tcjlj/OpenFlare
1
0
Fork 0
mirror of https://github.com/Rain-kl/OpenFlare.git synced 2026-10-07 16:16:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(agent): unify agent and openresty runtime user as openflare

Browse Source 
Introduce the shared openflare service account for the agent process and
OpenResty workers, normalize data_dir ownership on startup, and ensure
managed paths are chowned with 0755/0644 during sync and apply. Docker
entrypoint fixes volume ownership before dropping privileges; local systemd
install runs the service as openflare with CAP_NET_BIND_SERVICE.
This commit is contained in:
ryan
2026-06-21 14:25:20 +08:00
parent ee047cb351
commit d3777eac2d
17 changed files with 505 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/apps/agent/sync/pages.go
+8 -6
View File
@@ -24,6 +24,7 @@ import (
const (
pagesMaxExtractedFileBytes = 100 * 1024 * 1024
pagesDirPerm = 0o755
pagesFilePerm = 0o644
pagesManifestFilePerm = 0o644
)
@@ -137,6 +138,11 @@ func (s *Service) syncPagesDeployments(ctx context.Context, snapshot *state.Snap
return err
}
}
if s.nginxManager != nil {
if err := s.nginxManager.EnsureWorkerReadAccess(); err != nil {
return fmt.Errorf("ensure openresty worker read access: %w", err)
}
}
return nil
}
@@ -333,7 +339,7 @@ func extractPagesFile(item *zip.File, targetPath string) error {
return err
}
defer func() { _ = source.Close() }()
target, err := os.OpenFile(targetPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, item.FileInfo().Mode().Perm()) //nolint:gosec // targetPath is under managed PagesDir from validated zip entry
target, err := os.OpenFile(targetPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, pagesFilePerm) //nolint:gosec // targetPath is under managed PagesDir from validated zip entry
if err != nil {
return err
}
@@ -416,10 +422,6 @@ func copyPagesDir(sourceDir string, targetDir string) error {
if entry.IsDir() {
return os.MkdirAll(targetPath, pagesDirPerm)
}
info, err := entry.Info()
if err != nil {
return err
}
input, err := os.Open(sourcePath) //nolint:gosec // sourcePath is under managed PagesDir walk root
if err != nil {
return err
@@ -428,7 +430,7 @@ func copyPagesDir(sourceDir string, targetDir string) error {
if err := os.MkdirAll(filepath.Dir(targetPath), pagesDirPerm); err != nil {
return err
}
output, err := os.OpenFile(targetPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, info.Mode().Perm()) //nolint:gosec // targetPath is under managed PagesDir walk root
output, err := os.OpenFile(targetPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, pagesFilePerm) //nolint:gosec // targetPath is under managed PagesDir walk root
if err != nil {
return err
}