Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nixos/murmur: log to systemd journal, expose wrapper #50333

Closed
wants to merge 2 commits into from
Closed

nixos/murmur: log to systemd journal, expose wrapper #50333

wants to merge 2 commits into from

Conversation

florianjacob
Copy link
Contributor

@florianjacob florianjacob commented Nov 13, 2018 •
edited

Motivation for this change

Everything I have on my server logs to systemd journal by default - except murmur.
This takes murmur in line with all other services by changing that.

On the very first start, murmur writes the password of the SuperUser into the log file.
To change this if desired or if that entry is not available anymore, this exposes a wrapper combining the binary and the service config file as the murmurd-service executable. (open to better naming propositions!).

As long as it's in the journal, the initial SuperUser password is now readable for all users in the journal group instead of root and murmur only. In case that group is not equal with the murmur administrators, the password can be changed with the new wrapper.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Fits CONTRIBUTING.md.

@florianjacob
nixos/murmur: log to systemd journal
3bb11d8 
instead of /var/log/murmur/murmurd.log.
Achieved by having systemd run the daemon in foreground instead of
letting it fork to background.
@florianjacob
nixos/murmur: expose murmurd-service cli wrapper
7a36c96
@florianjacob
Copy link
Contributor Author

@GrahamcOfBorg test mumble

@GrahamcOfBorg
Copy link

No attempt on aarch64-linux (full log)

The following builds were skipped because they don't evaluate on aarch64-linux: tests.mumble

Partial log (click to expand)

Cannot nix-instantiate `tests.mumble' because:
error: while evaluating 'recursiveUpdate' at /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:415:26, called from /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:148:28:
while evaluating 'recursiveUpdateUntil' at /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:384:37, called from /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:416:5:
while evaluating 'zipAttrsWith' at /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:347:21, called from /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:394:8:
while evaluating 'zipAttrsWithNames' at /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:332:33, called from /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:347:27:
while evaluating the attribute 'mumble' at /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/nixos/tests/all-tests.nix:131:3:
while evaluating 'handleTest' at /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/nixos/tests/all-tests.nix:17:22, called from /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/nixos/tests/all-tests.nix:131:12:
while evaluating 'discoverTests' at /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/nixos/tests/all-tests.nix:13:19, called from /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/nixos/tests/all-tests.nix:18:5:
access to path '/nix/store/s6lni4rqrk98gdnzvdk7fvpwdf7c8y8d-grahamc-aarch64-community-22' is forbidden in restricted mode

@GrahamcOfBorg
Copy link

No attempt on x86_64-linux (full log)

The following builds were skipped because they don't evaluate on x86_64-linux: tests.mumble

Partial log (click to expand)

error: while evaluating 'recursiveUpdate' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:415:26, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:148:28:
while evaluating 'recursiveUpdateUntil' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:384:37, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:416:5:
while evaluating 'zipAttrsWith' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:347:21, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:394:8:
while evaluating 'zipAttrsWithNames' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:332:33, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:347:27:
while evaluating anonymous function at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/lists.nix:113:41, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:347:46:
while evaluating the attribute 'mumble' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/nixos/tests/all-tests.nix:131:3:
while evaluating 'handleTest' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/nixos/tests/all-tests.nix:17:22, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/nixos/tests/all-tests.nix:131:12:
while evaluating 'discoverTests' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/nixos/tests/all-tests.nix:13:19, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/nixos/tests/all-tests.nix:18:5:
access to path '/nix/store/3c1anc9ihqklylkpgfn5kjk35vr1safy-gleber-bastion' is forbidden in restricted mode

@florianjacob
Copy link
Contributor Author

florianjacob commented Nov 14, 2018 •
edited

Seems like I don't have the required permissions to run the tests through ofBorg, and when I try to run the tests locally I get a kernel panic, which does not seem to be related to the tests themselves, though. Probably issues with my nested virtualization setup or something.

@arianvp
Copy link
Member

arianvp commented Apr 10, 2019

@GrahamcOfBorg test mumble

aanderse
aanderse reviewed Apr 24, 2019
View reviewed changes
Copy link
Member

@aanderse aanderse left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Feel free to completely ignore my request to remove PermissionsStartOnly = true;... but it would be super awesome if you added an extra commit doing so! 😄

nixos/modules/services/networking/murmur.nix
@@ -251,19 +273,13 @@ in
after = [ "network-online.target "];

serviceConfig = {
Type = "forking";
Type = "simple";
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Simple is the default type so this isn't actually necessary.

nixos/modules/services/networking/murmur.nix
Restart = "always";
User = "murmur";
ExecStart = "${pkgs.murmur}/bin/murmurd -ini ${configFile}";
ExecStart = "${cli-wrapper}/bin/murmurd-service -fg";
PermissionsStartOnly = true;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know #56265 isn't related to this PR at all... but would you be willing to do me a solid and remove PermissionsStartOnly = true; in an extra commit here? It looks like the only other things to do would be to add StateDirectory = "murmur"; and remove the call to createHome = true; and you would be good to go...

@xaverdh
Copy link
Contributor

xaverdh commented Apr 12, 2020

Since #38775 was merged, I guess this can be closed now?

@ajs124 ajs124 closed this May 22, 2020
@florianjacob florianjacob deleted the murmur-journald branch July 17, 2022 21:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@aanderse aanderse aanderse left review comments

@infinisil infinisil Awaiting requested review from infinisil

Assignees
No one assigned
Labels
6.topic: nixos 8.has: changelog 8.has: documentation 8.has: module (update) 10.rebuild-darwin: 0 10.rebuild-linux: 0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@florianjacob @GrahamcOfBorg @arianvp @xaverdh @aanderse @ajs124