Dai Ha
380eb63277
deploy/fleetd.service started clean on fleet01 but broke the daemon in three ways nothing logs: ProtectSystem/ProtectHome/ProtectKernelTunables/ProtectControlGroups each put the unit in its own mount namespace, which blinds fleetd's lsof-based caller lookup and falls every caller back to ANONYMOUS; PrivateTmp=true silently no-ops the credential scrub the member pane depends on; and running java directly from ExecStart skips the login shell that sources the daemon's secrets, so it boots with empty credentials. Replace the unit with the version verified working on fleet01 for a day, and add the deploy/herdr.service companion unit it was already depending on via After=/Wants= but which did not exist in the repo. Add deploy/herdr-inner.sh as the login-shell template herdr.service's ExecStart wraps in a pty. Add SystemdUnitSafetyTest (fleetd/src/test/java/dev/ltms/fleet/deploy) to read both unit files from disk and fail if a forbidden mount-namespacing directive is active, PrivateTmp is true, or fleetd.service's ExecStart does not go through a login shell -- the only guard possible for a unit file with no compile step.
20 lines
1.1 KiB
Bash
Executable File
20 lines
1.1 KiB
Bash
Executable File
#!/bin/zsh
|
|
# fleetd #360 — template for the script deploy/herdr.service's ExecStart wraps in a pty.
|
|
#
|
|
# `script -qfec <this> /dev/null` needs a real command to run, and that command has to be a LOGIN
|
|
# shell script: herdr itself needs the same secrets fleetd.service's login shell picks up (this
|
|
# host: ~/.fleet/secrets.sh via ~/.zprofile), because members it spawns inherit its environment.
|
|
# systemd's own Environment= lines in herdr.service are not enough for that -- they set TERM and a
|
|
# bare PATH so the pty starts at all, nothing more.
|
|
#
|
|
# Copy this file to the path deploy/herdr.service's ExecStart names
|
|
# (%h/LTMS/fleetd/fleetd-run/herdr-inner.sh by default) and `chmod +x` it. Not committed under
|
|
# that path itself because the session name below is host-specific.
|
|
|
|
# A 0x0 pty makes every pane spawn fail with "ghostty error -2" (see herdr-multi-instance-facts /
|
|
# fleet01-headless-herdr-standup) -- give it a real size before herdr ever touches it.
|
|
stty rows 50 cols 200
|
|
|
|
# -l: login shell, so herdr and everything it spawns gets the real secrets and PATH.
|
|
exec zsh -lc 'exec herdr --session <name>'
|