48 lines
2.3 KiB
Bash
48 lines
2.3 KiB
Bash
#!/bin/sh
|
|
|
|
# Keep the historical service account so package downgrades remain possible,
|
|
# but current OPNsense runtime executes RustProxy as root (see rc.d script).
|
|
if ! /usr/sbin/pw groupshow rustproxy >/dev/null 2>&1; then
|
|
/usr/sbin/pw groupadd rustproxy
|
|
fi
|
|
|
|
if ! /usr/sbin/pw usershow rustproxy >/dev/null 2>&1; then
|
|
/usr/sbin/pw useradd rustproxy -g rustproxy -c "RustProxy daemon" -d /var/db/rustproxy -s /usr/sbin/nologin
|
|
fi
|
|
|
|
/usr/bin/install -d -o root -g wheel -m 0700 /var/db/rustproxy
|
|
/usr/sbin/chown -R root:wheel /var/db/rustproxy
|
|
/bin/chmod 0700 /var/db/rustproxy
|
|
/usr/bin/install -d -o root -g wheel -m 0750 /var/log/rustproxy
|
|
/usr/bin/install -d -o root -g wheel -m 0750 /var/run/rustproxy
|
|
/usr/bin/install -d -o root -g wheel -m 0755 /usr/local/etc/rustproxy
|
|
|
|
# configd discovers actions only on startup/reload. A direct `pkg add` must
|
|
# therefore refresh configd before the MVC service controller can call them.
|
|
/usr/sbin/service configd restart >/dev/null 2>&1 || true
|
|
/usr/local/sbin/pluginctl -cq cache_flush >/dev/null 2>&1 || true
|
|
|
|
# Apply model migrations before rendering the service template. In particular
|
|
# 1.4.0 copies the old combined listener values into the split address/port
|
|
# fields so upgrades keep their existing ports instead of falling back.
|
|
if [ -x /usr/local/opnsense/mvc/script/run_migrations.php ]; then
|
|
/usr/local/opnsense/mvc/script/run_migrations.php >/dev/null 2>&1 || true
|
|
fi
|
|
/usr/local/sbin/configctl template reload OPNsense/RustProxy >/dev/null 2>&1 || true
|
|
|
|
# A package upgrade invokes the previous package pre-deinstall hook, which stops
|
|
# RustProxy before replacing the binary. Start it again after migrations and
|
|
# template rendering. Use the installed service helper directly so this does
|
|
# not depend on configd having finished reloading its action registry. The
|
|
# helper itself checks enabled=1; on a fresh/default-disabled install this is a
|
|
# no-op. restart is deliberate: if an old process survived a forced pkg add,
|
|
# it is stopped before the new binary starts.
|
|
if [ -x /usr/local/opnsense/scripts/rustproxy/service.sh ]; then
|
|
if ! /usr/local/opnsense/scripts/rustproxy/service.sh restart; then
|
|
echo "WARNING: RustProxy package installed but the service could not be started." >&2
|
|
echo "Check /var/log/rustproxy/rustproxy.log and run: configctl rustproxy start" >&2
|
|
fi
|
|
fi
|
|
|
|
exit 0
|