secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 21:17:36 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix(podcaster): socket-ownership race left podcaster.sock root:root → nginx 502
Some checks failed
License Headers / check (push) Has been cancelled
Details

Browse Source 
The unit chowned the socket in an ExecStartPost gated only by `sleep 1`.
uvicorn can take several seconds to bind the UDS, so the chown ran before the
socket existed (silently, via the `-` prefix) and it stayed root:root — which
nginx (not root) cannot open, so every podcaster request 502'd after a restart.
A naive poll didn't help either: it found the STALE socket from the previous
run, chowned that, and uvicorn then re-bound a fresh root:root socket.

Fix: ExecStartPre removes the stale socket first, and ExecStartPost polls up to
~15s for the genuinely-new socket before chmod/chown. Socket is now reliably
secubox:secubox on start. Verified live: owner settles secubox:secubox and
nginx serves /api/v1/podcaster/status 200.

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
This commit is contained in:
CyberMind-FR 2026-07-14 09:04:52 +02:00
parent bfce737b1d
commit de5c2f2ebb
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
packages/secubox-podcaster/systemd/secubox-podcaster.service
View File

@ -8,11 +8,16 @@ Type=simple
User=root
Group=root
WorkingDirectory=/usr/share/secubox/podcaster
# Remove any stale socket first, so the ExecStartPost poll below waits for the
# genuinely-new socket uvicorn binds — not a leftover one it would chown before
# uvicorn re-creates it root:root (the actual cause of the nginx 502s).
ExecStartPre=-/bin/rm -f /run/secubox/podcaster.sock
ExecStart=/usr/bin/python3 -m uvicorn api.main:app --uds /run/secubox/podcaster.sock --workers 1
# #494: only chmod/chown our OWN socket — never the shared /run/secubox parent.
ExecStartPost=-/bin/sleep 1
ExecStartPost=-/bin/chmod 660 /run/secubox/podcaster.sock
ExecStartPost=-/bin/chown secubox:secubox /run/secubox/podcaster.sock
# Poll for the socket instead of a fixed `sleep 1`: uvicorn can take several
# seconds to bind the UDS, and a premature chown silently fails (leaving the
# socket root:root → nginx 502). Wait up to ~15s, then set ownership.
ExecStartPost=-/bin/sh -c 'for i in $(seq 1 150); do [ -S /run/secubox/podcaster.sock ] && break; sleep 0.1; done; chmod 660 /run/secubox/podcaster.sock; chown secubox:secubox /run/secubox/podcaster.sock'
Restart=on-failure
RestartSec=5