From e039d57409cb2e8184e37a2fe0002a53f285be64 Mon Sep 17 00:00:00 2001 From: Eric Wagoner Date: Sat, 31 Dec 2022 12:14:15 -0500 Subject: [PATCH] Split service up into separeate services --- conf/bookwyrm-beat.service | 15 ++++++++++++ conf/bookwyrm-server.service | 15 ++++++++++++ conf/bookwyrm-worker.service | 15 ++++++++++++ conf/bookwyrm.target | 3 +++ conf/dockerless-run.sh | 14 ----------- conf/systemd.service | 45 ------------------------------------ manifest.json | 2 +- scripts/backup | 5 +++- scripts/install | 28 ++++++++-------------- scripts/remove | 10 +++++++- scripts/restore | 18 +++++++++++---- scripts/upgrade | 19 +++++++++++---- 12 files changed, 101 insertions(+), 88 deletions(-) create mode 100644 conf/bookwyrm-beat.service create mode 100644 conf/bookwyrm-server.service create mode 100644 conf/bookwyrm-worker.service create mode 100644 conf/bookwyrm.target delete mode 100644 conf/dockerless-run.sh delete mode 100644 conf/systemd.service diff --git a/conf/bookwyrm-beat.service b/conf/bookwyrm-beat.service new file mode 100644 index 0000000..fd0adf1 --- /dev/null +++ b/conf/bookwyrm-beat.service @@ -0,0 +1,15 @@ + +[Unit] +Description=__APP__ celery beat process +After=redis.service postgresql.service +PartOf=__APP__.target + +[Service] +User=__APP__ +Group=__APP__ +WorkingDirectory=__FINALPATH__/ +EnvironmentFile=__FINALPATH__/.env +ExecStart=__FINALPATH__/venv/bin/celery -A celerywyrm beat -l INFO --scheduler django_celery_beat.schedulers:DatabaseScheduler + +[Install] +WantedBy=multi-user.target \ No newline at end of file diff --git a/conf/bookwyrm-server.service b/conf/bookwyrm-server.service new file mode 100644 index 0000000..0977449 --- /dev/null +++ b/conf/bookwyrm-server.service @@ -0,0 +1,15 @@ + +[Unit] +Description=__APP__ application server +After=redis.service postgresql.service +PartOf=__APP__.target + +[Service] +User=__APP__ +Group=__APP__ +WorkingDirectory=__FINALPATH__/ +EnvironmentFile=__FINALPATH__/.env +ExecStart=__FINALPATH__/venv/bin/gunicorn bookwyrm.wsgi:application --bind 0.0.0.0:__PORT__ + +[Install] +WantedBy=multi-user.target \ No newline at end of file diff --git a/conf/bookwyrm-worker.service b/conf/bookwyrm-worker.service new file mode 100644 index 0000000..7bc657d --- /dev/null +++ b/conf/bookwyrm-worker.service @@ -0,0 +1,15 @@ + +[Unit] +Description=__APP__ celery worker +After=redis.service postgresql.service +PartOf=__APP__.target + +[Service] +User=__APP__ +Group=__APP__ +WorkingDirectory=__FINALPATH__/ +EnvironmentFile=__FINALPATH__/.env +ExecStart=__FINALPATH__/venv/bin/celery -A celerywyrm worker -l info -Q high_priority,medium_priority,low_priority + +[Install] +WantedBy=multi-user.target \ No newline at end of file diff --git a/conf/bookwyrm.target b/conf/bookwyrm.target new file mode 100644 index 0000000..ae63b04 --- /dev/null +++ b/conf/bookwyrm.target @@ -0,0 +1,3 @@ +[Unit] +Description=Bookwyrm Services (__APP__) +Wants=__APP__-server.service __APP__-worker.service __APP__-beat.service \ No newline at end of file diff --git a/conf/dockerless-run.sh b/conf/dockerless-run.sh deleted file mode 100644 index 7e0aa9e..0000000 --- a/conf/dockerless-run.sh +++ /dev/null @@ -1,14 +0,0 @@ -#!/bin/bash - -set -a; source __FINALPATH__/.env; set +a - -# stop if one process fails -set -e - -# bookwyrm -__FINALPATH__/venv/bin/gunicorn bookwyrm.wsgi:application --bind 0.0.0.0:__PORT__ & - -# celery -__FINALPATH__/venv/bin/celery -A celerywyrm worker -l info -Q high_priority,medium_priority,low_priority & -__FINALPATH__/venv/bin/celery -A celerywyrm beat -l INFO --scheduler django_celery_beat.schedulers:DatabaseScheduler & -# __FINALPATH__/venv/bin/celery -A celerywyrm flower & \ No newline at end of file diff --git a/conf/systemd.service b/conf/systemd.service deleted file mode 100644 index 33ff720..0000000 --- a/conf/systemd.service +++ /dev/null @@ -1,45 +0,0 @@ -[Unit] -Description=Bookwyrm Server -After=network.target - -[Service] -Type=simple -User=__APP__ -Group=__APP__ -WorkingDirectory=__FINALPATH__/ -ExecStart=/bin/bash __FINALPATH__/dockerless-run.sh -StandardOutput=append:/var/log/__APP__/__APP__.log -StandardError=inherit - -# Sandboxing options to harden security -# Depending on specificities of your service/app, you may need to tweak these -# .. but this should be a good baseline -# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html -NoNewPrivileges=yes -PrivateTmp=yes -PrivateDevices=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -RestrictNamespaces=yes -RestrictRealtime=yes -DevicePolicy=closed -ProtectSystem=full -ProtectControlGroups=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -LockPersonality=yes -SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap - -# Denying access to capabilities that should not be relevant for webapps -# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html -CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD -CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE -CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT -CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK -CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM -CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG -CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE -CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW -CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG - -[Install] -WantedBy=multi-user.target diff --git a/manifest.json b/manifest.json index 6bec448..4061ad8 100644 --- a/manifest.json +++ b/manifest.json @@ -6,7 +6,7 @@ "en": "BookWyrm is a platform for social reading.", "fr": "BookWyrm est une plateforme de lecture sociale." }, - "version": "0.5.3~ynh1", + "version": "0.5.3~ynh1.0.5", "url": "https://github.com/bookwyrm-social/bookwyrm", "upstream": { "license": "AGPL-3.0-or-later", diff --git a/scripts/backup b/scripts/backup index e8aa49b..c09de5e 100755 --- a/scripts/backup +++ b/scripts/backup @@ -72,7 +72,10 @@ ynh_backup --src_path="/etc/nginx/conf.d/$domain.d/$app.conf" # BACKUP SYSTEMD #================================================= -ynh_backup --src_path="/etc/systemd/system/$app.service" +ynh_backup --src_path="/etc/systemd/system/${app}-beat.service" +ynh_backup --src_path="/etc/systemd/system/${app}-server.service" +ynh_backup --src_path="/etc/systemd/system/${app}-worker.service" +ynh_backup --src_path="/etc/systemd/system/$app.target" #================================================= diff --git a/scripts/install b/scripts/install index 44a94b2..b3265ef 100755 --- a/scripts/install +++ b/scripts/install @@ -109,15 +109,6 @@ chmod 750 "$final_path" chmod -R o-rwx "$final_path" chown -R $app:www-data "$final_path" -#================================================= -# CREATE LOG FILE -#================================================= -ynh_script_progression --message="Creating log file..." --weight=1 - -mkdir -p "/var/log/$app/" -touch "/var/log/$app/${app}.log" -chown -R $app: "/var/log/$app/" - #================================================= # CONFIGURE THEN INSTALL SCRIPT AND DEPENDENCIES #================================================= @@ -129,10 +120,6 @@ chown $app:www-data "$final_path/.env" set -a; source "$final_path/.env"; set +a -ynh_add_config --template="dockerless-run.sh" --destination="$final_path/dockerless-run.sh" -chmod 700 "$final_path/dockerless-run.sh" -chown $app:$app "$final_path/dockerless-run.sh" - mkdir "$final_path/venv" python3 -m venv "$final_path/venv" $final_path/venv/bin/pip3 install -r "$final_path/requirements.txt" @@ -176,9 +163,12 @@ chown -R $app:www-data "$datadir" #================================================= ynh_script_progression --message="Configuring a systemd service..." --weight=1 +ynh_add_config --template="../conf/${app}.target" --destination="/etc/systemd/system/$app.target" # Create a dedicated systemd config -ynh_add_systemd_config +ynh_add_systemd_config --service="${app}-server" --template="${app}-server.service" +ynh_add_systemd_config --service="${app}-worker" --template="${app}-worker.service" +ynh_add_systemd_config --service="${app}-beat" --template="${app}-beat.service" #================================================= @@ -190,8 +180,9 @@ ynh_add_systemd_config #================================================= ynh_script_progression --message="Integrating service in YunoHost..." --weight=1 - -yunohost service add $app --description="BookWyrm service" --log="/var/log/$app/$app.log" +yunohost service add "${app}-beat" +yunohost service add "${app}-server" +yunohost service add "${app}-worker" #================================================= @@ -199,9 +190,10 @@ yunohost service add $app --description="BookWyrm service" --log="/var/log/$app/ #================================================= ynh_script_progression --message="Starting a systemd service..." --weight=1 - # Start a systemd service -ynh_systemd_action --service_name=$app --action="start" --log_path="/var/log/$app/$app.log" +ynh_systemd_action --service_name="${app}-beat" --action="start" --log_path="systemd" --line_match="Started" +ynh_systemd_action --service_name="${app}-server" --action="start" --log_path="systemd" --line_match="Booting worker with pid" +ynh_systemd_action --service_name="${app}-worker" --action="start" --log_path="systemd" --line_match="ready" #================================================= diff --git a/scripts/remove b/scripts/remove index 8d10d43..a3093de 100755 --- a/scripts/remove +++ b/scripts/remove @@ -41,8 +41,16 @@ fi #================================================= ynh_script_progression --message="Stopping and removing the systemd service..." --weight=1 +ynh_systemd_action --service_name="${app}-beat" --action="stop" --log_path="systemd" --line_match="Stopped $app" +ynh_systemd_action --service_name="${app}-server" --action="stop" --log_path="systemd" --line_match="Stopped $app" +ynh_systemd_action --service_name="${app}-worker" --action="stop" --log_path="systemd" --line_match="Stopped $app" + # Remove the dedicated systemd config -ynh_remove_systemd_config +ynh_remove_systemd_config --service="${app}-beat" +ynh_remove_systemd_config --service="${app}-server" +ynh_remove_systemd_config --service="${app}-worker" + +ynh_secure_remove --file="/etc/systemd/system/$app.target" #================================================= # REMOVE LOGROTATE CONFIGURATION diff --git a/scripts/restore b/scripts/restore index 7b4ddab..5fb7cd1 100755 --- a/scripts/restore +++ b/scripts/restore @@ -124,22 +124,32 @@ ynh_psql_execute_file_as_root --file="./db.sql" --database="$db_name" #================================================= ynh_script_progression --message="Restoring the systemd configuration..." --weight=1 -ynh_restore_file --origin_path="/etc/systemd/system/$app.service" -systemctl enable $app.service --quiet +ynh_restore_file --origin_path="/etc/systemd/system/${app}-beat.service" +ynh_restore_file --origin_path="/etc/systemd/system/${app}-server.service" +ynh_restore_file --origin_path="/etc/systemd/system/${app}-worker.service" +ynh_restore_file --origin_path="/etc/systemd/system/$app.target" + +systemctl enable "${app}-beat.service" --quiet +systemctl enable "${app}-server.service" --quiet +systemctl enable "${app}-worker.service" --quiet #================================================= # INTEGRATE SERVICE IN YUNOHOST #================================================= ynh_script_progression --message="Integrating service in YunoHost..." --weight=1 -yunohost service add $app --description="BookWyrm service" --log="/var/log/$app/$app.log" +yunohost service add "${app}-beat" +yunohost service add "${app}-server" +yunohost service add "${app}-worker" #================================================= # START SYSTEMD SERVICE #================================================= ynh_script_progression --message="Starting a systemd service..." --weight=1 -ynh_systemd_action --service_name=$app --action="start" --log_path="/var/log/$app/$app.log" +ynh_systemd_action --service_name="${app}-beat" --action="start" --log_path="systemd" --line_match="Started" +ynh_systemd_action --service_name="${app}-server" --action="start" --log_path="systemd" --line_match="Booting worker with pid" +ynh_systemd_action --service_name="${app}-worker" --action="start" --log_path="systemd" --line_match="ready" #================================================= # GENERIC FINALIZATION diff --git a/scripts/upgrade b/scripts/upgrade index 951da60..bab43e2 100644 --- a/scripts/upgrade +++ b/scripts/upgrade @@ -22,6 +22,7 @@ language=$(ynh_app_setting_get --app=$app --key=language) admin=$(ynh_app_setting_get --app=$app --key=admin) final_path=$(ynh_app_setting_get --app=$app --key=final_path) db_name=$(ynh_app_setting_get --app=$app --key=db_name) +port=$(ynh_app_setting_get --app=$app --key=port) #================================================= # CHECK VERSION @@ -56,7 +57,9 @@ ynh_abort_if_errors #================================================= ynh_script_progression --message="Stopping a systemd service..." --weight=1 -ynh_systemd_action --service_name=$app --action="stop" --log_path="/var/log/$app/$app.log" +ynh_systemd_action --action="stop" --service_name="${app}-beat" --log_path="systemd" --line_match="Stopped" +ynh_systemd_action --action="stop" --service_name="${app}-server" --log_path="systemd" --line_match="Stopped" +ynh_systemd_action --action="stop" --service_name="${app}-worker" --log_path="systemd" --line_match="Stopped" #================================================= # ENSURE DOWNWARD COMPATIBILITY @@ -152,8 +155,12 @@ ynh_install_app_dependencies $pkg_dependencies #================================================= ynh_script_progression --message="Upgrading systemd configuration..." --weight=1 +ynh_add_config --template="../conf/${app}.target" --destination="/etc/systemd/system/$app.target" + # Create a dedicated systemd config -ynh_add_systemd_config +ynh_add_systemd_config --service="${app}-server" --template="${app}-server.service" +ynh_add_systemd_config --service="${app}-worker" --template="${app}-worker.service" +ynh_add_systemd_config --service="${app}-beat" --template="${app}-beat.service" #================================================= # GENERIC FINALIZATION @@ -163,14 +170,18 @@ ynh_add_systemd_config #================================================= ynh_script_progression --message="Integrating service in YunoHost..." --weight=1 -yunohost service add $app --description="BookWyrm service" --log="/var/log/$app/$app.log" +yunohost service add "${app}-beat" +yunohost service add "${app}-server" +yunohost service add "${app}-worker" #================================================= # START SYSTEMD SERVICE #================================================= ynh_script_progression --message="Starting a systemd service..." --weight=1 -ynh_systemd_action --service_name=$app --action="start" --log_path="/var/log/$app/$app.log" +ynh_systemd_action --service_name="${app}-beat" --action="start" --log_path="systemd" --line_match="Started" +ynh_systemd_action --service_name="${app}-server" --action="start" --log_path="systemd" --line_match="Booting worker with pid" +ynh_systemd_action --service_name="${app}-worker" --action="start" --log_path="systemd" --line_match="ready" #=================================================