Related to #738: make pulse proxy mount migration-safe
This commit is contained in:
rcourtman
parent
4c1da82e28
commit
19408fdb2b
4 changed files with 220 additions and 193 deletions
|
|
@ -147,7 +147,7 @@ The socket directory needs `0775` (not `0770`) to allow the container's unprivil
|
||||||
| `lxc.idmap` | `u 0 100000 65536`<br>`g 0 100000 65536` | Unprivileged UID/GID mapping |
|
| `lxc.idmap` | `u 0 100000 65536`<br>`g 0 100000 65536` | Unprivileged UID/GID mapping |
|
||||||
| `lxc.apparmor.profile` | `generated` or custom | AppArmor confinement |
|
| `lxc.apparmor.profile` | `generated` or custom | AppArmor confinement |
|
||||||
| `lxc.cap.drop` | `sys_admin` (optional) | Drop dangerous capabilities |
|
| `lxc.cap.drop` | `sys_admin` (optional) | Drop dangerous capabilities |
|
||||||
| `mpX` | `/run/pulse-sensor-proxy,mp=/mnt/pulse-proxy` | Socket access from container |
|
| `lxc.mount.entry` | `/run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0` | Socket access from container (migration-safe) |
|
||||||
|
|
||||||
### Sample LXC Configuration
|
### Sample LXC Configuration
|
||||||
|
|
||||||
|
|
@ -164,27 +164,25 @@ lxc.apparmor.profile: generated
|
||||||
lxc.cap.drop: sys_admin
|
lxc.cap.drop: sys_admin
|
||||||
|
|
||||||
# Bind mount proxy socket directory (REQUIRED)
|
# Bind mount proxy socket directory (REQUIRED)
|
||||||
# Note: Use an mp entry so Proxmox manages the bind mount automatically
|
# Use lxc.mount.entry to keep snapshots/migrations working with Proxmox bind mounts
|
||||||
mp0: /run/pulse-sensor-proxy,mp=/mnt/pulse-proxy
|
lxc.mount.entry: /run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0
|
||||||
```
|
```
|
||||||
|
|
||||||
**Key points:**
|
**Key points:**
|
||||||
- **Directory-level mount**: Mount `/run/pulse-sensor-proxy` directory, not the socket file itself
|
- **Directory-level mount**: Mount `/run/pulse-sensor-proxy` directory, not the socket file itself (socket is recreated by systemd)
|
||||||
- **Why directory mount?** Systemd recreates the socket on restart; socket-level mounts break on recreation
|
- **lxc.mount.entry instead of mp**: Proxmox refuses snapshots/migrations when `mpX` bind mounts target `/run/pulse-sensor-proxy`; `lxc.mount.entry` keeps the bind mount without blocking those workflows
|
||||||
- **Mode 0775**: Socket directory needs group+other execute permissions for container UID traversal
|
- **Mode 0775**: Socket directory needs group+other execute permissions for container UID traversal
|
||||||
- **Socket 0777**: Actual socket is world-writable; security enforced via `SO_PEERCRED` authentication
|
- **Socket 0777**: Actual socket is world-writable; security enforced via `SO_PEERCRED` authentication
|
||||||
|
|
||||||
### Upgrading Existing Installations
|
### Upgrading Existing Installations
|
||||||
|
|
||||||
If you previously followed the legacy guide (manual `lxc.mount.entry` and `/run/pulse-sensor-proxy` inside the container), upgrade by **removing each node in Pulse and then re-adding it using the “Copy install script” flow in Settings → Nodes**. The script you copy from the UI now:
|
If you previously used an `mpX` bind mount (e.g., `mp0: /run/pulse-sensor-proxy,mp=/mnt/pulse-proxy`), upgrade by **removing each node in Pulse and then re-adding it using the “Copy install script” flow in Settings → Nodes**. The installer now:
|
||||||
|
|
||||||
- Cleans up any old `lxc.mount.entry` rows and replaces them with the managed `mp` mount.
|
- Removes `mp*` entries referencing `/run/pulse-sensor-proxy`
|
||||||
- Ensures the socket is mounted at `/mnt/pulse-proxy/pulse-sensor-proxy.sock` inside the container.
|
- Writes the migration-safe `lxc.mount.entry: /run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0`
|
||||||
- Adds the systemd override so the container backend (or hot-dev) automatically uses the mounted socket.
|
- Keeps the systemd override so the backend automatically uses `/mnt/pulse-proxy/pulse-sensor-proxy.sock`
|
||||||
|
|
||||||
This is the same workflow you used originally—no extra commands are required. Just remove the node from Pulse, click “Copy install script,” run it on the Proxmox host, and add the node again.
|
This is the same workflow you used originally—no extra commands are required. Just remove the node from Pulse, click “Copy install script,” run it on the Proxmox host, and add the node again. If you prefer to refresh in place, rerun the host-side installer directly (e.g. `sudo /opt/pulse/scripts/install-sensor-proxy.sh --ctid <id> --pulse-server http://<pulse-container-ip>:7655`).
|
||||||
|
|
||||||
> **Advanced option**: If you’d rather refresh in place without removing the node, you can rerun the host-side installer directly (e.g. `sudo /opt/pulse/scripts/install-sensor-proxy.sh --ctid <id> --pulse-server http://<pulse-container-ip>:7655`). The script is idempotent, but re-adding through the UI guarantees the full host + Pulse configuration is rebuilt.
|
|
||||||
|
|
||||||
### Runtime Verification
|
### Runtime Verification
|
||||||
|
|
||||||
|
|
|
||||||
57
install.sh
57
install.sh
|
|
@ -441,6 +441,50 @@ cleanup_sensor_proxy() {
|
||||||
manual_sensor_proxy_cleanup
|
manual_sensor_proxy_cleanup
|
||||||
}
|
}
|
||||||
|
|
||||||
|
configure_proxy_socket_mount() {
|
||||||
|
local ctid="$1"
|
||||||
|
local host_source="/run/pulse-sensor-proxy"
|
||||||
|
local target_rel="mnt/pulse-proxy"
|
||||||
|
local desired_entry="lxc.mount.entry: ${host_source} ${target_rel} none bind,create=dir 0 0"
|
||||||
|
local lxc_config="/etc/pve/lxc/${ctid}.conf"
|
||||||
|
|
||||||
|
mkdir -p "$host_source"
|
||||||
|
|
||||||
|
if [[ ! -f "$lxc_config" ]]; then
|
||||||
|
print_error "Container config not found at $lxc_config; cannot configure pulse-sensor-proxy mount"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local updated=false
|
||||||
|
|
||||||
|
if grep -Eq '^mp[0-9]+: .*pulse-sensor-proxy' "$lxc_config" 2>/dev/null; then
|
||||||
|
print_info "Removing mp entries for pulse-sensor-proxy to keep snapshots and migrations working"
|
||||||
|
sed -i '/^mp[0-9]\+: .*pulse-sensor-proxy/d' "$lxc_config"
|
||||||
|
updated=true
|
||||||
|
fi
|
||||||
|
|
||||||
|
if grep -q "^lxc.mount.entry: .*/pulse-sensor-proxy" "$lxc_config" 2>/dev/null; then
|
||||||
|
if ! grep -qxF "$desired_entry" "$lxc_config"; then
|
||||||
|
sed -i "s#^lxc.mount.entry: .*pulse-sensor-proxy.*#${desired_entry}#" "$lxc_config"
|
||||||
|
updated=true
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
echo "$desired_entry" >> "$lxc_config"
|
||||||
|
updated=true
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! pct config "$ctid" | grep -qxF "$desired_entry"; then
|
||||||
|
print_error "Failed to persist pulse-sensor-proxy mount entry in $lxc_config"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ "$updated" == true ]]; then
|
||||||
|
print_info "Configured migration-safe socket mount via lxc.mount.entry"
|
||||||
|
else
|
||||||
|
print_info "pulse-sensor-proxy mount already configured for migrations"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
# Prompt user about proxy installation
|
# Prompt user about proxy installation
|
||||||
# Returns 0 if user wants proxy, 1 if not
|
# Returns 0 if user wants proxy, 1 if not
|
||||||
prompt_proxy_installation() {
|
prompt_proxy_installation() {
|
||||||
|
|
@ -1335,10 +1379,7 @@ create_lxc_container() {
|
||||||
fi
|
fi
|
||||||
|
|
||||||
if [[ "$PROXY_PREPARE_MOUNT" == "true" ]]; then
|
if [[ "$PROXY_PREPARE_MOUNT" == "true" ]]; then
|
||||||
local PROXY_HOST_PATH="/run/pulse-sensor-proxy"
|
mkdir -p /run/pulse-sensor-proxy
|
||||||
local PROXY_CONTAINER_PATH="/mnt/pulse-proxy"
|
|
||||||
mkdir -p "$PROXY_HOST_PATH"
|
|
||||||
CREATE_ARGS+=("--mp0" "${PROXY_HOST_PATH},mp=${PROXY_CONTAINER_PATH},replicate=0")
|
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Execute container creation (suppress verbose output)
|
# Execute container creation (suppress verbose output)
|
||||||
|
|
@ -1347,7 +1388,7 @@ create_lxc_container() {
|
||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
CONTAINER_CREATED_FOR_CLEANUP=true
|
CONTAINER_CREATED_FOR_CLEANUP=true
|
||||||
|
|
||||||
# From this point on, cleanup container if we fail
|
# From this point on, cleanup container if we fail
|
||||||
cleanup_on_error() {
|
cleanup_on_error() {
|
||||||
print_error "Installation failed, cleaning up container $CTID..."
|
print_error "Installation failed, cleaning up container $CTID..."
|
||||||
|
|
@ -1358,6 +1399,12 @@ create_lxc_container() {
|
||||||
pct destroy $CTID 2>/dev/null || true
|
pct destroy $CTID 2>/dev/null || true
|
||||||
exit 1
|
exit 1
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if [[ "$PROXY_PREPARE_MOUNT" == "true" ]]; then
|
||||||
|
if ! configure_proxy_socket_mount "$CTID"; then
|
||||||
|
cleanup_on_error
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
# Start container
|
# Start container
|
||||||
print_info "Starting container..."
|
print_info "Starting container..."
|
||||||
|
|
|
||||||
|
|
@ -3466,10 +3466,14 @@ pveum user token add pulse-monitor@pam "$TOKEN_NAME" --privsep 0
|
||||||
# 2) Install or update pulse-sensor-proxy on the host
|
# 2) Install or update pulse-sensor-proxy on the host
|
||||||
curl -sSL "$PULSE_URL/api/install/install-sensor-proxy.sh" | bash -s -- --ctid ${CTID_DISPLAY} --pulse-server "$PULSE_URL"
|
curl -sSL "$PULSE_URL/api/install/install-sensor-proxy.sh" | bash -s -- --ctid ${CTID_DISPLAY} --pulse-server "$PULSE_URL"
|
||||||
|
|
||||||
# 3) Ensure the proxy socket is mounted into this container
|
# 3) Ensure the proxy socket is mounted into this container (migration-safe)
|
||||||
NEXT_MP=\$(pct config ${CTID_DISPLAY} | awk '\$1 ~ /^mp[0-9]+:/ && index(\$0, "mp=/mnt/pulse-proxy") {gsub(":", "", \$1); print \$1; exit}')
|
LXC_CONF="/etc/pve/lxc/${CTID_DISPLAY}.conf"
|
||||||
if [ -z "\$NEXT_MP" ]; then NEXT_MP="mp0"; fi
|
mkdir -p /run/pulse-sensor-proxy
|
||||||
pct set ${CTID_DISPLAY} -\${NEXT_MP} /run/pulse-sensor-proxy,mp=/mnt/pulse-proxy,replicate=0
|
sed -i '/^mp[0-9]\+: .*pulse-sensor-proxy/d' "$LXC_CONF"
|
||||||
|
if ! grep -q "^lxc.mount.entry: /run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0\$" "$LXC_CONF"; then
|
||||||
|
echo 'lxc.mount.entry: /run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0' >> "$LXC_CONF"
|
||||||
|
fi
|
||||||
|
pct stop ${CTID_DISPLAY} && sleep 2 && pct start ${CTID_DISPLAY}
|
||||||
pct exec ${CTID_DISPLAY} -- test -S /mnt/pulse-proxy/pulse-sensor-proxy.sock && echo "Socket OK"
|
pct exec ${CTID_DISPLAY} -- test -S /mnt/pulse-proxy/pulse-sensor-proxy.sock && echo "Socket OK"
|
||||||
|
|
||||||
EOF
|
EOF
|
||||||
|
|
|
||||||
|
|
@ -3134,203 +3134,181 @@ if [[ "$STANDALONE" == false ]]; then
|
||||||
echo " • Proxy on host manages all temperature collection"
|
echo " • Proxy on host manages all temperature collection"
|
||||||
echo ""
|
echo ""
|
||||||
|
|
||||||
# Ensure container mount via mp configuration
|
|
||||||
print_info "Configuring socket bind mount..."
|
print_info "Configuring socket bind mount..."
|
||||||
MOUNT_TARGET="/mnt/pulse-proxy"
|
MOUNT_TARGET="/mnt/pulse-proxy"
|
||||||
HOST_SOCKET_SOURCE="/run/pulse-sensor-proxy"
|
HOST_SOCKET_SOURCE="/run/pulse-sensor-proxy"
|
||||||
LXC_CONFIG="/etc/pve/lxc/${CTID}.conf"
|
LXC_CONFIG="/etc/pve/lxc/${CTID}.conf"
|
||||||
|
LOCAL_MOUNT_ENTRY="lxc.mount.entry: ${HOST_SOCKET_SOURCE} mnt/pulse-proxy none bind,create=dir 0 0"
|
||||||
|
|
||||||
# Back up container config before modifying
|
mkdir -p "$HOST_SOCKET_SOURCE"
|
||||||
LXC_CONFIG_BACKUP=$(mktemp)
|
|
||||||
cp "$LXC_CONFIG" "$LXC_CONFIG_BACKUP" 2>/dev/null || {
|
|
||||||
print_warn "Could not back up container config (may not exist yet)"
|
|
||||||
LXC_CONFIG_BACKUP=""
|
|
||||||
}
|
|
||||||
|
|
||||||
CONFIG_CONTENT=$(pct config "$CTID")
|
# Back up container config before modifying
|
||||||
CURRENT_MP=$(pct config "$CTID" | awk -v target="$MOUNT_TARGET" '$1 ~ /^mp[0-9]+:$/ && index($0, "mp=" target) {split($1, arr, ":"); print arr[1]; exit}')
|
LXC_CONFIG_BACKUP=$(mktemp)
|
||||||
MOUNT_UPDATED=false
|
cp "$LXC_CONFIG" "$LXC_CONFIG_BACKUP" 2>/dev/null || {
|
||||||
HOTPLUG_FAILED=false
|
print_warn "Could not back up container config (may not exist yet)"
|
||||||
CT_RUNNING=false
|
LXC_CONFIG_BACKUP=""
|
||||||
if pct status "$CTID" 2>/dev/null | grep -q "running"; then
|
}
|
||||||
CT_RUNNING=true
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -z "$CURRENT_MP" ]]; then
|
MOUNT_UPDATED=false
|
||||||
for idx in $(seq 0 9); do
|
CT_RUNNING=false
|
||||||
if ! printf "%s\n" "$CONFIG_CONTENT" | grep -q "^mp${idx}:"; then
|
SKIP_CONTAINER_POST_STEPS=false
|
||||||
CURRENT_MP="mp${idx}"
|
if pct status "$CTID" 2>/dev/null | grep -q "running"; then
|
||||||
break
|
CT_RUNNING=true
|
||||||
fi
|
|
||||||
done
|
|
||||||
if [[ -z "$CURRENT_MP" ]]; then
|
|
||||||
print_error "Unable to find available mp slot for container mount"
|
|
||||||
exit 1
|
|
||||||
fi
|
fi
|
||||||
print_info "Configuring container mount using $CURRENT_MP..."
|
|
||||||
SET_ERROR=$(pct set "$CTID" -${CURRENT_MP} "${HOST_SOCKET_SOURCE},mp=${MOUNT_TARGET},replicate=0" 2>&1)
|
if grep -Eq '^mp[0-9]+: .*pulse-sensor-proxy' "$LXC_CONFIG" 2>/dev/null; then
|
||||||
if [ $? -eq 0 ]; then
|
print_info "Removing mp mounts for pulse-sensor-proxy to keep snapshots and migrations working"
|
||||||
|
sed -i '/^mp[0-9]\+: .*pulse-sensor-proxy/d' "$LXC_CONFIG"
|
||||||
MOUNT_UPDATED=true
|
MOUNT_UPDATED=true
|
||||||
else
|
|
||||||
HOTPLUG_FAILED=true
|
|
||||||
if [ -n "$SET_ERROR" ]; then
|
|
||||||
print_warn "pct set failed: $SET_ERROR"
|
|
||||||
fi
|
|
||||||
fi
|
fi
|
||||||
else
|
|
||||||
desired_pattern="^${CURRENT_MP}: ${HOST_SOCKET_SOURCE},mp=${MOUNT_TARGET}"
|
if grep -q "^lxc.mount.entry: .*/pulse-sensor-proxy" "$LXC_CONFIG" 2>/dev/null; then
|
||||||
if pct config "$CTID" | grep -q "$desired_pattern"; then
|
if ! grep -qxF "$LOCAL_MOUNT_ENTRY" "$LXC_CONFIG"; then
|
||||||
print_info "Container already has socket mount configured ($CURRENT_MP)"
|
print_info "Updating existing lxc.mount.entry for pulse-sensor-proxy"
|
||||||
else
|
sed -i "s#^lxc.mount.entry: .*pulse-sensor-proxy.*#${LOCAL_MOUNT_ENTRY}#" "$LXC_CONFIG"
|
||||||
print_info "Updating container mount configuration ($CURRENT_MP)..."
|
|
||||||
SET_ERROR=$(pct set "$CTID" -${CURRENT_MP} "${HOST_SOCKET_SOURCE},mp=${MOUNT_TARGET},replicate=0" 2>&1)
|
|
||||||
if [ $? -eq 0 ]; then
|
|
||||||
MOUNT_UPDATED=true
|
MOUNT_UPDATED=true
|
||||||
else
|
else
|
||||||
HOTPLUG_FAILED=true
|
print_info "Container already has migration-safe lxc.mount.entry for proxy"
|
||||||
if [ -n "$SET_ERROR" ]; then
|
fi
|
||||||
print_warn "pct set failed: $SET_ERROR"
|
else
|
||||||
|
print_info "Adding lxc.mount.entry for pulse-sensor-proxy"
|
||||||
|
echo "$LOCAL_MOUNT_ENTRY" >> "$LXC_CONFIG"
|
||||||
|
MOUNT_UPDATED=true
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! pct config "$CTID" | grep -qxF "$LOCAL_MOUNT_ENTRY"; then
|
||||||
|
print_error "Failed to persist migration-safe socket mount in container config"
|
||||||
|
if [ -n "$LXC_CONFIG_BACKUP" ] && [ -f "$LXC_CONFIG_BACKUP" ]; then
|
||||||
|
print_warn "Rolling back container configuration changes..."
|
||||||
|
cp "$LXC_CONFIG_BACKUP" "$LXC_CONFIG"
|
||||||
|
rm -f "$LXC_CONFIG_BACKUP"
|
||||||
|
fi
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
print_info "✓ Mount configuration recorded in container config"
|
||||||
|
|
||||||
|
if [[ "$MOUNT_UPDATED" = true ]]; then
|
||||||
|
if [[ "$SKIP_RESTART" = true ]]; then
|
||||||
|
if [[ "$CT_RUNNING" = true ]]; then
|
||||||
|
print_info "Skipping container restart (--skip-restart provided). Changes apply on next restart."
|
||||||
|
else
|
||||||
|
print_info "Skipping automatic container start (--skip-restart provided)."
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
print_info "Restarting container to activate secure communication..."
|
||||||
|
if [[ "$CT_RUNNING" = true ]]; then
|
||||||
|
pct stop "$CTID" && sleep 2 && pct start "$CTID"
|
||||||
|
else
|
||||||
|
pct start "$CTID"
|
||||||
|
fi
|
||||||
|
sleep 5
|
||||||
|
CT_RUNNING=true
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Verify socket directory and file inside container
|
||||||
|
if [[ "$SKIP_RESTART" = true && "$CT_RUNNING" = true && "$MOUNT_UPDATED" = true ]]; then
|
||||||
|
print_warn "Skipping socket verification until container $CTID is restarted."
|
||||||
|
print_warn "Please restart container and verify socket manually:"
|
||||||
|
print_warn " pct stop $CTID && sleep 2 && pct start $CTID"
|
||||||
|
print_warn " pct exec $CTID -- test -S ${MOUNT_TARGET}/pulse-sensor-proxy.sock && echo 'Socket OK'"
|
||||||
|
elif [[ "$SKIP_RESTART" = true && "$CT_RUNNING" = false ]]; then
|
||||||
|
print_warn "Socket verification deferred. Start container $CTID and run:"
|
||||||
|
print_warn " pct exec $CTID -- test -S ${MOUNT_TARGET}/pulse-sensor-proxy.sock && echo 'Socket OK'"
|
||||||
|
SKIP_CONTAINER_POST_STEPS=true
|
||||||
|
elif [[ "$CT_RUNNING" = false ]]; then
|
||||||
|
print_warn "Container $CTID is stopped. Start it to verify the pulse-sensor-proxy socket:"
|
||||||
|
print_warn " pct start $CTID && pct exec $CTID -- test -S ${MOUNT_TARGET}/pulse-sensor-proxy.sock && echo 'Socket OK'"
|
||||||
|
SKIP_CONTAINER_POST_STEPS=true
|
||||||
|
else
|
||||||
|
if [[ ! -S "$SOCKET_PATH" ]]; then
|
||||||
|
print_warn "Host proxy socket not available yet; deferring container verification until service starts."
|
||||||
|
DEFER_SOCKET_VERIFICATION=true
|
||||||
|
else
|
||||||
|
print_info "Verifying secure communication channel..."
|
||||||
|
if pct exec "$CTID" -- test -S "${MOUNT_TARGET}/pulse-sensor-proxy.sock"; then
|
||||||
|
print_info "✓ Secure socket communication ready"
|
||||||
|
# Clean up backup since verification succeeded
|
||||||
|
[ -n "$LXC_CONFIG_BACKUP" ] && rm -f "$LXC_CONFIG_BACKUP"
|
||||||
|
else
|
||||||
|
print_error "Socket not visible at ${MOUNT_TARGET}/pulse-sensor-proxy.sock"
|
||||||
|
print_error "Mount configuration verified but socket not accessible in container"
|
||||||
|
print_error "This indicates a mount or restart issue"
|
||||||
|
|
||||||
|
# Rollback container config changes
|
||||||
|
if [ -n "$LXC_CONFIG_BACKUP" ] && [ -f "$LXC_CONFIG_BACKUP" ]; then
|
||||||
|
print_warn "Rolling back container configuration changes..."
|
||||||
|
cp "$LXC_CONFIG_BACKUP" "$LXC_CONFIG"
|
||||||
|
rm -f "$LXC_CONFIG_BACKUP"
|
||||||
|
print_info "Container configuration restored to previous state"
|
||||||
|
fi
|
||||||
|
exit 1
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ "$HOTPLUG_FAILED" = true ]]; then
|
if [[ "$SKIP_CONTAINER_POST_STEPS" != true ]]; then
|
||||||
print_warn "Hot-plugging socket mount failed (container may be running). Updating config directly."
|
# Configure Pulse backend environment override inside container
|
||||||
CURRENT_MP_LINE="${CURRENT_MP}: ${HOST_SOCKET_SOURCE},mp=${MOUNT_TARGET},replicate=0"
|
print_info "Configuring Pulse to use proxy..."
|
||||||
if ! grep -q "^${CURRENT_MP}:" "$LXC_CONFIG" 2>/dev/null; then
|
|
||||||
echo "$CURRENT_MP_LINE" >> "$LXC_CONFIG"
|
|
||||||
else
|
|
||||||
sed -i "s#^${CURRENT_MP}:.*#${CURRENT_MP_LINE}#" "$LXC_CONFIG"
|
|
||||||
fi
|
|
||||||
MOUNT_UPDATED=true
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Verify mount configuration actually persisted
|
# Always make sure the Pulse .env file contains the proxy socket override.
|
||||||
if ! pct config "$CTID" | grep -q "^${CURRENT_MP}:"; then
|
configure_container_proxy_env
|
||||||
print_error "Failed to persist mount configuration for $CURRENT_MP"
|
|
||||||
print_error "Expected mount not found in container config"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
print_info "✓ Mount configuration verified in container config"
|
|
||||||
|
|
||||||
# Remove legacy lxc.mount.entry directives if present
|
if ! pct exec "$CTID" -- systemctl status pulse >/dev/null 2>&1; then
|
||||||
if grep -q "lxc.mount.entry: ${HOST_SOCKET_SOURCE}" "$LXC_CONFIG"; then
|
print_warn "Pulse service not found in container $CTID; proxy socket configured but service restart deferred."
|
||||||
print_info "Removing legacy lxc.mount.entry directives for pulse-sensor-proxy"
|
print_info "Install or restart Pulse inside the container to enable temperature monitoring."
|
||||||
sed -i '/lxc\.mount\.entry: \/run\/pulse-sensor-proxy/d' "$LXC_CONFIG"
|
|
||||||
MOUNT_UPDATED=true
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Restart container to apply mount if configuration changed or mount missing
|
|
||||||
if [[ "$MOUNT_UPDATED" = true ]]; then
|
|
||||||
if [[ "$SKIP_RESTART" = true ]]; then
|
|
||||||
if [[ "$CT_RUNNING" = true ]]; then
|
|
||||||
print_info "Skipping container restart (--skip-restart provided)."
|
|
||||||
else
|
else
|
||||||
print_info "Skipping automatic container start (--skip-restart provided)."
|
pct exec "$CTID" -- bash -lc "mkdir -p /etc/systemd/system/pulse.service.d"
|
||||||
fi
|
pct exec "$CTID" -- bash -lc "cat <<'EOF' >/etc/systemd/system/pulse.service.d/10-pulse-proxy.conf
|
||||||
else
|
|
||||||
print_info "Restarting container to activate secure communication..."
|
|
||||||
if [[ "$CT_RUNNING" = true ]]; then
|
|
||||||
pct stop "$CTID" && sleep 2 && pct start "$CTID"
|
|
||||||
else
|
|
||||||
pct start "$CTID"
|
|
||||||
fi
|
|
||||||
sleep 5
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Verify socket directory and file inside container
|
|
||||||
if [[ "$HOTPLUG_FAILED" = true && "$CT_RUNNING" = true ]]; then
|
|
||||||
print_warn "Skipping socket verification until container $CTID is restarted."
|
|
||||||
print_warn "Please restart container and verify socket manually:"
|
|
||||||
print_warn " pct stop $CTID && sleep 2 && pct start $CTID"
|
|
||||||
print_warn " pct exec $CTID -- test -S ${MOUNT_TARGET}/pulse-sensor-proxy.sock && echo 'Socket OK'"
|
|
||||||
elif [[ "$SKIP_RESTART" = true && "$CT_RUNNING" = false ]]; then
|
|
||||||
print_warn "Socket verification deferred. Start container $CTID and run:"
|
|
||||||
print_warn " pct exec $CTID -- test -S ${MOUNT_TARGET}/pulse-sensor-proxy.sock && echo 'Socket OK'"
|
|
||||||
else
|
|
||||||
if [[ ! -S "$SOCKET_PATH" ]]; then
|
|
||||||
print_warn "Host proxy socket not available yet; deferring container verification until service starts."
|
|
||||||
DEFER_SOCKET_VERIFICATION=true
|
|
||||||
else
|
|
||||||
print_info "Verifying secure communication channel..."
|
|
||||||
if pct exec "$CTID" -- test -S "${MOUNT_TARGET}/pulse-sensor-proxy.sock"; then
|
|
||||||
print_info "✓ Secure socket communication ready"
|
|
||||||
# Clean up backup since verification succeeded
|
|
||||||
[ -n "$LXC_CONFIG_BACKUP" ] && rm -f "$LXC_CONFIG_BACKUP"
|
|
||||||
else
|
|
||||||
print_error "Socket not visible at ${MOUNT_TARGET}/pulse-sensor-proxy.sock"
|
|
||||||
print_error "Mount configuration verified but socket not accessible in container"
|
|
||||||
print_error "This indicates a mount or restart issue"
|
|
||||||
|
|
||||||
# Rollback container config changes
|
|
||||||
if [ -n "$LXC_CONFIG_BACKUP" ] && [ -f "$LXC_CONFIG_BACKUP" ]; then
|
|
||||||
print_warn "Rolling back container configuration changes..."
|
|
||||||
cp "$LXC_CONFIG_BACKUP" "$LXC_CONFIG"
|
|
||||||
rm -f "$LXC_CONFIG_BACKUP"
|
|
||||||
print_info "Container configuration restored to previous state"
|
|
||||||
fi
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Configure Pulse backend environment override inside container
|
|
||||||
print_info "Configuring Pulse to use proxy..."
|
|
||||||
|
|
||||||
# Always make sure the Pulse .env file contains the proxy socket override.
|
|
||||||
configure_container_proxy_env
|
|
||||||
|
|
||||||
if ! pct exec "$CTID" -- systemctl status pulse >/dev/null 2>&1; then
|
|
||||||
print_warn "Pulse service not found in container $CTID; proxy socket configured but service restart deferred."
|
|
||||||
print_info "Install or restart Pulse inside the container to enable temperature monitoring."
|
|
||||||
else
|
|
||||||
pct exec "$CTID" -- bash -lc "mkdir -p /etc/systemd/system/pulse.service.d"
|
|
||||||
pct exec "$CTID" -- bash -lc "cat <<'EOF' >/etc/systemd/system/pulse.service.d/10-pulse-proxy.conf
|
|
||||||
[Service]
|
[Service]
|
||||||
Environment=PULSE_SENSOR_PROXY_SOCKET=${MOUNT_TARGET}/pulse-sensor-proxy.sock
|
Environment=PULSE_SENSOR_PROXY_SOCKET=${MOUNT_TARGET}/pulse-sensor-proxy.sock
|
||||||
EOF"
|
EOF"
|
||||||
pct exec "$CTID" -- systemctl daemon-reload || true
|
pct exec "$CTID" -- systemctl daemon-reload || true
|
||||||
|
|
||||||
# Restart Pulse service to apply the new environment variable
|
# Restart Pulse service to apply the new environment variable
|
||||||
if pct exec "$CTID" -- systemctl is-active --quiet pulse 2>/dev/null; then
|
if pct exec "$CTID" -- systemctl is-active --quiet pulse 2>/dev/null; then
|
||||||
print_info "Restarting Pulse service to apply configuration..."
|
print_info "Restarting Pulse service to apply configuration..."
|
||||||
pct exec "$CTID" -- systemctl restart pulse
|
pct exec "$CTID" -- systemctl restart pulse
|
||||||
sleep 2
|
sleep 2
|
||||||
print_success "Pulse service restarted with proxy configuration"
|
print_success "Pulse service restarted with proxy configuration"
|
||||||
fi
|
fi
|
||||||
fi
|
|
||||||
|
|
||||||
# Test proxy status
|
|
||||||
print_info "Testing proxy status..."
|
|
||||||
if systemctl is-active --quiet pulse-sensor-proxy; then
|
|
||||||
print_info "${GREEN}✓${NC} pulse-sensor-proxy is running"
|
|
||||||
else
|
|
||||||
print_error "pulse-sensor-proxy is not running"
|
|
||||||
print_info "Check logs: journalctl -u pulse-sensor-proxy -n 50"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Check for and remove legacy SSH keys from container
|
|
||||||
print_info "Checking for legacy SSH keys in container..."
|
|
||||||
LEGACY_KEYS_FOUND=false
|
|
||||||
for key_type in id_rsa id_dsa id_ecdsa id_ed25519; do
|
|
||||||
if pct exec "$CTID" -- test -f "/root/.ssh/$key_type" 2>/dev/null; then
|
|
||||||
LEGACY_KEYS_FOUND=true
|
|
||||||
if [ "$QUIET" != true ]; then
|
|
||||||
print_warn "Found legacy SSH key: /root/.ssh/$key_type"
|
|
||||||
fi
|
fi
|
||||||
pct exec "$CTID" -- rm -f "/root/.ssh/$key_type" "/root/.ssh/${key_type}.pub"
|
|
||||||
print_info " Removed /root/.ssh/$key_type"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
if [ "$LEGACY_KEYS_FOUND" = true ] && [ "$QUIET" != true ]; then
|
# Check for and remove legacy SSH keys from container
|
||||||
print_info ""
|
print_info "Checking for legacy SSH keys in container..."
|
||||||
print_info "Legacy SSH keys removed from container for security"
|
LEGACY_KEYS_FOUND=false
|
||||||
print_info ""
|
for key_type in id_rsa id_dsa id_ecdsa id_ed25519; do
|
||||||
fi
|
if pct exec "$CTID" -- test -f "/root/.ssh/$key_type" 2>/dev/null; then
|
||||||
|
LEGACY_KEYS_FOUND=true
|
||||||
|
if [ "$QUIET" != true ]; then
|
||||||
|
print_warn "Found legacy SSH key: /root/.ssh/$key_type"
|
||||||
|
fi
|
||||||
|
pct exec "$CTID" -- rm -f "/root/.ssh/$key_type" "/root/.ssh/${key_type}.pub"
|
||||||
|
print_info " Removed /root/.ssh/$key_type"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
if [ "$LEGACY_KEYS_FOUND" = true ] && [ "$QUIET" != true ]; then
|
||||||
|
print_info ""
|
||||||
|
print_info "Legacy SSH keys removed from container for security"
|
||||||
|
print_info ""
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
if [ -n "$LXC_CONFIG_BACKUP" ] && [ -f "$LXC_CONFIG_BACKUP" ]; then
|
||||||
|
rm -f "$LXC_CONFIG_BACKUP"
|
||||||
|
fi
|
||||||
|
print_warn "Skipping container-side configuration until container $CTID is running."
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Test proxy status
|
||||||
|
print_info "Testing proxy status..."
|
||||||
|
if systemctl is-active --quiet pulse-sensor-proxy; then
|
||||||
|
print_info "${GREEN}✓${NC} pulse-sensor-proxy is running"
|
||||||
|
else
|
||||||
|
print_error "pulse-sensor-proxy is not running"
|
||||||
|
print_info "Check logs: journalctl -u pulse-sensor-proxy -n 50"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
fi # End of container-specific configuration
|
fi # End of container-specific configuration
|
||||||
|
|
||||||
if [[ "$SKIP_SELF_HEAL_SETUP" == "true" ]]; then
|
if [[ "$SKIP_SELF_HEAL_SETUP" == "true" ]]; then
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue