Commit Graph
26 Commits
Author SHA1 Message Date
Joachim Wiberg 76cf464a01 ttyd: run on 127.0.0.1:8801 to allow nginx on 0.0.0.0:7681
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2024-04-15 15:36:41 +02:00
Joachim Wiberg 8bf78c2fbb board/common: relocate mkcert and fix openssl v3 x509 output
Not for public consumption.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2024-04-15 15:36:41 +02:00
Joachim Wiberg efec5f57cd confd: make web server and web console interface configurable
This commit adds an initial YANG model for Infix web services under the
infix-services.yang umbrella.  For now the nginx server statements in
/etc/nginx/nginx.conf are always on, but the backend ttyd, and the
entire nginx server can be disabled.

The default in the YANG model for both is disabled, the factory-config
has been updated to enable these services by default.

The Web Console Interface mDNS service has been updated to advertise
on port 7681, which nginx is set to forward to ttyd.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2024-04-15 15:36:41 +02:00
Joachim Wiberg fc7d9bacac board/common: enable ttyd, web console app
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2024-04-15 15:36:41 +02:00
Joachim Wiberg 28cf5525bf board/common: add mkcert, generates self-signed HTTPS certificate
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2024-04-15 15:36:41 +02:00
Joachim Wiberg 360d3b322d confd: use podman stop/start to prevent container corruption
Sending SIGTERM to conmon is not a safe shutdown of a podman container.
To handle gracefully handle shutdown, restarting and provide an orderly
start of dependencies, we use the Finit sysv trick via container script
wrapper to call 'podman stop foo'.

However, since podman does not support syslog as output for containers
we employ an old FIFO trick with another program, k8s-logger, to allow
logs to reach syslog.  Please note that k8s-logger must have properly
started before we call `podman start` -- this makes us fully dependent
on the 'container' wrapper script.  Hence the documentation update.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2024-02-25 19:49:27 +01:00
Joachim WibergandTobias Waldekranz d69f51a173 Fix #224: relocate /lib/infix to /libexec/infix
The /lib directory is not intended for executable scripts and programs.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2023-12-04 10:24:35 +01:00
Tobias Waldekranz f4a604f63c Prevent non-essential services from running in runlevels > 6
In case failure-config fails to load, we park the system in runlevel
9. In this state, we only want the most essential services running.
2023-11-30 11:39:42 +01:00
Tobias WaldekranzandJoachim Wiberg e1db5bad78 rauc: Start after D-Bus
On occasion, rauc has problems registering with D-Bus. Ensure that the
D-Bus daemon is running before starting rauc.
2023-11-25 20:37:15 +01:00
Tobias WaldekranzandJoachim Wiberg be728accbb rauc: Remove unsupported argument from finit service stanza
Fixes: 0f410eb ("rauc: add support for tftp:// for bundles and syslog for logging")
2023-11-25 20:37:15 +01:00
Tobias WaldekranzandJoachim Wiberg e53fd91c7f common: probe: Support default passwords on devicetree based systems
In addition to QEMU, we can now source the factory default password
from real VPD EEPROMs, on systems that use a devicetree.
2023-11-25 20:37:15 +01:00
Joachim Wiberg 0f410eb3b2 rauc: add support for tftp:// for bundles and syslog for logging
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2023-11-24 12:35:46 +01:00
Tobias Waldekranz 252b894d55 rauc: Source service arguments from /etc/default, if available
This is need by upcoming provisioning scripts.
2023-11-23 12:18:28 +01:00
Joachim WibergandMattias Walström 608f82afd6 Mark known services as 'notify:none', no readiness notification
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2023-11-13 10:28:47 +01:00
Joachim Wiberg b44e303775 board/common: basic feature probe
Currently does not need any conditions, but may later need to check for
loaded modules and other capabilities.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2023-10-12 16:35:00 +02:00
Joachim WibergandTobias Waldekranz b7c4c251ca board/common: Finit dbus.conf override behind <pid/syslogd>
This ensures dbus is not started before any udevadm call has completed.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2023-10-09 10:41:46 +02:00
Joachim WibergandTobias Waldekranz 5bad7f472f Guard system critical bootstrap services behind <pid/syslogd>
This ensures they do not start earlier than the system log daemon.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2023-10-09 10:41:46 +02:00
Joachim WibergandTobias Waldekranz acd33d4fa5 board/common: drop duplicate sshd.config and ssh-hostkeys
Instead, use the version from package/skeleton-init-finit, including the
ssh-hostkeys (previously ssh-genhostkeys) from the same package, because
it include extensive error handling and logging on failure.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2023-10-09 10:41:46 +02:00
Joachim WibergandRichard Alpe 72e388458d board/common: drop sshd.conf symlink, enabled by skeleton-init-finit
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2023-07-04 09:35:47 +02:00
Tobias WaldekranzandJoachim Wiberg c4b7b2aa65 rauc: Enable service
The RAUC service exports a D-Bus API that fits well with NETCONF's
notion of RPCs and notifications.
2023-06-30 15:33:10 +02:00
Tobias WaldekranzandJoachim Wiberg 32f6f22b47 common: Use IPv4/6 default configuration on all interfaces
The comment in the script has the story.
2023-05-12 14:24:41 +02:00
Joachim WibergandTobias Waldekranz 8158d3bffb Simplify and refine NETCONF and Classic build variants
- board/common: drop everything not needed by NETCONF mode
 - board/classic: most board/common helpers relocated here
 - Simplify Finit scripts for critical services
 - Source variant from /etc/os-release to select ramdisk /etc

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2023-04-27 09:59:35 +02:00
Joachim Wiberg 25db613398 Refactor boot mode handling
With the recent `if:<cond>` addition to Finit we can simplify a lot of
the logic for disabling and enabling features in Infix.  Standardizing
on conditions that Finit provides.

We create boot/netconf, boot/etc, and boot/profinet conditions early,
after all filesystems have been mounted (and cleaned), so they are all
set before Finit loads its configuration files in runlevel S.

The default is still to boot into a managed NETCONF mode, since the end
goal remains to integrate PROFINET as yet another service.  The other
mode, native /etc, should then be the only exception.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2023-03-08 20:02:03 +01:00
Tobias Waldekranz 61213c7c3c sshd: Move hostkeys to /var/lib/ssh
This means keys are persistent even when /etc is not.
2023-02-09 10:26:10 +01:00
Tobias Waldekranz 3036b08945 board/common: Split out iface renaming from swup
The factory config part of swup will now only run when in unmanaged
mode.
2023-02-09 09:43:15 +01:00
Joachim Wiberg 50493740e4 board/common: new script swup
Probe for switch ports, classify, rename interfaces according to mactab

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2022-12-20 16:32:21 +01:00