customer-engineering/wallarm
3
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

feat: systemd PrivateMounts bind-mount isolation, port offsets kept

Browse source
This commit is contained in:
admin 2026-08-03 12:58:35 +00:00
parent c8fd8bc37e
commit 06c1ecfe85
1 changed files with 9 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
python/deploy.py
View file

@ -161,31 +161,29 @@ http {{
run(f"cp -a {DEPLOY_TO} {instance}", timeout=30) run(f"cp -a {DEPLOY_TO} {instance}", timeout=30)
shutil.rmtree(DEPLOY_TO, ignore_errors=True) shutil.rmtree(DEPLOY_TO, ignore_errors=True)
# Patch paths + ports # PrivateMounts handles filesystem isolation (/opt/wallarm == instance dir)
# Still need port offsets for internal services (wstore, api-firewall)
offset = hash_port(instance) offset = hash_port(instance)
for pattern in ("*.sh", "*.list", "*.conf", "*.yaml", "*.yml"): for pattern in ("*.yaml", "*.yml", "*.conf"):
for f in Path(instance).rglob(pattern): for f in Path(instance).rglob(pattern):
content = f.read_text() content = f.read_text()
content = content.replace("/opt/wallarm", instance)
for port_num in (3313, 6388, 9001, 8088, 9667, 6060, 5005): for port_num in (3313, 6388, 9001, 8088, 9667, 6060, 5005):
content = content.replace(f":{port_num}", f":{port_num + offset}") content = content.replace(f":{port_num}", f":{port_num + offset}")
f.write_text(content) f.write_text(content)
# Add -cfg flag to wcli so it reads its own node.yaml
for conf in Path(f"{instance}/etc").glob("*.conf"):
c = conf.read_text()
if "wcli run" in c and "-cfg" not in c:
conf.write_text(c.replace("wcli run", f"wcli run -cfg {instance}/etc/wallarm/node.yaml"))
# Systemd # Systemd
# Systemd template with private /opt/wallarm per instance
tmpl = f"""[Unit] tmpl = f"""[Unit]
Description=Wallarm Node - %i Description=Wallarm Node - %i
After=network.target After=network.target
[Service] [Service]
Type=simple Type=simple
WorkingDirectory={BASE}/%i/wallarm WorkingDirectory={BASE}/%i/wallarm
EnvironmentFile=-{BASE}/%i/wallarm/env.list EnvironmentFile=-{BASE}/%i/wallarm/env.list
ExecStartPre=/bin/ln -sf {BASE}/%i/wallarm /opt/wallarm # Private mount namespace isolates /opt/wallarm per instance
PrivateMounts=yes
ExecStartPre=/bin/mount --bind {BASE}/%i/wallarm /opt/wallarm
ExecStartPre=-{BASE}/%i/wallarm/nginx/sbin/nginx -c {BASE}/%i/wallarm/nginx/conf/nginx.conf ExecStartPre=-{BASE}/%i/wallarm/nginx/sbin/nginx -c {BASE}/%i/wallarm/nginx/conf/nginx.conf
ExecStartPre=/bin/sleep 1 ExecStartPre=/bin/sleep 1
ExecStart={BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervisord -c {BASE}/%i/wallarm/etc/supervisord.conf ExecStart={BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervisord -c {BASE}/%i/wallarm/etc/supervisord.conf
@ -193,6 +191,7 @@ ExecStop={BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervis
Restart=on-failure Restart=on-failure
RestartSec=5 RestartSec=5
User=root User=root
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target
""" """