4 Commits

Author SHA1 Message Date
Sunil Mohan Adapa
efe303de31
ttrss: Use drop-in config component for /etc files
Tests:

- Config files are all symlinks in /etc/
- Web interface works

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-06-05 20:29:56 -04:00
Sunil Mohan Adapa
40eecb6446
*: Move modules-enabled files to /usr/share
- This will leave /etc/{plinth,freedombox} empty by default making service more
robust to run across various environments and situations. See systemd's
explanation for more details.

- Use Debian maintainer scripts remove all the existing files in
/etc/plinth/modules-enabled.

- Read from /usr/share/freedombox/modules-enabled then from
/etc/plinth/modules-enabled and finally from /etc/freedombox/modules-enabled.
Later read ones override previously read files. Any file pointing to /dev/null
will mean the module must be ignored.

Tests:

- Clean up /etc/plinth, /etc/freedombox and
/usr/share/freedombox/modules-enabled. Run service and notice that files are
getting loaded from development folder using a debug message.

- Run setup.py and notice that files get installed in
/usr/share/freedombox/modules-enabled/ and in the next run they get loaded from
there.

- Create a override file in /etc/plinth/modules-enabled/transmission and notice
that overriden file gets priority over the one in
/usr/share/freedombox/modules-enabled.

- Link the file /etc/plinth/modules-enabled/transmission to /dev/null and notice
that is not loaded.

- Create another file in /etc/freedombox/modules-enabled/transmission and notice
that it overrides the previous two files.

- All affected modules are loaded.

- Build a new Debian package and ensure that upgrading 23.8 to new version
removes are all configuration files.

- Build developer documentation and test that Tutorial -> Full Code and Tutorial
-> Skeleton sections have been updated with references to
-.../modules-enabled/... paths.

- Install quassel and notice that certificates were copied to /var/lib/quassel
directory. Change domain to another domain and notice that certificates were
copied again to that directory.

Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-05-13 07:08:43 -04:00
Sunil Mohan Adapa
c7c9d49939
ttrss: Add systemd security hardening to daemon
→ Overall exposure level for tt-rss.service: 1.1 OK 🙂

Tests:

- Run ./setup.py install. systemctl daemon-reload. Subscribe to a new feed and
don't wait for it load the feed. Then start/restart the daemon. The daemon
successfully fetches the feed. When tt-rss interface is loaded again the feed
items are available.

- For getting output of the daemon add StandardOutput=journal option to the
service file.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2021-10-11 15:47:05 -04:00
Sunil Mohan Adapa
2c4423baaf
ttrss: Fix daemon not running sometimes on startup
- Sometimes when postgres is not available, the daemon fails to create a
database connection. In this case the daemon permanently exits with code 101
instead of trying again.

- This happens more prominently when booting the system and postgres may not be
available. Although tt-rss.service has Wants= and After= on postgres.service, it
appears that postgres does not have proper startup notification with systemd.

- This may also happen in other situations such as when temporarily restarting
postgres during upgrades or backup/restore operations.

- Fix the issue by make the daemon restart after a failure. This seems
appropriate because the daemon is coded like a web page to fail and exit on
all, even temporary, errors.

Tests:

- Without the patch, stop postgres@13-main.service. Start tt-rss.service. It
will fail permanently and not try to restart.

- With the patch, daemon-reload systemd. Notice that the intended changes
reflect with systemd status. Start the service. It fails. But retries 2 minutes
later with failure again. When postgres is started again, the next attempt
succeeds.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2021-10-11 15:46:59 -04:00