danvics/Pulse
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Related to #738: make pulse proxy mount migration-safe

Browse source
This commit is contained in:
rcourtman 2025-11-21 21:29:14 +00:00
parent 4c1da82e28
commit 19408fdb2b
4 changed files with 220 additions and 193 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
docs/PULSE_SENSOR_PROXY_HARDENING.md
View file

@ -147,7 +147,7 @@ The socket directory needs `0775` (not `0770`) to allow the container's unprivil
| `lxc.idmap` | `u 0 100000 65536`<br>`g 0 100000 65536` | Unprivileged UID/GID mapping | | `lxc.idmap` | `u 0 100000 65536`<br>`g 0 100000 65536` | Unprivileged UID/GID mapping |
| `lxc.apparmor.profile` | `generated` or custom | AppArmor confinement | | `lxc.apparmor.profile` | `generated` or custom | AppArmor confinement |
| `lxc.cap.drop` | `sys_admin` (optional) | Drop dangerous capabilities | | `lxc.cap.drop` | `sys_admin` (optional) | Drop dangerous capabilities |
| `mpX` | `/run/pulse-sensor-proxy,mp=/mnt/pulse-proxy` | Socket access from container | | `lxc.mount.entry` | `/run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0` | Socket access from container (migration-safe) |
### Sample LXC Configuration ### Sample LXC Configuration
@ -164,27 +164,25 @@ lxc.apparmor.profile: generated
lxc.cap.drop: sys_admin lxc.cap.drop: sys_admin
# Bind mount proxy socket directory (REQUIRED) # Bind mount proxy socket directory (REQUIRED)
# Note: Use an mp entry so Proxmox manages the bind mount automatically # Use lxc.mount.entry to keep snapshots/migrations working with Proxmox bind mounts
mp0: /run/pulse-sensor-proxy,mp=/mnt/pulse-proxy lxc.mount.entry: /run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0
``` ```
**Key points:** **Key points:**
- **Directory-level mount**: Mount `/run/pulse-sensor-proxy` directory, not the socket file itself - **Directory-level mount**: Mount `/run/pulse-sensor-proxy` directory, not the socket file itself (socket is recreated by systemd)
- **Why directory mount?** Systemd recreates the socket on restart; socket-level mounts break on recreation - **lxc.mount.entry instead of mp**: Proxmox refuses snapshots/migrations when `mpX` bind mounts target `/run/pulse-sensor-proxy`; `lxc.mount.entry` keeps the bind mount without blocking those workflows
- **Mode 0775**: Socket directory needs group+other execute permissions for container UID traversal - **Mode 0775**: Socket directory needs group+other execute permissions for container UID traversal
- **Socket 0777**: Actual socket is world-writable; security enforced via `SO_PEERCRED` authentication - **Socket 0777**: Actual socket is world-writable; security enforced via `SO_PEERCRED` authentication
### Upgrading Existing Installations ### Upgrading Existing Installations
If you previously followed the legacy guide (manual `lxc.mount.entry` and `/run/pulse-sensor-proxy` inside the container), upgrade by **removing each node in Pulse and then re-adding it using the “Copy install script” flow in Settings → Nodes**. The script you copy from the UI now: If you previously used an `mpX` bind mount (e.g., `mp0: /run/pulse-sensor-proxy,mp=/mnt/pulse-proxy`), upgrade by **removing each node in Pulse and then re-adding it using the “Copy install script” flow in Settings → Nodes**. The installer now:
- Cleans up any old `lxc.mount.entry` rows and replaces them with the managed `mp` mount. - Removes `mp*` entries referencing `/run/pulse-sensor-proxy`
- Ensures the socket is mounted at `/mnt/pulse-proxy/pulse-sensor-proxy.sock` inside the container. - Writes the migration-safe `lxc.mount.entry: /run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0`
- Adds the systemd override so the container backend (or hot-dev) automatically uses the mounted socket. - Keeps the systemd override so the backend automatically uses `/mnt/pulse-proxy/pulse-sensor-proxy.sock`
This is the same workflow you used originally—no extra commands are required. Just remove the node from Pulse, click “Copy install script,” run it on the Proxmox host, and add the node again. This is the same workflow you used originally—no extra commands are required. Just remove the node from Pulse, click “Copy install script,” run it on the Proxmox host, and add the node again. If you prefer to refresh in place, rerun the host-side installer directly (e.g. `sudo /opt/pulse/scripts/install-sensor-proxy.sh --ctid <id> --pulse-server http://<pulse-container-ip>:7655`).
> **Advanced option**: If you’d rather refresh in place without removing the node, you can rerun the host-side installer directly (e.g. `sudo /opt/pulse/scripts/install-sensor-proxy.sh --ctid <id> --pulse-server http://<pulse-container-ip>:7655`). The script is idempotent, but re-adding through the UI guarantees the full host + Pulse configuration is rebuilt.
### Runtime Verification ### Runtime Verification

55
install.sh
View file

@ -441,6 +441,50 @@ cleanup_sensor_proxy() {
manual_sensor_proxy_cleanup manual_sensor_proxy_cleanup
} }
configure_proxy_socket_mount() {
local ctid="$1"
local host_source="/run/pulse-sensor-proxy"
local target_rel="mnt/pulse-proxy"
local desired_entry="lxc.mount.entry: ${host_source} ${target_rel} none bind,create=dir 0 0"
local lxc_config="/etc/pve/lxc/${ctid}.conf"
mkdir -p "$host_source"
if [[ ! -f "$lxc_config" ]]; then
print_error "Container config not found at $lxc_config; cannot configure pulse-sensor-proxy mount"
return 1
fi
local updated=false
if grep -Eq '^mp[0-9]+: .*pulse-sensor-proxy' "$lxc_config" 2>/dev/null; then
print_info "Removing mp entries for pulse-sensor-proxy to keep snapshots and migrations working"
sed -i '/^mp[0-9]\+: .*pulse-sensor-proxy/d' "$lxc_config"
updated=true
fi
if grep -q "^lxc.mount.entry: .*/pulse-sensor-proxy" "$lxc_config" 2>/dev/null; then
if ! grep -qxF "$desired_entry" "$lxc_config"; then
sed -i "s#^lxc.mount.entry: .*pulse-sensor-proxy.*#${desired_entry}#" "$lxc_config"
updated=true
fi
else
echo "$desired_entry" >> "$lxc_config"
updated=true
fi
if ! pct config "$ctid" | grep -qxF "$desired_entry"; then
print_error "Failed to persist pulse-sensor-proxy mount entry in $lxc_config"
return 1
fi
if [[ "$updated" == true ]]; then
print_info "Configured migration-safe socket mount via lxc.mount.entry"
else
print_info "pulse-sensor-proxy mount already configured for migrations"
fi
}
# Prompt user about proxy installation # Prompt user about proxy installation
# Returns 0 if user wants proxy, 1 if not # Returns 0 if user wants proxy, 1 if not
prompt_proxy_installation() { prompt_proxy_installation() {
@ -1335,10 +1379,7 @@ create_lxc_container() {
fi fi
if [[ "$PROXY_PREPARE_MOUNT" == "true" ]]; then if [[ "$PROXY_PREPARE_MOUNT" == "true" ]]; then
local PROXY_HOST_PATH="/run/pulse-sensor-proxy" mkdir -p /run/pulse-sensor-proxy
local PROXY_CONTAINER_PATH="/mnt/pulse-proxy"
mkdir -p "$PROXY_HOST_PATH"
CREATE_ARGS+=("--mp0" "${PROXY_HOST_PATH},mp=${PROXY_CONTAINER_PATH},replicate=0")
fi fi
# Execute container creation (suppress verbose output) # Execute container creation (suppress verbose output)
@ -1359,6 +1400,12 @@ create_lxc_container() {
exit 1 exit 1
} }
if [[ "$PROXY_PREPARE_MOUNT" == "true" ]]; then
if ! configure_proxy_socket_mount "$CTID"; then
cleanup_on_error
fi
fi
# Start container # Start container
print_info "Starting container..." print_info "Starting container..."
if ! pct start $CTID >/dev/null 2>&1; then if ! pct start $CTID >/dev/null 2>&1; then

12
internal/api/config_handlers.go
View file

@ -3466,10 +3466,14 @@ pveum user token add pulse-monitor@pam "$TOKEN_NAME" --privsep 0
# 2) Install or update pulse-sensor-proxy on the host # 2) Install or update pulse-sensor-proxy on the host
curl -sSL "$PULSE_URL/api/install/install-sensor-proxy.sh" | bash -s -- --ctid ${CTID_DISPLAY} --pulse-server "$PULSE_URL" curl -sSL "$PULSE_URL/api/install/install-sensor-proxy.sh" | bash -s -- --ctid ${CTID_DISPLAY} --pulse-server "$PULSE_URL"
# 3) Ensure the proxy socket is mounted into this container # 3) Ensure the proxy socket is mounted into this container (migration-safe)
NEXT_MP=\$(pct config ${CTID_DISPLAY} | awk '\$1 ~ /^mp[0-9]+:/ && index(\$0, "mp=/mnt/pulse-proxy") {gsub(":", "", \$1); print \$1; exit}') LXC_CONF="/etc/pve/lxc/${CTID_DISPLAY}.conf"
if [ -z "\$NEXT_MP" ]; then NEXT_MP="mp0"; fi mkdir -p /run/pulse-sensor-proxy
pct set ${CTID_DISPLAY} -\${NEXT_MP} /run/pulse-sensor-proxy,mp=/mnt/pulse-proxy,replicate=0 sed -i '/^mp[0-9]\+: .*pulse-sensor-proxy/d' "$LXC_CONF"
if ! grep -q "^lxc.mount.entry: /run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0\$" "$LXC_CONF"; then
echo 'lxc.mount.entry: /run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0' >> "$LXC_CONF"
fi
pct stop ${CTID_DISPLAY} && sleep 2 && pct start ${CTID_DISPLAY}
pct exec ${CTID_DISPLAY} -- test -S /mnt/pulse-proxy/pulse-sensor-proxy.sock && echo "Socket OK" pct exec ${CTID_DISPLAY} -- test -S /mnt/pulse-proxy/pulse-sensor-proxy.sock && echo "Socket OK"
EOF EOF

134
scripts/install-sensor-proxy.sh
View file

@ -3134,11 +3134,13 @@ if [[ "$STANDALONE" == false ]]; then
echo " • Proxy on host manages all temperature collection" echo " • Proxy on host manages all temperature collection"
echo "" echo ""
# Ensure container mount via mp configuration
print_info "Configuring socket bind mount..." print_info "Configuring socket bind mount..."
MOUNT_TARGET="/mnt/pulse-proxy" MOUNT_TARGET="/mnt/pulse-proxy"
HOST_SOCKET_SOURCE="/run/pulse-sensor-proxy" HOST_SOCKET_SOURCE="/run/pulse-sensor-proxy"
LXC_CONFIG="/etc/pve/lxc/${CTID}.conf" LXC_CONFIG="/etc/pve/lxc/${CTID}.conf"
LOCAL_MOUNT_ENTRY="lxc.mount.entry: ${HOST_SOCKET_SOURCE} mnt/pulse-proxy none bind,create=dir 0 0"
mkdir -p "$HOST_SOCKET_SOURCE"
# Back up container config before modifying # Back up container config before modifying
LXC_CONFIG_BACKUP=$(mktemp) LXC_CONFIG_BACKUP=$(mktemp)
@ -3147,85 +3149,48 @@ cp "$LXC_CONFIG" "$LXC_CONFIG_BACKUP" 2>/dev/null || {
LXC_CONFIG_BACKUP="" LXC_CONFIG_BACKUP=""
} }
CONFIG_CONTENT=$(pct config "$CTID")
CURRENT_MP=$(pct config "$CTID" | awk -v target="$MOUNT_TARGET" '$1 ~ /^mp[0-9]+:$/ && index($0, "mp=" target) {split($1, arr, ":"); print arr[1]; exit}')
MOUNT_UPDATED=false MOUNT_UPDATED=false
HOTPLUG_FAILED=false
CT_RUNNING=false CT_RUNNING=false
SKIP_CONTAINER_POST_STEPS=false
if pct status "$CTID" 2>/dev/null | grep -q "running"; then if pct status "$CTID" 2>/dev/null | grep -q "running"; then
CT_RUNNING=true CT_RUNNING=true
fi fi
if [[ -z "$CURRENT_MP" ]]; then if grep -Eq '^mp[0-9]+: .*pulse-sensor-proxy' "$LXC_CONFIG" 2>/dev/null; then
for idx in $(seq 0 9); do print_info "Removing mp mounts for pulse-sensor-proxy to keep snapshots and migrations working"
if ! printf "%s\n" "$CONFIG_CONTENT" | grep -q "^mp${idx}:"; then sed -i '/^mp[0-9]\+: .*pulse-sensor-proxy/d' "$LXC_CONFIG"
CURRENT_MP="mp${idx}" MOUNT_UPDATED=true
break fi
if grep -q "^lxc.mount.entry: .*/pulse-sensor-proxy" "$LXC_CONFIG" 2>/dev/null; then
if ! grep -qxF "$LOCAL_MOUNT_ENTRY" "$LXC_CONFIG"; then
print_info "Updating existing lxc.mount.entry for pulse-sensor-proxy"
sed -i "s#^lxc.mount.entry: .*pulse-sensor-proxy.*#${LOCAL_MOUNT_ENTRY}#" "$LXC_CONFIG"
MOUNT_UPDATED=true
else
print_info "Container already has migration-safe lxc.mount.entry for proxy"
fi
else
print_info "Adding lxc.mount.entry for pulse-sensor-proxy"
echo "$LOCAL_MOUNT_ENTRY" >> "$LXC_CONFIG"
MOUNT_UPDATED=true
fi
if ! pct config "$CTID" | grep -qxF "$LOCAL_MOUNT_ENTRY"; then
print_error "Failed to persist migration-safe socket mount in container config"
if [ -n "$LXC_CONFIG_BACKUP" ] && [ -f "$LXC_CONFIG_BACKUP" ]; then
print_warn "Rolling back container configuration changes..."
cp "$LXC_CONFIG_BACKUP" "$LXC_CONFIG"
rm -f "$LXC_CONFIG_BACKUP"
fi fi
done
if [[ -z "$CURRENT_MP" ]]; then
print_error "Unable to find available mp slot for container mount"
exit 1 exit 1
fi fi
print_info "Configuring container mount using $CURRENT_MP..." print_info "✓ Mount configuration recorded in container config"
SET_ERROR=$(pct set "$CTID" -${CURRENT_MP} "${HOST_SOCKET_SOURCE},mp=${MOUNT_TARGET},replicate=0" 2>&1)
if [ $? -eq 0 ]; then
MOUNT_UPDATED=true
else
HOTPLUG_FAILED=true
if [ -n "$SET_ERROR" ]; then
print_warn "pct set failed: $SET_ERROR"
fi
fi
else
desired_pattern="^${CURRENT_MP}: ${HOST_SOCKET_SOURCE},mp=${MOUNT_TARGET}"
if pct config "$CTID" | grep -q "$desired_pattern"; then
print_info "Container already has socket mount configured ($CURRENT_MP)"
else
print_info "Updating container mount configuration ($CURRENT_MP)..."
SET_ERROR=$(pct set "$CTID" -${CURRENT_MP} "${HOST_SOCKET_SOURCE},mp=${MOUNT_TARGET},replicate=0" 2>&1)
if [ $? -eq 0 ]; then
MOUNT_UPDATED=true
else
HOTPLUG_FAILED=true
if [ -n "$SET_ERROR" ]; then
print_warn "pct set failed: $SET_ERROR"
fi
fi
fi
fi
if [[ "$HOTPLUG_FAILED" = true ]]; then
print_warn "Hot-plugging socket mount failed (container may be running). Updating config directly."
CURRENT_MP_LINE="${CURRENT_MP}: ${HOST_SOCKET_SOURCE},mp=${MOUNT_TARGET},replicate=0"
if ! grep -q "^${CURRENT_MP}:" "$LXC_CONFIG" 2>/dev/null; then
echo "$CURRENT_MP_LINE" >> "$LXC_CONFIG"
else
sed -i "s#^${CURRENT_MP}:.*#${CURRENT_MP_LINE}#" "$LXC_CONFIG"
fi
MOUNT_UPDATED=true
fi
# Verify mount configuration actually persisted
if ! pct config "$CTID" | grep -q "^${CURRENT_MP}:"; then
print_error "Failed to persist mount configuration for $CURRENT_MP"
print_error "Expected mount not found in container config"
exit 1
fi
print_info "✓ Mount configuration verified in container config"
# Remove legacy lxc.mount.entry directives if present
if grep -q "lxc.mount.entry: ${HOST_SOCKET_SOURCE}" "$LXC_CONFIG"; then
print_info "Removing legacy lxc.mount.entry directives for pulse-sensor-proxy"
sed -i '/lxc\.mount\.entry: \/run\/pulse-sensor-proxy/d' "$LXC_CONFIG"
MOUNT_UPDATED=true
fi
# Restart container to apply mount if configuration changed or mount missing
if [[ "$MOUNT_UPDATED" = true ]]; then if [[ "$MOUNT_UPDATED" = true ]]; then
if [[ "$SKIP_RESTART" = true ]]; then if [[ "$SKIP_RESTART" = true ]]; then
if [[ "$CT_RUNNING" = true ]]; then if [[ "$CT_RUNNING" = true ]]; then
print_info "Skipping container restart (--skip-restart provided)." print_info "Skipping container restart (--skip-restart provided). Changes apply on next restart."
else else
print_info "Skipping automatic container start (--skip-restart provided)." print_info "Skipping automatic container start (--skip-restart provided)."
fi fi
@ -3237,11 +3202,12 @@ if [[ "$MOUNT_UPDATED" = true ]]; then
pct start "$CTID" pct start "$CTID"
fi fi
sleep 5 sleep 5
CT_RUNNING=true
fi fi
fi fi
# Verify socket directory and file inside container # Verify socket directory and file inside container
if [[ "$HOTPLUG_FAILED" = true && "$CT_RUNNING" = true ]]; then if [[ "$SKIP_RESTART" = true && "$CT_RUNNING" = true && "$MOUNT_UPDATED" = true ]]; then
print_warn "Skipping socket verification until container $CTID is restarted." print_warn "Skipping socket verification until container $CTID is restarted."
print_warn "Please restart container and verify socket manually:" print_warn "Please restart container and verify socket manually:"
print_warn " pct stop $CTID && sleep 2 && pct start $CTID" print_warn " pct stop $CTID && sleep 2 && pct start $CTID"
@ -3249,6 +3215,11 @@ if [[ "$HOTPLUG_FAILED" = true && "$CT_RUNNING" = true ]]; then
elif [[ "$SKIP_RESTART" = true && "$CT_RUNNING" = false ]]; then elif [[ "$SKIP_RESTART" = true && "$CT_RUNNING" = false ]]; then
print_warn "Socket verification deferred. Start container $CTID and run:" print_warn "Socket verification deferred. Start container $CTID and run:"
print_warn " pct exec $CTID -- test -S ${MOUNT_TARGET}/pulse-sensor-proxy.sock && echo 'Socket OK'" print_warn " pct exec $CTID -- test -S ${MOUNT_TARGET}/pulse-sensor-proxy.sock && echo 'Socket OK'"
SKIP_CONTAINER_POST_STEPS=true
elif [[ "$CT_RUNNING" = false ]]; then
print_warn "Container $CTID is stopped. Start it to verify the pulse-sensor-proxy socket:"
print_warn " pct start $CTID && pct exec $CTID -- test -S ${MOUNT_TARGET}/pulse-sensor-proxy.sock && echo 'Socket OK'"
SKIP_CONTAINER_POST_STEPS=true
else else
if [[ ! -S "$SOCKET_PATH" ]]; then if [[ ! -S "$SOCKET_PATH" ]]; then
print_warn "Host proxy socket not available yet; deferring container verification until service starts." print_warn "Host proxy socket not available yet; deferring container verification until service starts."
@ -3276,6 +3247,7 @@ else
fi fi
fi fi
if [[ "$SKIP_CONTAINER_POST_STEPS" != true ]]; then
# Configure Pulse backend environment override inside container # Configure Pulse backend environment override inside container
print_info "Configuring Pulse to use proxy..." print_info "Configuring Pulse to use proxy..."
@ -3302,16 +3274,6 @@ EOF"
fi fi
fi fi
# Test proxy status
print_info "Testing proxy status..."
if systemctl is-active --quiet pulse-sensor-proxy; then
print_info "${GREEN}✓${NC} pulse-sensor-proxy is running"
else
print_error "pulse-sensor-proxy is not running"
print_info "Check logs: journalctl -u pulse-sensor-proxy -n 50"
exit 1
fi
# Check for and remove legacy SSH keys from container # Check for and remove legacy SSH keys from container
print_info "Checking for legacy SSH keys in container..." print_info "Checking for legacy SSH keys in container..."
LEGACY_KEYS_FOUND=false LEGACY_KEYS_FOUND=false
@ -3331,6 +3293,22 @@ if [ "$LEGACY_KEYS_FOUND" = true ] && [ "$QUIET" != true ]; then
print_info "Legacy SSH keys removed from container for security" print_info "Legacy SSH keys removed from container for security"
print_info "" print_info ""
fi fi
else
if [ -n "$LXC_CONFIG_BACKUP" ] && [ -f "$LXC_CONFIG_BACKUP" ]; then
rm -f "$LXC_CONFIG_BACKUP"
fi
print_warn "Skipping container-side configuration until container $CTID is running."
fi
# Test proxy status
print_info "Testing proxy status..."
if systemctl is-active --quiet pulse-sensor-proxy; then
print_info "${GREEN}✓${NC} pulse-sensor-proxy is running"
else
print_error "pulse-sensor-proxy is not running"
print_info "Check logs: journalctl -u pulse-sensor-proxy -n 50"
exit 1
fi
fi # End of container-specific configuration fi # End of container-specific configuration
if [[ "$SKIP_SELF_HEAL_SETUP" == "true" ]]; then if [[ "$SKIP_SELF_HEAL_SETUP" == "true" ]]; then