glusterfs service: a few fixes and improvements #29868
Conversation
…get. This introduces dependency cycles. A network file system to be running is not required for a network connection to be available. NixOS@19759cf#commitcomment-22044519
| @@ -41,6 +41,18 @@ in | |||
| default = "INFO"; | |||
| }; | |||
|
|
|||
| useRpcbind = mkOption { | |||
| type = types.bool; | |||
| description = "Enable use of rpcbind. This is required for Gluster's NFS functionality. You may want to turn it off to reduce the attack surface for DDoS reflection attacks. See https://davelozier.com/glusterfs-and-rpcbind-portmap-ddos-reflection-attacks/ and https://bugzilla.redhat.com/show_bug.cgi?id=1426842 for details."; | |||
There was a problem hiding this comment.
@globin Done, also for the other commit.
nh2
force-pushed
the
nh2-glusterfs-improvements-for-17.09-master
branch
from
590cf7c
to
ed2d5f3
Compare
| set this to 'control-group'. | ||
| ''; | ||
| default = "process"; | ||
| }; |
There was a problem hiding this comment.
Does this need to be configurable? If yes give a quick description in which cases the different modes might be useful.
There was a problem hiding this comment.
@bachp Updated; I have now described both typical use cases.
I have also added a commit that changes the default to control-group, as you and me both think that this is the better default (from #27340 (comment)).
Prevents glustereventsd failing at startup in case it starts before glusterd has started (whose `preStart` would also create the needed directory).
This is a better default for NixOS because it ensures that config changes happen fully when NixOS users expect it.
nh2
force-pushed
the
nh2-glusterfs-improvements-for-17.09-master
branch
from
ed2d5f3
to
18eecae
Compare
|
Copying into main conversation so it doesn't get hidden by I have also added a commit that changes the default to |
|
This is good to go from my side. Once this is merged, we should switftly go on to #29062, so that we can have a good gluster 3.12 experience on NixOS 17.09. |
FRidh
changed the title
Motivation for this change
These commits fix issues I found in my production cluster; see their commit messages for individual motivations.
These are the changes I promised in #27340 (comment).
Things done
build-use-sandboxinnix.confon non-NixOS)nix-shell -p nox --run "nox-review wip"./result/bin/)FYI @bachp who's another user of this service.
CC @joachifm