search

PowerDNS / weakforced

Anti-Abuse for servers at authentication time
GNU General Public License v3.0
123 stars 33 forks source link

[FEATURE] Official RPM for RHEL8 family built against Lua5.1, but should be built against Lua 5.3 #401

Closed sshipway closed 1 week ago

sshipway commented 10 months ago

Is your feature request related to a problem? Please describe. Under RHEL8 family, the default version of Lua is 5.3, with 5.1 only as legacy. This means that many lua modules are not available as RPMs for 5.1. We require the modules ssl, socket, and json (so that wforce actions can result in calling user suspension APIs on our central system) but these modules are only available as RPMs for Lua 5.3.

Describe the solution you'd like Please build the official RHEL8 wforce RPMs against Lua 5.3 rather than 5.1, so that it is easier to add modules for more complex actions.

Describe alternatives you've considered I could rewrap the 5.1 lua RPMs from RHEL7 as custom RPMs and install these under RHEL8. It works, but there are 3 modules to manage and it would mean no updates in the future so it is not easily maintainable. I could build my own wforce RPM from source, but this is not easy to maintain and support

Additional context The wforce package for RHEL8 works, but is harder to extend due to the older Lua version. We are using Alma 8 for testing.

neilcook commented 10 months ago

The main issue with this is that we use LuaJIT for speed. LuaJIT uses Lua 5.1, and doesn't support Lua higher than that. Not using LuaJIT would be a major performance penalty, which is really not worth it for the ability to use RPMs.

FYI 2.10 will provide (in the closed-source version which you already are using of course) support for running in Kubernetes. As part of that you could use wforce in a containerised fashion (the OCI image already exists on docker hub BTW and already contains all the Lua modules you mention above as part of the image).

Alternatively you could install the Lua modules from source using luarocks, and maybe even build RPMs from them.

sshipway commented 7 months ago

I can see how you'd not want to lose LuaJIT; until that comes out for 5.3 you're stuck with 5.1.
In the end, I built the RPMs for the required Lua modules so that RPM install still works; longer term, we're moving to running in containers under Kubes which will solve the issue

neilcook commented 7 months ago

If you're moving to kubernetes, then you should checkout the commercial release of OX Abuse Shield 2.10, because that supports Kubernetes via Helm Charts (should be released next week). See https://documentation.open-xchange.com/components/wforce-documentation/2.10/