxy >/dev/null 2>&1; then
+    /usr/sbin/pw useradd rustproxy -g rustproxy -c "RustProxy daemon" -d /var/db/rustproxy -s /usr/sbin/nologin
+fi
+
+/usr/bin/install -d -o root -g wheel -m 0700 /var/db/rustproxy
+/usr/sbin/chown -R root:wheel /var/db/rustproxy
+/bin/chmod 0700 /var/db/rustproxy
+/usr/bin/install -d -o root -g wheel -m 0750 /var/log/rustproxy
+/usr/bin/install -d -o root -g wheel -m 0750 /var/run/rustproxy
+/usr/bin/install -d -o root -g wheel -m 0755 /usr/local/etc/rustproxy
+
+# configd discovers actions only on startup/reload.  A direct `pkg add` must
+# therefore refresh configd before the MVC service controller can call them.
+/usr/sbin/service configd restart >/dev/null 2>&1 || true
+/usr/local/sbin/pluginctl -cq cache_flush >/dev/null 2>&1 || true
+
+# Apply model migrations before rendering the service template.  In particular
+# 1.4.0 copies the old combined listener values into the split address/port
+# fields so upgrades keep their existing ports instead of falling back.
+if [ -x /usr/local/opnsense/mvc/script/run_migrations.php ]; then
+    /usr/local/opnsense/mvc/script/run_migrations.php >/dev/null 2>&1 || true
+fi
+/usr/local/sbin/configctl template reload OPNsense/RustProxy >/dev/null 2>&1 || true
+
+# A package upgrade invokes the previous package pre-deinstall hook, which stops
+# RustProxy before replacing the binary.  Start it again after migrations and
+# template rendering.  Use the installed service helper directly so this does
+# not depend on configd having finished reloading its action registry.  The
+# helper itself checks enabled=1; on a fresh/default-disabled install this is a
+# no-op.  restart is deliberate: if an old process survived a forced pkg add,
+# it is stopped before the new binary starts.
+if [ -x /usr/local/opnsense/scripts/rustproxy/service.sh ]; then
+    if ! /usr/local/opnsense/scripts/rustproxy/service.sh restart; then
+        echo "WARNING: RustProxy package installed but the service could not be started." >&2
+        echo "Check /var/log/rustproxy/rustproxy.log and run: configctl rustproxy start" >&2
+    fi
+fi
+
+exit 0