mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
ArjenandJohnathan Corgan
245b3d5f4b
Restart=on-failure with RestartSec=5 and systemd's default start limit (5 starts in 10 s) never trips: one start every 5 s or more stays under it, so a daemon whose start cannot succeed, such as one given an empty or invalid config, respawned every 5 s for as long as it was left, paying its full start-up cost each time. The fips and fips-gateway units in the tarball, .deb, AUR (which installs the .deb units) and NixOS module now set RestartSteps=5 and RestartMaxDelaySec=30. systemd grows the delay exponentially from RestartSec to the maximum over the steps, so successive automatic restarts wait 5 s, 7 s, 10 s, 15 s, 21 s and then 30 s each. The step count is systemd's restart counter, which a successful run does not clear: it is reset by a stop then start, a restart while the unit is running, or systemctl reset-failed, and not by a restart issued while the unit is waiting to restart. A unit that has backed off once therefore keeps the longer delay for later failures until one of those happens. The comments in the units say so. The units keep restarting without a limit: a start limit would leave a remote node down after a bad boot, and the mesh may be the only way to reach it. systemd before v254 ignores both keys with a warning and keeps the fixed 5 s delay. A packaging test checks that each tarball and .deb unit that restarts sets both keys, that the two copies of each unit agree on them, and that each NixOS service restarted on failure sets the same values as the unit of that name. Other supervisors are left as they are. fips-dns and fips-firewall are Type=oneshot units without Restart=. OpenWrt's procd init scripts, which stop respawning after more than 5 consecutive runs shorter than an hour, are changed separately to respawn without a limit. launchd throttles the macOS KeepAlive job by its default ThrottleInterval of 10 s. The Windows service is installed without recovery actions, so the service manager does not restart it, and the FreeBSD rc script runs daemon(8) without -r, so it does not restart either.
37 lines
1.2 KiB
Desktop File
37 lines
1.2 KiB
Desktop File
[Unit]
|
|
Description=FIPS Mesh Network Daemon
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/local/bin/fips --config /etc/fips/fips.yaml
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
# Back off between automatic restarts: 5s, 7s, 10s, 15s, 21s, then 30s. The
|
|
# step count is cleared by a stop then start, a restart while the unit is
|
|
# running, or systemctl reset-failed. A run that succeeds does not clear it,
|
|
# nor does a restart while the unit is waiting to restart. systemd before v254
|
|
# ignores these two keys and keeps the fixed 5s delay.
|
|
RestartSteps=5
|
|
RestartMaxDelaySec=30
|
|
|
|
# Control socket directory (/run/fips/).
|
|
# Group-accessible so 'fips' group members can use fipsctl/fipstop.
|
|
RuntimeDirectory=fips
|
|
RuntimeDirectoryMode=0750
|
|
|
|
# Log directory (/var/log/fips/), where the built-in tick-body profiler writes
|
|
# its capture files. Declared so systemd creates it on start and removes it on
|
|
# purge; the daemon runs as root and already has access without it.
|
|
LogsDirectory=fips
|
|
|
|
# Security hardening (daemon runs as root for TUN and raw sockets)
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=no
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|