gru/rust-package-builder
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chages in systemd

Browse Source
This commit is contained in:
Mateusz Gruszczyński committed 2026-10-21 10:50:35 +02:00
1 parent a1389a6a61
commit 3b317a4f0c
9 files changed
+249 -41
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

scripts/lib.sh
+1 -1
View File
@@ -2,7 +2,7 @@
set -Eeuo pipefail
# Increment when package payload/installation semantics change without a source commit.
PACKAGING_REVISION=4
PACKAGING_REVISION=5
OPNSENSE_PACKAGING_REVISION=4
FREEBSD_NATIVE_PACKAGING_REVISION=1
scripts/normalize-systemd-unit.py
+42
View File
@@ -0,0 +1,42 @@
#!/usr/bin/env python3
"""Normalize the packaged RustProxy systemd unit for Linux DEB/RPM."""
from pathlib import Path
import re
import sys
path = Path(sys.argv[1])
name = sys.argv[2]
text = path.read_text()
if not re.search(r'^\[Service\][ \t]*$', text, re.M):
raise SystemExit('unit has no [Service] section')
# This normalization also covers older/source-provided debian/*.service units:
# ProtectHome=true masks /home completely, so neither chgrp nor setfacl can
# make web roots/certificate files there readable. Keep the directories
# read-only, in addition to the existing strict filesystem sandbox.
if re.search(r'^[ \t]*ProtectHome[ \t]*=', text, re.M):
text = re.sub(r'^[ \t]*ProtectHome[ \t]*=.*$', 'ProtectHome=read-only',
text, flags=re.M)
else:
text = re.sub(r'^(\[Service\][ \t]*\n)',
lambda m: m.group(1) + 'ProtectHome=read-only\n',
text, count=1, flags=re.M)
if not re.search(r'^ExecReload=', text, re.M):
if not re.search(r'^ExecStart=', text, re.M):
raise SystemExit('unit has no ExecStart; cannot attach reload')
text = re.sub(
r'^(ExecStart=[^\n]*\n)',
lambda m: m.group(1) +
f'ExecReload=/usr/bin/{name} --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 reload\n',
text,
count=1,
flags=re.M,
)
if re.search(r'^ProtectSystem=strict\s*$', text, re.M) and not re.search(
r'^ReadWritePaths=.*(?:^|[ \t])-?/etc/rustproxy(?:[ \t]|$)', text, re.M
):
text = re.sub(
r'^(ProtectSystem=strict\s*\n)',
lambda m: m.group(1) + 'ReadWritePaths=-/etc/rustproxy\n',
text, count=1, flags=re.M,
)
path.write_text(text)
scripts/prepare-package.sh
+9 -29
View File
@@ -14,6 +14,7 @@ install -D -m 0755 "$BINARY_PATH" "$PKG/payload/usr/bin/$BINARY_NAME"
SERVICE_SRC="$SRC/debian/${PACKAGE_NAME}.service"
ENV_SRC="$SRC/debian/${PACKAGE_NAME}.environment"
LOGROTATE_SRC="$BUILDER_ROOT/packaging/rustproxy.logrotate"
ACCESS_GUIDE_SRC="$BUILDER_ROOT/packaging/rustproxy-filesystem-access.md"
TMPFILES_SRC="$SRC/debian/${PACKAGE_NAME}.tmpfiles"
POSTINST_SRC="$SRC/debian/${PACKAGE_NAME}.postinst"
@@ -52,7 +53,9 @@ ProtectSystem=strict
LogsDirectory=rustproxy
LogsDirectoryMode=0700
ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy
ProtectHome=true
# Allow ACL/group-controlled read access to web roots and external certificates
# under /home; ProtectSystem=strict still makes all other paths read-only.
ProtectHome=read-only
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
@@ -71,40 +74,16 @@ fi
# Match the 0.34.x CLI. Avoid changing upstream units that already provide
# their own ExecReload. Linux package revision forces rebuilding old binaries.
python3 - "$PKG/payload/usr/lib/systemd/system/${PACKAGE_NAME}.service" "$BINARY_NAME" <<'PY_UNIT'
from pathlib import Path
import re
import sys
path = Path(sys.argv[1])
name = sys.argv[2]
text = path.read_text()
if not re.search(r'^ExecReload=', text, re.M):
if not re.search(r'^ExecStart=', text, re.M):
raise SystemExit('unit has no ExecStart; cannot attach reload')
text = re.sub(
r'^(ExecStart=[^\n]*\n)',
lambda m: m.group(1) +
f'ExecReload=/usr/bin/{name} --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 reload\n',
text,
count=1,
flags=re.M,
)
if re.search(r'^ProtectSystem=strict\s*$', text, re.M) and not re.search(
r'^ReadWritePaths=.*(?:^|[ \t])-?/etc/rustproxy(?:[ \t]|$)', text, re.M
):
text = re.sub(
r'^(ProtectSystem=strict\s*\n)',
lambda m: m.group(1) + 'ReadWritePaths=-/etc/rustproxy\n',
text, count=1, flags=re.M,
)
path.write_text(text)
PY_UNIT
python3 "$BUILDER_ROOT/scripts/normalize-systemd-unit.py" \
"$PKG/payload/usr/lib/systemd/system/${PACKAGE_NAME}.service" "$BINARY_NAME"
if [[ -r "$ENV_SRC" ]]; then
install -D -m 0640 "$ENV_SRC" "$PKG/payload/etc/${PACKAGE_NAME}/environment"
fi
[[ -r "$LOGROTATE_SRC" ]] || fatal "missing bundled logrotate configuration: $LOGROTATE_SRC"
install -D -m 0644 "$LOGROTATE_SRC" "$PKG/payload/etc/logrotate.d/${PACKAGE_NAME}"
[[ -r "$ACCESS_GUIDE_SRC" ]] || fatal "missing Linux filesystem access guide: $ACCESS_GUIDE_SRC"
install -D -m 0644 "$ACCESS_GUIDE_SRC" "$PKG/payload/usr/share/doc/${PACKAGE_NAME}/FILESYSTEM_ACCESS.md"
if [[ -r "$TMPFILES_SRC" ]]; then
install -D -m 0644 "$TMPFILES_SRC" "$PKG/payload/usr/lib/tmpfiles.d/${PACKAGE_NAME}.conf"
fi
@@ -214,6 +193,7 @@ add_content "$PKG/payload/usr/bin/$BINARY_NAME" "/usr/bin/$BINARY_NAME" 0755
add_content "$PKG/payload/usr/lib/systemd/system/${PACKAGE_NAME}.service" "/usr/lib/systemd/system/${PACKAGE_NAME}.service" 0644
[[ -f "$PKG/payload/etc/${PACKAGE_NAME}/environment" ]] && add_content "$PKG/payload/etc/${PACKAGE_NAME}/environment" "/etc/${PACKAGE_NAME}/environment" 0640 'config|noreplace'
add_content "$PKG/payload/etc/logrotate.d/${PACKAGE_NAME}" "/etc/logrotate.d/${PACKAGE_NAME}" 0644 'config|noreplace'
add_content "$PKG/payload/usr/share/doc/${PACKAGE_NAME}/FILESYSTEM_ACCESS.md" "/usr/share/doc/${PACKAGE_NAME}/FILESYSTEM_ACCESS.md" 0644
[[ -f "$PKG/payload/usr/lib/tmpfiles.d/${PACKAGE_NAME}.conf" ]] && add_content "$PKG/payload/usr/lib/tmpfiles.d/${PACKAGE_NAME}.conf" "/usr/lib/tmpfiles.d/${PACKAGE_NAME}.conf" 0644
[[ -f "$PKG/payload/usr/share/${PACKAGE_NAME}/grafana/rustproxy-overview.json" ]] && add_content "$PKG/payload/usr/share/${PACKAGE_NAME}/grafana/rustproxy-overview.json" "/usr/share/${PACKAGE_NAME}/grafana/rustproxy-overview.json" 0644
[[ -f "$PKG/payload/usr/share/doc/${PACKAGE_NAME}/grafana/README.md" ]] && add_content "$PKG/payload/usr/share/doc/${PACKAGE_NAME}/grafana/README.md" "/usr/share/doc/${PACKAGE_NAME}/grafana/README.md" 0644