Refs #29144 - Use systemd socket activation

[ekohl]

When using systemd socket activation, it's important that the ListenSocket matches what Puma binds on. Otherwise it may fail. This happens when is configured on [::]:3000 (dual stack) and Puma on 0.0.0.0:3000. Puma will then attempt to bind and fail because the port is already in use.

The service bind is now made explicit because systemd's ListenSocket=3000 binds on :: where Puma by default binds on 0.0.0.0:3000. This is IPv4-only, but is what was done prior to this as well. Apache is configured dual stack and the recommended deployment.

Note this depends on theforeman/foreman#7536 and theforeman/foreman-packaging#4894 (deb) / theforeman/foreman-packaging#4895 (rpm).

[ehelms]

Was curious why we call this installer.conf ?

[ekohl]

We already did this before, but since you can't define systemd::dropin_file twice with 'installer.conf' I had to be explicit. This creates /etc/systemd/system/foreman.service.d/installer.conf and I thought this was the most logical name for it. systemctl cat foreman shows you how it would look like:

# /usr/lib/systemd/system/foreman.service
[Unit]
Description=Foreman
Documentation=https://theforeman.org
After=network.target remote-fs.target nss-lookup.target
Requires=foreman.socket

[Service]
Type=simple
User=foreman
TimeoutSec=300
WorkingDirectory=/usr/share/foreman
ExecStart=/usr/share/foreman/bin/rails server --environment $FOREMAN_ENV --port $FOREMAN_PORT --binding $FOREMAN_BIND
Environment=FOREMAN_ENV=production FOREMAN_PORT=3000 FOREMAN_BIND=0.0.0.0

SyslogIdentifier=foreman

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/foreman.service.d/installer.conf
[Service]
User=foreman
Environment=FOREMAN_ENV=production
Environment=FOREMAN_HOME=/usr/share/foreman
Environment=FOREMAN_BIND=127.0.0.1
Environment=FOREMAN_PORT=3000
Environment=FOREMAN_PUMA_THREADS_MIN=0
Environment=FOREMAN_PUMA_THREADS_MAX=16
Environment=FOREMAN_PUMA_WORKERS=2

[ekohl]

I've updated it to reuse $listen_socket in the Apache reverse proxy config. This makes it even clearer that these are directly linked. In a later iteration we can have a look at using unix sockets which can prevent attacks (currently anyone on the local host can send HTTP(S) headers impersonating hosts)

[ehelms]

Looks like a linting error

[ekohl]

voxpupuli/puppet-lint-unquoted_string-check#4 is the lint issue.

[ehelms]

Hrmm, can we work around it for now?

[ekohl]

voxpupuli/puppet-lint-unquoted_string-check#9 is the bugfix. Working on releasing a fix for it.

[ekohl]

Restarted the failed tests now that the new version is out.

[mmoll]

tests fail 💔

[ekohl]

I wonder why https://travis-ci.org/github/theforeman/puppet-foreman/builds/666888226 is not in the status checks

[ehelms]

Seems Travis might be having a rough time

[ekohl]

💚 now

[ekohl]

I'm not entirely sure if this is breaking or not. I think it still works on Foreman 2.0 since we don't manage foreman.socket. However, perhaps we need to. Labeled as enhancement for now.