Related to #738: make pulse proxy mount migration-safe
This commit is contained in:
rcourtman
parent
4c1da82e28
commit
19408fdb2b
4 changed files with 220 additions and 193 deletions
|
|
@ -147,7 +147,7 @@ The socket directory needs `0775` (not `0770`) to allow the container's unprivil
|
|||
| `lxc.idmap` | `u 0 100000 65536`<br>`g 0 100000 65536` | Unprivileged UID/GID mapping |
|
||||
| `lxc.apparmor.profile` | `generated` or custom | AppArmor confinement |
|
||||
| `lxc.cap.drop` | `sys_admin` (optional) | Drop dangerous capabilities |
|
||||
| `mpX` | `/run/pulse-sensor-proxy,mp=/mnt/pulse-proxy` | Socket access from container |
|
||||
| `lxc.mount.entry` | `/run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0` | Socket access from container (migration-safe) |
|
||||
|
||||
### Sample LXC Configuration
|
||||
|
||||
|
|
@ -164,27 +164,25 @@ lxc.apparmor.profile: generated
|
|||
lxc.cap.drop: sys_admin
|
||||
|
||||
# Bind mount proxy socket directory (REQUIRED)
|
||||
# Note: Use an mp entry so Proxmox manages the bind mount automatically
|
||||
mp0: /run/pulse-sensor-proxy,mp=/mnt/pulse-proxy
|
||||
# Use lxc.mount.entry to keep snapshots/migrations working with Proxmox bind mounts
|
||||
lxc.mount.entry: /run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0
|
||||
```
|
||||
|
||||
**Key points:**
|
||||
- **Directory-level mount**: Mount `/run/pulse-sensor-proxy` directory, not the socket file itself
|
||||
- **Why directory mount?** Systemd recreates the socket on restart; socket-level mounts break on recreation
|
||||
- **Directory-level mount**: Mount `/run/pulse-sensor-proxy` directory, not the socket file itself (socket is recreated by systemd)
|
||||
- **lxc.mount.entry instead of mp**: Proxmox refuses snapshots/migrations when `mpX` bind mounts target `/run/pulse-sensor-proxy`; `lxc.mount.entry` keeps the bind mount without blocking those workflows
|
||||
- **Mode 0775**: Socket directory needs group+other execute permissions for container UID traversal
|
||||
- **Socket 0777**: Actual socket is world-writable; security enforced via `SO_PEERCRED` authentication
|
||||
|
||||
### Upgrading Existing Installations
|
||||
|
||||
If you previously followed the legacy guide (manual `lxc.mount.entry` and `/run/pulse-sensor-proxy` inside the container), upgrade by **removing each node in Pulse and then re-adding it using the “Copy install script” flow in Settings → Nodes**. The script you copy from the UI now:
|
||||
If you previously used an `mpX` bind mount (e.g., `mp0: /run/pulse-sensor-proxy,mp=/mnt/pulse-proxy`), upgrade by **removing each node in Pulse and then re-adding it using the “Copy install script” flow in Settings → Nodes**. The installer now:
|
||||
|
||||
- Cleans up any old `lxc.mount.entry` rows and replaces them with the managed `mp` mount.
|
||||
- Ensures the socket is mounted at `/mnt/pulse-proxy/pulse-sensor-proxy.sock` inside the container.
|
||||
- Adds the systemd override so the container backend (or hot-dev) automatically uses the mounted socket.
|
||||
- Removes `mp*` entries referencing `/run/pulse-sensor-proxy`
|
||||
- Writes the migration-safe `lxc.mount.entry: /run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0`
|
||||
- Keeps the systemd override so the backend automatically uses `/mnt/pulse-proxy/pulse-sensor-proxy.sock`
|
||||
|
||||
This is the same workflow you used originally—no extra commands are required. Just remove the node from Pulse, click “Copy install script,” run it on the Proxmox host, and add the node again.
|
||||
|
||||
> **Advanced option**: If you’d rather refresh in place without removing the node, you can rerun the host-side installer directly (e.g. `sudo /opt/pulse/scripts/install-sensor-proxy.sh --ctid <id> --pulse-server http://<pulse-container-ip>:7655`). The script is idempotent, but re-adding through the UI guarantees the full host + Pulse configuration is rebuilt.
|
||||
This is the same workflow you used originally—no extra commands are required. Just remove the node from Pulse, click “Copy install script,” run it on the Proxmox host, and add the node again. If you prefer to refresh in place, rerun the host-side installer directly (e.g. `sudo /opt/pulse/scripts/install-sensor-proxy.sh --ctid <id> --pulse-server http://<pulse-container-ip>:7655`).
|
||||
|
||||
### Runtime Verification
|
||||
|
||||
|
|
|
|||
57
install.sh
57
install.sh
|
|
@ -441,6 +441,50 @@ cleanup_sensor_proxy() {
|
|||
manual_sensor_proxy_cleanup
|
||||
}
|
||||
|
||||
configure_proxy_socket_mount() {
|
||||
local ctid="$1"
|
||||
local host_source="/run/pulse-sensor-proxy"
|
||||
local target_rel="mnt/pulse-proxy"
|
||||
local desired_entry="lxc.mount.entry: ${host_source} ${target_rel} none bind,create=dir 0 0"
|
||||
local lxc_config="/etc/pve/lxc/${ctid}.conf"
|
||||
|
||||
mkdir -p "$host_source"
|
||||
|
||||
if [[ ! -f "$lxc_config" ]]; then
|
||||
print_error "Container config not found at $lxc_config; cannot configure pulse-sensor-proxy mount"
|
||||
return 1
|
||||
fi
|
||||
|
||||
local updated=false
|
||||
|
||||
if grep -Eq '^mp[0-9]+: .*pulse-sensor-proxy' "$lxc_config" 2>/dev/null; then
|
||||
print_info "Removing mp entries for pulse-sensor-proxy to keep snapshots and migrations working"
|
||||
sed -i '/^mp[0-9]\+: .*pulse-sensor-proxy/d' "$lxc_config"
|
||||
updated=true
|
||||
fi
|
||||
|
||||
if grep -q "^lxc.mount.entry: .*/pulse-sensor-proxy" "$lxc_config" 2>/dev/null; then
|
||||
if ! grep -qxF "$desired_entry" "$lxc_config"; then
|
||||
sed -i "s#^lxc.mount.entry: .*pulse-sensor-proxy.*#${desired_entry}#" "$lxc_config"
|
||||
updated=true
|
||||
fi
|
||||
else
|
||||
echo "$desired_entry" >> "$lxc_config"
|
||||
updated=true
|
||||
fi
|
||||
|
||||
if ! pct config "$ctid" | grep -qxF "$desired_entry"; then
|
||||
print_error "Failed to persist pulse-sensor-proxy mount entry in $lxc_config"
|
||||
return 1
|
||||
fi
|
||||
|
||||
if [[ "$updated" == true ]]; then
|
||||
print_info "Configured migration-safe socket mount via lxc.mount.entry"
|
||||
else
|
||||
print_info "pulse-sensor-proxy mount already configured for migrations"
|
||||
fi
|
||||
}
|
||||
|
||||
# Prompt user about proxy installation
|
||||
# Returns 0 if user wants proxy, 1 if not
|
||||
prompt_proxy_installation() {
|
||||
|
|
@ -1335,10 +1379,7 @@ create_lxc_container() {
|
|||
fi
|
||||
|
||||
if [[ "$PROXY_PREPARE_MOUNT" == "true" ]]; then
|
||||
local PROXY_HOST_PATH="/run/pulse-sensor-proxy"
|
||||
local PROXY_CONTAINER_PATH="/mnt/pulse-proxy"
|
||||
mkdir -p "$PROXY_HOST_PATH"
|
||||
CREATE_ARGS+=("--mp0" "${PROXY_HOST_PATH},mp=${PROXY_CONTAINER_PATH},replicate=0")
|
||||
mkdir -p /run/pulse-sensor-proxy
|
||||
fi
|
||||
|
||||
# Execute container creation (suppress verbose output)
|
||||
|
|
@ -1347,7 +1388,7 @@ create_lxc_container() {
|
|||
exit 1
|
||||
fi
|
||||
CONTAINER_CREATED_FOR_CLEANUP=true
|
||||
|
||||
|
||||
# From this point on, cleanup container if we fail
|
||||
cleanup_on_error() {
|
||||
print_error "Installation failed, cleaning up container $CTID..."
|
||||
|
|
@ -1358,6 +1399,12 @@ create_lxc_container() {
|
|||
pct destroy $CTID 2>/dev/null || true
|
||||
exit 1
|
||||
}
|
||||
|
||||
if [[ "$PROXY_PREPARE_MOUNT" == "true" ]]; then
|
||||
if ! configure_proxy_socket_mount "$CTID"; then
|
||||
cleanup_on_error
|
||||
fi
|
||||
fi
|
||||
|
||||
# Start container
|
||||
print_info "Starting container..."
|
||||
|
|
|
|||
|
|
@ -3466,10 +3466,14 @@ pveum user token add pulse-monitor@pam "$TOKEN_NAME" --privsep 0
|
|||
# 2) Install or update pulse-sensor-proxy on the host
|
||||
curl -sSL "$PULSE_URL/api/install/install-sensor-proxy.sh" | bash -s -- --ctid ${CTID_DISPLAY} --pulse-server "$PULSE_URL"
|
||||
|
||||
# 3) Ensure the proxy socket is mounted into this container
|
||||
NEXT_MP=\$(pct config ${CTID_DISPLAY} | awk '\$1 ~ /^mp[0-9]+:/ && index(\$0, "mp=/mnt/pulse-proxy") {gsub(":", "", \$1); print \$1; exit}')
|
||||
if [ -z "\$NEXT_MP" ]; then NEXT_MP="mp0"; fi
|
||||
pct set ${CTID_DISPLAY} -\${NEXT_MP} /run/pulse-sensor-proxy,mp=/mnt/pulse-proxy,replicate=0
|
||||
# 3) Ensure the proxy socket is mounted into this container (migration-safe)
|
||||
LXC_CONF="/etc/pve/lxc/${CTID_DISPLAY}.conf"
|
||||
mkdir -p /run/pulse-sensor-proxy
|
||||
sed -i '/^mp[0-9]\+: .*pulse-sensor-proxy/d' "$LXC_CONF"
|
||||
if ! grep -q "^lxc.mount.entry: /run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0\$" "$LXC_CONF"; then
|
||||
echo 'lxc.mount.entry: /run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0' >> "$LXC_CONF"
|
||||
fi
|
||||
pct stop ${CTID_DISPLAY} && sleep 2 && pct start ${CTID_DISPLAY}
|
||||
pct exec ${CTID_DISPLAY} -- test -S /mnt/pulse-proxy/pulse-sensor-proxy.sock && echo "Socket OK"
|
||||
|
||||
EOF
|
||||
|
|
|
|||
|
|
@ -3134,203 +3134,181 @@ if [[ "$STANDALONE" == false ]]; then
|
|||
echo " • Proxy on host manages all temperature collection"
|
||||
echo ""
|
||||
|
||||
# Ensure container mount via mp configuration
|
||||
print_info "Configuring socket bind mount..."
|
||||
MOUNT_TARGET="/mnt/pulse-proxy"
|
||||
HOST_SOCKET_SOURCE="/run/pulse-sensor-proxy"
|
||||
LXC_CONFIG="/etc/pve/lxc/${CTID}.conf"
|
||||
LOCAL_MOUNT_ENTRY="lxc.mount.entry: ${HOST_SOCKET_SOURCE} mnt/pulse-proxy none bind,create=dir 0 0"
|
||||
|
||||
# Back up container config before modifying
|
||||
LXC_CONFIG_BACKUP=$(mktemp)
|
||||
cp "$LXC_CONFIG" "$LXC_CONFIG_BACKUP" 2>/dev/null || {
|
||||
print_warn "Could not back up container config (may not exist yet)"
|
||||
LXC_CONFIG_BACKUP=""
|
||||
}
|
||||
mkdir -p "$HOST_SOCKET_SOURCE"
|
||||
|
||||
CONFIG_CONTENT=$(pct config "$CTID")
|
||||
CURRENT_MP=$(pct config "$CTID" | awk -v target="$MOUNT_TARGET" '$1 ~ /^mp[0-9]+:$/ && index($0, "mp=" target) {split($1, arr, ":"); print arr[1]; exit}')
|
||||
MOUNT_UPDATED=false
|
||||
HOTPLUG_FAILED=false
|
||||
CT_RUNNING=false
|
||||
if pct status "$CTID" 2>/dev/null | grep -q "running"; then
|
||||
CT_RUNNING=true
|
||||
fi
|
||||
# Back up container config before modifying
|
||||
LXC_CONFIG_BACKUP=$(mktemp)
|
||||
cp "$LXC_CONFIG" "$LXC_CONFIG_BACKUP" 2>/dev/null || {
|
||||
print_warn "Could not back up container config (may not exist yet)"
|
||||
LXC_CONFIG_BACKUP=""
|
||||
}
|
||||
|
||||
if [[ -z "$CURRENT_MP" ]]; then
|
||||
for idx in $(seq 0 9); do
|
||||
if ! printf "%s\n" "$CONFIG_CONTENT" | grep -q "^mp${idx}:"; then
|
||||
CURRENT_MP="mp${idx}"
|
||||
break
|
||||
fi
|
||||
done
|
||||
if [[ -z "$CURRENT_MP" ]]; then
|
||||
print_error "Unable to find available mp slot for container mount"
|
||||
exit 1
|
||||
MOUNT_UPDATED=false
|
||||
CT_RUNNING=false
|
||||
SKIP_CONTAINER_POST_STEPS=false
|
||||
if pct status "$CTID" 2>/dev/null | grep -q "running"; then
|
||||
CT_RUNNING=true
|
||||
fi
|
||||
print_info "Configuring container mount using $CURRENT_MP..."
|
||||
SET_ERROR=$(pct set "$CTID" -${CURRENT_MP} "${HOST_SOCKET_SOURCE},mp=${MOUNT_TARGET},replicate=0" 2>&1)
|
||||
if [ $? -eq 0 ]; then
|
||||
|
||||
if grep -Eq '^mp[0-9]+: .*pulse-sensor-proxy' "$LXC_CONFIG" 2>/dev/null; then
|
||||
print_info "Removing mp mounts for pulse-sensor-proxy to keep snapshots and migrations working"
|
||||
sed -i '/^mp[0-9]\+: .*pulse-sensor-proxy/d' "$LXC_CONFIG"
|
||||
MOUNT_UPDATED=true
|
||||
else
|
||||
HOTPLUG_FAILED=true
|
||||
if [ -n "$SET_ERROR" ]; then
|
||||
print_warn "pct set failed: $SET_ERROR"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
desired_pattern="^${CURRENT_MP}: ${HOST_SOCKET_SOURCE},mp=${MOUNT_TARGET}"
|
||||
if pct config "$CTID" | grep -q "$desired_pattern"; then
|
||||
print_info "Container already has socket mount configured ($CURRENT_MP)"
|
||||
else
|
||||
print_info "Updating container mount configuration ($CURRENT_MP)..."
|
||||
SET_ERROR=$(pct set "$CTID" -${CURRENT_MP} "${HOST_SOCKET_SOURCE},mp=${MOUNT_TARGET},replicate=0" 2>&1)
|
||||
if [ $? -eq 0 ]; then
|
||||
|
||||
if grep -q "^lxc.mount.entry: .*/pulse-sensor-proxy" "$LXC_CONFIG" 2>/dev/null; then
|
||||
if ! grep -qxF "$LOCAL_MOUNT_ENTRY" "$LXC_CONFIG"; then
|
||||
print_info "Updating existing lxc.mount.entry for pulse-sensor-proxy"
|
||||
sed -i "s#^lxc.mount.entry: .*pulse-sensor-proxy.*#${LOCAL_MOUNT_ENTRY}#" "$LXC_CONFIG"
|
||||
MOUNT_UPDATED=true
|
||||
else
|
||||
HOTPLUG_FAILED=true
|
||||
if [ -n "$SET_ERROR" ]; then
|
||||
print_warn "pct set failed: $SET_ERROR"
|
||||
print_info "Container already has migration-safe lxc.mount.entry for proxy"
|
||||
fi
|
||||
else
|
||||
print_info "Adding lxc.mount.entry for pulse-sensor-proxy"
|
||||
echo "$LOCAL_MOUNT_ENTRY" >> "$LXC_CONFIG"
|
||||
MOUNT_UPDATED=true
|
||||
fi
|
||||
|
||||
if ! pct config "$CTID" | grep -qxF "$LOCAL_MOUNT_ENTRY"; then
|
||||
print_error "Failed to persist migration-safe socket mount in container config"
|
||||
if [ -n "$LXC_CONFIG_BACKUP" ] && [ -f "$LXC_CONFIG_BACKUP" ]; then
|
||||
print_warn "Rolling back container configuration changes..."
|
||||
cp "$LXC_CONFIG_BACKUP" "$LXC_CONFIG"
|
||||
rm -f "$LXC_CONFIG_BACKUP"
|
||||
fi
|
||||
exit 1
|
||||
fi
|
||||
print_info "✓ Mount configuration recorded in container config"
|
||||
|
||||
if [[ "$MOUNT_UPDATED" = true ]]; then
|
||||
if [[ "$SKIP_RESTART" = true ]]; then
|
||||
if [[ "$CT_RUNNING" = true ]]; then
|
||||
print_info "Skipping container restart (--skip-restart provided). Changes apply on next restart."
|
||||
else
|
||||
print_info "Skipping automatic container start (--skip-restart provided)."
|
||||
fi
|
||||
else
|
||||
print_info "Restarting container to activate secure communication..."
|
||||
if [[ "$CT_RUNNING" = true ]]; then
|
||||
pct stop "$CTID" && sleep 2 && pct start "$CTID"
|
||||
else
|
||||
pct start "$CTID"
|
||||
fi
|
||||
sleep 5
|
||||
CT_RUNNING=true
|
||||
fi
|
||||
fi
|
||||
|
||||
# Verify socket directory and file inside container
|
||||
if [[ "$SKIP_RESTART" = true && "$CT_RUNNING" = true && "$MOUNT_UPDATED" = true ]]; then
|
||||
print_warn "Skipping socket verification until container $CTID is restarted."
|
||||
print_warn "Please restart container and verify socket manually:"
|
||||
print_warn " pct stop $CTID && sleep 2 && pct start $CTID"
|
||||
print_warn " pct exec $CTID -- test -S ${MOUNT_TARGET}/pulse-sensor-proxy.sock && echo 'Socket OK'"
|
||||
elif [[ "$SKIP_RESTART" = true && "$CT_RUNNING" = false ]]; then
|
||||
print_warn "Socket verification deferred. Start container $CTID and run:"
|
||||
print_warn " pct exec $CTID -- test -S ${MOUNT_TARGET}/pulse-sensor-proxy.sock && echo 'Socket OK'"
|
||||
SKIP_CONTAINER_POST_STEPS=true
|
||||
elif [[ "$CT_RUNNING" = false ]]; then
|
||||
print_warn "Container $CTID is stopped. Start it to verify the pulse-sensor-proxy socket:"
|
||||
print_warn " pct start $CTID && pct exec $CTID -- test -S ${MOUNT_TARGET}/pulse-sensor-proxy.sock && echo 'Socket OK'"
|
||||
SKIP_CONTAINER_POST_STEPS=true
|
||||
else
|
||||
if [[ ! -S "$SOCKET_PATH" ]]; then
|
||||
print_warn "Host proxy socket not available yet; deferring container verification until service starts."
|
||||
DEFER_SOCKET_VERIFICATION=true
|
||||
else
|
||||
print_info "Verifying secure communication channel..."
|
||||
if pct exec "$CTID" -- test -S "${MOUNT_TARGET}/pulse-sensor-proxy.sock"; then
|
||||
print_info "✓ Secure socket communication ready"
|
||||
# Clean up backup since verification succeeded
|
||||
[ -n "$LXC_CONFIG_BACKUP" ] && rm -f "$LXC_CONFIG_BACKUP"
|
||||
else
|
||||
print_error "Socket not visible at ${MOUNT_TARGET}/pulse-sensor-proxy.sock"
|
||||
print_error "Mount configuration verified but socket not accessible in container"
|
||||
print_error "This indicates a mount or restart issue"
|
||||
|
||||
# Rollback container config changes
|
||||
if [ -n "$LXC_CONFIG_BACKUP" ] && [ -f "$LXC_CONFIG_BACKUP" ]; then
|
||||
print_warn "Rolling back container configuration changes..."
|
||||
cp "$LXC_CONFIG_BACKUP" "$LXC_CONFIG"
|
||||
rm -f "$LXC_CONFIG_BACKUP"
|
||||
print_info "Container configuration restored to previous state"
|
||||
fi
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$HOTPLUG_FAILED" = true ]]; then
|
||||
print_warn "Hot-plugging socket mount failed (container may be running). Updating config directly."
|
||||
CURRENT_MP_LINE="${CURRENT_MP}: ${HOST_SOCKET_SOURCE},mp=${MOUNT_TARGET},replicate=0"
|
||||
if ! grep -q "^${CURRENT_MP}:" "$LXC_CONFIG" 2>/dev/null; then
|
||||
echo "$CURRENT_MP_LINE" >> "$LXC_CONFIG"
|
||||
else
|
||||
sed -i "s#^${CURRENT_MP}:.*#${CURRENT_MP_LINE}#" "$LXC_CONFIG"
|
||||
fi
|
||||
MOUNT_UPDATED=true
|
||||
fi
|
||||
if [[ "$SKIP_CONTAINER_POST_STEPS" != true ]]; then
|
||||
# Configure Pulse backend environment override inside container
|
||||
print_info "Configuring Pulse to use proxy..."
|
||||
|
||||
# Verify mount configuration actually persisted
|
||||
if ! pct config "$CTID" | grep -q "^${CURRENT_MP}:"; then
|
||||
print_error "Failed to persist mount configuration for $CURRENT_MP"
|
||||
print_error "Expected mount not found in container config"
|
||||
exit 1
|
||||
fi
|
||||
print_info "✓ Mount configuration verified in container config"
|
||||
# Always make sure the Pulse .env file contains the proxy socket override.
|
||||
configure_container_proxy_env
|
||||
|
||||
# Remove legacy lxc.mount.entry directives if present
|
||||
if grep -q "lxc.mount.entry: ${HOST_SOCKET_SOURCE}" "$LXC_CONFIG"; then
|
||||
print_info "Removing legacy lxc.mount.entry directives for pulse-sensor-proxy"
|
||||
sed -i '/lxc\.mount\.entry: \/run\/pulse-sensor-proxy/d' "$LXC_CONFIG"
|
||||
MOUNT_UPDATED=true
|
||||
fi
|
||||
|
||||
# Restart container to apply mount if configuration changed or mount missing
|
||||
if [[ "$MOUNT_UPDATED" = true ]]; then
|
||||
if [[ "$SKIP_RESTART" = true ]]; then
|
||||
if [[ "$CT_RUNNING" = true ]]; then
|
||||
print_info "Skipping container restart (--skip-restart provided)."
|
||||
if ! pct exec "$CTID" -- systemctl status pulse >/dev/null 2>&1; then
|
||||
print_warn "Pulse service not found in container $CTID; proxy socket configured but service restart deferred."
|
||||
print_info "Install or restart Pulse inside the container to enable temperature monitoring."
|
||||
else
|
||||
print_info "Skipping automatic container start (--skip-restart provided)."
|
||||
fi
|
||||
else
|
||||
print_info "Restarting container to activate secure communication..."
|
||||
if [[ "$CT_RUNNING" = true ]]; then
|
||||
pct stop "$CTID" && sleep 2 && pct start "$CTID"
|
||||
else
|
||||
pct start "$CTID"
|
||||
fi
|
||||
sleep 5
|
||||
fi
|
||||
fi
|
||||
|
||||
# Verify socket directory and file inside container
|
||||
if [[ "$HOTPLUG_FAILED" = true && "$CT_RUNNING" = true ]]; then
|
||||
print_warn "Skipping socket verification until container $CTID is restarted."
|
||||
print_warn "Please restart container and verify socket manually:"
|
||||
print_warn " pct stop $CTID && sleep 2 && pct start $CTID"
|
||||
print_warn " pct exec $CTID -- test -S ${MOUNT_TARGET}/pulse-sensor-proxy.sock && echo 'Socket OK'"
|
||||
elif [[ "$SKIP_RESTART" = true && "$CT_RUNNING" = false ]]; then
|
||||
print_warn "Socket verification deferred. Start container $CTID and run:"
|
||||
print_warn " pct exec $CTID -- test -S ${MOUNT_TARGET}/pulse-sensor-proxy.sock && echo 'Socket OK'"
|
||||
else
|
||||
if [[ ! -S "$SOCKET_PATH" ]]; then
|
||||
print_warn "Host proxy socket not available yet; deferring container verification until service starts."
|
||||
DEFER_SOCKET_VERIFICATION=true
|
||||
else
|
||||
print_info "Verifying secure communication channel..."
|
||||
if pct exec "$CTID" -- test -S "${MOUNT_TARGET}/pulse-sensor-proxy.sock"; then
|
||||
print_info "✓ Secure socket communication ready"
|
||||
# Clean up backup since verification succeeded
|
||||
[ -n "$LXC_CONFIG_BACKUP" ] && rm -f "$LXC_CONFIG_BACKUP"
|
||||
else
|
||||
print_error "Socket not visible at ${MOUNT_TARGET}/pulse-sensor-proxy.sock"
|
||||
print_error "Mount configuration verified but socket not accessible in container"
|
||||
print_error "This indicates a mount or restart issue"
|
||||
|
||||
# Rollback container config changes
|
||||
if [ -n "$LXC_CONFIG_BACKUP" ] && [ -f "$LXC_CONFIG_BACKUP" ]; then
|
||||
print_warn "Rolling back container configuration changes..."
|
||||
cp "$LXC_CONFIG_BACKUP" "$LXC_CONFIG"
|
||||
rm -f "$LXC_CONFIG_BACKUP"
|
||||
print_info "Container configuration restored to previous state"
|
||||
fi
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# Configure Pulse backend environment override inside container
|
||||
print_info "Configuring Pulse to use proxy..."
|
||||
|
||||
# Always make sure the Pulse .env file contains the proxy socket override.
|
||||
configure_container_proxy_env
|
||||
|
||||
if ! pct exec "$CTID" -- systemctl status pulse >/dev/null 2>&1; then
|
||||
print_warn "Pulse service not found in container $CTID; proxy socket configured but service restart deferred."
|
||||
print_info "Install or restart Pulse inside the container to enable temperature monitoring."
|
||||
else
|
||||
pct exec "$CTID" -- bash -lc "mkdir -p /etc/systemd/system/pulse.service.d"
|
||||
pct exec "$CTID" -- bash -lc "cat <<'EOF' >/etc/systemd/system/pulse.service.d/10-pulse-proxy.conf
|
||||
pct exec "$CTID" -- bash -lc "mkdir -p /etc/systemd/system/pulse.service.d"
|
||||
pct exec "$CTID" -- bash -lc "cat <<'EOF' >/etc/systemd/system/pulse.service.d/10-pulse-proxy.conf
|
||||
[Service]
|
||||
Environment=PULSE_SENSOR_PROXY_SOCKET=${MOUNT_TARGET}/pulse-sensor-proxy.sock
|
||||
EOF"
|
||||
pct exec "$CTID" -- systemctl daemon-reload || true
|
||||
pct exec "$CTID" -- systemctl daemon-reload || true
|
||||
|
||||
# Restart Pulse service to apply the new environment variable
|
||||
if pct exec "$CTID" -- systemctl is-active --quiet pulse 2>/dev/null; then
|
||||
print_info "Restarting Pulse service to apply configuration..."
|
||||
pct exec "$CTID" -- systemctl restart pulse
|
||||
sleep 2
|
||||
print_success "Pulse service restarted with proxy configuration"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Test proxy status
|
||||
print_info "Testing proxy status..."
|
||||
if systemctl is-active --quiet pulse-sensor-proxy; then
|
||||
print_info "${GREEN}✓${NC} pulse-sensor-proxy is running"
|
||||
else
|
||||
print_error "pulse-sensor-proxy is not running"
|
||||
print_info "Check logs: journalctl -u pulse-sensor-proxy -n 50"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check for and remove legacy SSH keys from container
|
||||
print_info "Checking for legacy SSH keys in container..."
|
||||
LEGACY_KEYS_FOUND=false
|
||||
for key_type in id_rsa id_dsa id_ecdsa id_ed25519; do
|
||||
if pct exec "$CTID" -- test -f "/root/.ssh/$key_type" 2>/dev/null; then
|
||||
LEGACY_KEYS_FOUND=true
|
||||
if [ "$QUIET" != true ]; then
|
||||
print_warn "Found legacy SSH key: /root/.ssh/$key_type"
|
||||
# Restart Pulse service to apply the new environment variable
|
||||
if pct exec "$CTID" -- systemctl is-active --quiet pulse 2>/dev/null; then
|
||||
print_info "Restarting Pulse service to apply configuration..."
|
||||
pct exec "$CTID" -- systemctl restart pulse
|
||||
sleep 2
|
||||
print_success "Pulse service restarted with proxy configuration"
|
||||
fi
|
||||
fi
|
||||
pct exec "$CTID" -- rm -f "/root/.ssh/$key_type" "/root/.ssh/${key_type}.pub"
|
||||
print_info " Removed /root/.ssh/$key_type"
|
||||
fi
|
||||
done
|
||||
|
||||
if [ "$LEGACY_KEYS_FOUND" = true ] && [ "$QUIET" != true ]; then
|
||||
print_info ""
|
||||
print_info "Legacy SSH keys removed from container for security"
|
||||
print_info ""
|
||||
fi
|
||||
# Check for and remove legacy SSH keys from container
|
||||
print_info "Checking for legacy SSH keys in container..."
|
||||
LEGACY_KEYS_FOUND=false
|
||||
for key_type in id_rsa id_dsa id_ecdsa id_ed25519; do
|
||||
if pct exec "$CTID" -- test -f "/root/.ssh/$key_type" 2>/dev/null; then
|
||||
LEGACY_KEYS_FOUND=true
|
||||
if [ "$QUIET" != true ]; then
|
||||
print_warn "Found legacy SSH key: /root/.ssh/$key_type"
|
||||
fi
|
||||
pct exec "$CTID" -- rm -f "/root/.ssh/$key_type" "/root/.ssh/${key_type}.pub"
|
||||
print_info " Removed /root/.ssh/$key_type"
|
||||
fi
|
||||
done
|
||||
|
||||
if [ "$LEGACY_KEYS_FOUND" = true ] && [ "$QUIET" != true ]; then
|
||||
print_info ""
|
||||
print_info "Legacy SSH keys removed from container for security"
|
||||
print_info ""
|
||||
fi
|
||||
else
|
||||
if [ -n "$LXC_CONFIG_BACKUP" ] && [ -f "$LXC_CONFIG_BACKUP" ]; then
|
||||
rm -f "$LXC_CONFIG_BACKUP"
|
||||
fi
|
||||
print_warn "Skipping container-side configuration until container $CTID is running."
|
||||
fi
|
||||
|
||||
# Test proxy status
|
||||
print_info "Testing proxy status..."
|
||||
if systemctl is-active --quiet pulse-sensor-proxy; then
|
||||
print_info "${GREEN}✓${NC} pulse-sensor-proxy is running"
|
||||
else
|
||||
print_error "pulse-sensor-proxy is not running"
|
||||
print_info "Check logs: journalctl -u pulse-sensor-proxy -n 50"
|
||||
exit 1
|
||||
fi
|
||||
fi # End of container-specific configuration
|
||||
|
||||
if [[ "$SKIP_SELF_HEAL_SETUP" == "true" ]]; then
|
||||
|
|
|
|||
Loading…
Reference in a new issue