gru/rust-package-builder
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chages in systemd

Browse Source
This commit is contained in:
Mateusz Gruszczyński committed 2026-10-21 10:50:35 +02:00
1 parent a1389a6a61
commit 3b317a4f0c
9 files changed
+249 -41
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

scripts/prepare-package.sh
+9 -29
View File
@@ -14,6 +14,7 @@ install -D -m 0755 "$BINARY_PATH" "$PKG/payload/usr/bin/$BINARY_NAME"
SERVICE_SRC="$SRC/debian/${PACKAGE_NAME}.service"
ENV_SRC="$SRC/debian/${PACKAGE_NAME}.environment"
LOGROTATE_SRC="$BUILDER_ROOT/packaging/rustproxy.logrotate"
ACCESS_GUIDE_SRC="$BUILDER_ROOT/packaging/rustproxy-filesystem-access.md"
TMPFILES_SRC="$SRC/debian/${PACKAGE_NAME}.tmpfiles"
POSTINST_SRC="$SRC/debian/${PACKAGE_NAME}.postinst"
@@ -52,7 +53,9 @@ ProtectSystem=strict
LogsDirectory=rustproxy
LogsDirectoryMode=0700
ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy
ProtectHome=true
# Allow ACL/group-controlled read access to web roots and external certificates
# under /home; ProtectSystem=strict still makes all other paths read-only.
ProtectHome=read-only
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
@@ -71,40 +74,16 @@ fi
# Match the 0.34.x CLI. Avoid changing upstream units that already provide
# their own ExecReload. Linux package revision forces rebuilding old binaries.
python3 - "$PKG/payload/usr/lib/systemd/system/${PACKAGE_NAME}.service" "$BINARY_NAME" <<'PY_UNIT'
from pathlib import Path
import re
import sys
path = Path(sys.argv[1])
name = sys.argv[2]
text = path.read_text()
if not re.search(r'^ExecReload=', text, re.M):
if not re.search(r'^ExecStart=', text, re.M):
raise SystemExit('unit has no ExecStart; cannot attach reload')
text = re.sub(
r'^(ExecStart=[^\n]*\n)',
lambda m: m.group(1) +
f'ExecReload=/usr/bin/{name} --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 reload\n',
text,
count=1,
flags=re.M,
)
if re.search(r'^ProtectSystem=strict\s*$', text, re.M) and not re.search(
r'^ReadWritePaths=.*(?:^|[ \t])-?/etc/rustproxy(?:[ \t]|$)', text, re.M
):
text = re.sub(
r'^(ProtectSystem=strict\s*\n)',
lambda m: m.group(1) + 'ReadWritePaths=-/etc/rustproxy\n',
text, count=1, flags=re.M,
)
path.write_text(text)
PY_UNIT
python3 "$BUILDER_ROOT/scripts/normalize-systemd-unit.py" \
"$PKG/payload/usr/lib/systemd/system/${PACKAGE_NAME}.service" "$BINARY_NAME"
if [[ -r "$ENV_SRC" ]]; then
install -D -m 0640 "$ENV_SRC" "$PKG/payload/etc/${PACKAGE_NAME}/environment"
fi
[[ -r "$LOGROTATE_SRC" ]] || fatal "missing bundled logrotate configuration: $LOGROTATE_SRC"
install -D -m 0644 "$LOGROTATE_SRC" "$PKG/payload/etc/logrotate.d/${PACKAGE_NAME}"
[[ -r "$ACCESS_GUIDE_SRC" ]] || fatal "missing Linux filesystem access guide: $ACCESS_GUIDE_SRC"
install -D -m 0644 "$ACCESS_GUIDE_SRC" "$PKG/payload/usr/share/doc/${PACKAGE_NAME}/FILESYSTEM_ACCESS.md"
if [[ -r "$TMPFILES_SRC" ]]; then
install -D -m 0644 "$TMPFILES_SRC" "$PKG/payload/usr/lib/tmpfiles.d/${PACKAGE_NAME}.conf"
fi
@@ -214,6 +193,7 @@ add_content "$PKG/payload/usr/bin/$BINARY_NAME" "/usr/bin/$BINARY_NAME" 0755
add_content "$PKG/payload/usr/lib/systemd/system/${PACKAGE_NAME}.service" "/usr/lib/systemd/system/${PACKAGE_NAME}.service" 0644
[[ -f "$PKG/payload/etc/${PACKAGE_NAME}/environment" ]] && add_content "$PKG/payload/etc/${PACKAGE_NAME}/environment" "/etc/${PACKAGE_NAME}/environment" 0640 'config|noreplace'
add_content "$PKG/payload/etc/logrotate.d/${PACKAGE_NAME}" "/etc/logrotate.d/${PACKAGE_NAME}" 0644 'config|noreplace'
add_content "$PKG/payload/usr/share/doc/${PACKAGE_NAME}/FILESYSTEM_ACCESS.md" "/usr/share/doc/${PACKAGE_NAME}/FILESYSTEM_ACCESS.md" 0644
[[ -f "$PKG/payload/usr/lib/tmpfiles.d/${PACKAGE_NAME}.conf" ]] && add_content "$PKG/payload/usr/lib/tmpfiles.d/${PACKAGE_NAME}.conf" "/usr/lib/tmpfiles.d/${PACKAGE_NAME}.conf" 0644
[[ -f "$PKG/payload/usr/share/${PACKAGE_NAME}/grafana/rustproxy-overview.json" ]] && add_content "$PKG/payload/usr/share/${PACKAGE_NAME}/grafana/rustproxy-overview.json" "/usr/share/${PACKAGE_NAME}/grafana/rustproxy-overview.json" 0644
[[ -f "$PKG/payload/usr/share/doc/${PACKAGE_NAME}/grafana/README.md" ]] && add_content "$PKG/payload/usr/share/doc/${PACKAGE_NAME}/grafana/README.md" "/usr/share/doc/${PACKAGE_NAME}/grafana/README.md" 0644