matrix-org / pantalaimon

E2EE aware proxy daemon for matrix clients.
Apache License 2.0
279 stars 41 forks source link

systemd/inetd socket activation #126

Open jkhsjdhjs opened 2 years ago

jkhsjdhjs commented 2 years ago

It would be cool if pantalaimon supported systemd or inetd socket activation, so that it can be started on demand, when a matrix client is trying to connect. For this, pantalaimon would need to be able to accept sockets passed from systemd/inetd, either via systemd's native socket passing interface or via standard input/output (inetd). See the second to last paragraph of this section: https://www.freedesktop.org/software/systemd/man/systemd.socket.html#Description

Stebalien commented 1 year ago

FYI, systemd-socket-proxyd works pretty well for this kind of thing.

jkhsjdhjs commented 1 year ago

Thanks for letting me know, systemd really has a solution for everything!

jkhsjdhjs commented 11 months ago

I finally got to try the solution via systemd-socket-proxyd and defined the units as follows:

pantalaimon-proxy.socket

[Socket]
ListenStream=127.0.0.1:8009

[Install]
WantedBy=sockets.target

pantalaimon-proxy.service

[Unit]
Requires=pantalaimon.service pantalaimon-proxy.socket
After=pantalaimon.service pantalaimon-proxy.socket

[Service]
# wait 5 seconds to ensure pantalaimon.service is up and can accept connections
ExecStartPre=/usr/bin/sleep 5
ExecStart=/usr/lib/systemd/systemd-socket-proxyd --exit-idle-time=5m 127.0.0.1:8010

This allows pantalaimon to be started on demand. Furthermore, when extending pantalaimon by StopWhenUnneeded=yes, it is stopped 5 minutes after pantalaimon-proxy.service isn't proxying any connections anymore, as defined by --exit-idle-time=5m. pantalaimon has been configured to listen on localhost on port 8010. I added ExecStartPre as sleep 5 seconds to the pantalaimon-proxy.service, because pantalaimon doesn't immediately accept connections after it is started. It usually takes 2 seconds on my machine. A better solution would be Type=notify support for pantalaimon, but at least it works for now.