From de5c2f2ebbb1936c21799799f877d451dd21707b Mon Sep 17 00:00:00 2001 From: CyberMind-FR Date: Tue, 14 Jul 2026 09:04:52 +0200 Subject: [PATCH] =?UTF-8?q?fix(podcaster):=20socket-ownership=20race=20lef?= =?UTF-8?q?t=20podcaster.sock=20root:root=20=E2=86=92=20nginx=20502?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The unit chowned the socket in an ExecStartPost gated only by `sleep 1`. uvicorn can take several seconds to bind the UDS, so the chown ran before the socket existed (silently, via the `-` prefix) and it stayed root:root — which nginx (not root) cannot open, so every podcaster request 502'd after a restart. A naive poll didn't help either: it found the STALE socket from the previous run, chowned that, and uvicorn then re-bound a fresh root:root socket. Fix: ExecStartPre removes the stale socket first, and ExecStartPost polls up to ~15s for the genuinely-new socket before chmod/chown. Socket is now reliably secubox:secubox on start. Verified live: owner settles secubox:secubox and nginx serves /api/v1/podcaster/status 200. Co-Authored-By: Gerald KERMA --- .../systemd/secubox-podcaster.service | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/packages/secubox-podcaster/systemd/secubox-podcaster.service b/packages/secubox-podcaster/systemd/secubox-podcaster.service index 52b61ea2..6d504021 100644 --- a/packages/secubox-podcaster/systemd/secubox-podcaster.service +++ b/packages/secubox-podcaster/systemd/secubox-podcaster.service @@ -8,11 +8,16 @@ Type=simple User=root Group=root WorkingDirectory=/usr/share/secubox/podcaster +# Remove any stale socket first, so the ExecStartPost poll below waits for the +# genuinely-new socket uvicorn binds — not a leftover one it would chown before +# uvicorn re-creates it root:root (the actual cause of the nginx 502s). +ExecStartPre=-/bin/rm -f /run/secubox/podcaster.sock ExecStart=/usr/bin/python3 -m uvicorn api.main:app --uds /run/secubox/podcaster.sock --workers 1 # #494: only chmod/chown our OWN socket — never the shared /run/secubox parent. -ExecStartPost=-/bin/sleep 1 -ExecStartPost=-/bin/chmod 660 /run/secubox/podcaster.sock -ExecStartPost=-/bin/chown secubox:secubox /run/secubox/podcaster.sock +# Poll for the socket instead of a fixed `sleep 1`: uvicorn can take several +# seconds to bind the UDS, and a premature chown silently fails (leaving the +# socket root:root → nginx 502). Wait up to ~15s, then set ownership. +ExecStartPost=-/bin/sh -c 'for i in $(seq 1 150); do [ -S /run/secubox/podcaster.sock ] && break; sleep 0.1; done; chmod 660 /run/secubox/podcaster.sock; chown secubox:secubox /run/secubox/podcaster.sock' Restart=on-failure RestartSec=5