NethServer / nethsecurity

NethSecurity image and build environment
https://www.nethsecurity.org/
Other
82 stars 6 forks source link

packages: add supervisor #542

Closed gsanchietti closed 2 weeks ago

gsanchietti commented 1 month ago

Add supervisor package to be used as supervisor for important services like nethsecurity-api and dpi-report.

To make it work correctly we need to change many things:

/etc/init.d/supervisord (the stop action does still not work):

#!/bin/sh /etc/rc.common
START=95
USE_PROCD=0
PROG=/usr/bin/supervisord
DAEMON=${PROG}
# Location of the pid file
PIDFILE=/var/run/supervisord.pid
# Config of supervisor
CONFIG=/etc/supervisord/supervisord.conf

start_service()
{
    exec /usr/bin/supervisord -c $CONFIG -j $PIDFILE
}

stop_service()
{
    kill $(cat $PIDFILE)
}

/usr/sbin/ns-api-server

#!/bin/sh
WORK_DIR=/var/run/ns-api-server
TOKENS_DIR=${WORK_DIR}/tokens
SECRETS_DIR=/etc/ns-api-server
UPLOAD_FILE_PATH=${WORK_DIR}/uploads
UPLOAD_FILE_MAX_SIZE=64 # 64MB
mkdir -m 0700 -p ${TOKENS_DIR}
mkdir -m 0700 -p ${SECRETS_DIR}
export GIN_MODE=release
export LISTEN_ADDRESS=127.0.0.1:8090
export SECRET_JWT="$(uuidgen | sha256sum | awk '{print $1}')"
export ISSUER_2FA="$(uci -q get system.@system[0].hostname)"
export SECRETS_DIR=${SECRETS_DIR}
export TOKENS_DIR=${TOKENS_DIR}
export STATIC_DIR=${STATIC_DIR}
export UPLOAD_FILE_PATH=${UPLOAD_FILE_PATH}
export UPLOAD_FILE_MAX_SIZE=${UPLOAD_FILE_MAX_SIZE}
exec /usr/bin/nethsecurity-api

Config file with includes /etc/supervisord/supervisord.conf:

[supervisord]
logfile=/var/log/supervisord.log
pidfile=/var/run/supervisord.pid
user=root

[include]
files=/etc/supervisord/conf.d/*.conf

dpi-report: /etc/supervisord/conf.d/dpi-report.conf

[program:dpi-report]
command=/usr/bin/dpireport
redirect_stderr=true

api-server: /etc/supervisord/conf.d/ns-api-server.conf (audit is not logged to messages)

[program:ns-api-server]
command=/usr/sbin/ns-api-server
stderr_syslog=true
stdout_syslog=true
gsanchietti commented 2 weeks ago

Sometime the api-server does not start but we can't find any evidence of a reproducible problem. I'm closing this for now but preserving the branch for future use.