tickets #169012
openCachet bootstrap and sync complete chaos
0%
Description
While trying to move status.o.o from status2 to status1 I found several problems. The documentation at https://progress.opensuse.org/projects/opensuse-admin-wiki/wiki/Statusopensuseorg is a bit outdated, but that was the least of my issues.
- the copy scripts /root/bin/prepare_other_status.sh and /root/bin/restore_config.sh use outdated certificate logic (=> commented out) and wrong hardcoded target hosts (tried to sync to itself => corrected)
- the copy script relies on a MariaDB backup done via mysql-backupscript, which was broken (
mysql-backupscript[31254]: /usr/bin/mariadb-admin: unknown variable 'database=cachet') => commented out "database" line in ~/.my.cnf - the target database on status1 did not exist (it seemed like an empty MariaDB installation) => created "cachet" database as per README.SUSE
- no Cachet configuration was present at /etc/Cachet/.env on status1 => copied from status2
- the bootstrap instructions in README.SUSE miss instructions to change directory and reference a path which do not exist
- bootstrapping Cachet does not work, cd /usr/share/php/Cachet (the correct path) and running
php artisan migratetries to connect to some SQLite database, seemingly ignoring the MySQL configuration in the .env file => I could not figure out why (strace did not yield anything useful, and the database logic in the PHP libraries is rather complicated) - reinstallating the Cachet package tries to replace php7 with php8 (which is not compatible with Cachet) seemingly, due to requiring a "Cachet-http" package (which is listed as "Requires" in the .spec file), but this sub (?) package does not exist
- as a result of the two previous points I eventually - very ugly - rsync'd /usr/share/php/Cachet from status2 to status1. This then made it respect the .env file and run the migrations on the fresh database
- /root/bin/restore_config.sh too references a Cachet path which does not exist => corrected to /usr/share/php/Cachet
- /root/bin/restore_config.sh calls
php artisan app:updatewhich fails withLinks are not supported, encountered link at /usr/share/php/Cachet/vendor/laravel/framework/src/Illuminate/Mail/resources/views/html/message.blade.php, which indeed is a symlink:/usr/share/php/Cachet/vendor/laravel/framework/src/Illuminate/Mail/resources/views/html/message.blade.php -> ../markdown/message.blade.php=> tried to replace it with a copy of the file, but it would subsequently complain about further files => again, very ugly:find vendor -type l -exec sh -c 'LINK=$0; TARGET=$(readlink -e $0); echo "$LINK => $TARGET"; rm $LINK; cp $TARGET $LINK' {} \;=> this made app:update work - /etc/apache2/conf.d/cachet.conf, /etc/apache2/vhosts.d/Cachet.conf and /etc/apache2/vhosts.d/ssl_status.opensuse.org.inc missing on status1 => copied from status2
- ssl_status.opensuse.org.inc SSLOpenSSLConfCmd references dhparams which do not exist => commented out as it's using an ECDSA certificate
- various needed httpd modules were not enabled => copied /etc/sysconfig/apache2 from status2 to status1
curl -i -H 'Host: status.opensuse.org' -k https://localhoston status1 yields a 500, but works on status2, no entry in /var/log/apache2/error_log- the Cachet-config-apache package ships things which do not seem related to apache
Updated by crameleon 4 months ago
Got a bit further, now it tries to redirect to /setup, but that yields 404 (at least with curl). I then tried to import the database again mariadb cachet < /import/mysql/20241028/cachet.sql (which took an eternity, I thought restore_config.sh had done it, but I guess not, as that script always returned rather quickly) , afterwards the curl yields 500 again.
Updated by crameleon 4 months ago
- Status changed from New to In Progress
- Assignee set to crameleon
Submitted https://build.opensuse.org/request/show/1219205 to make the package functional again, it still has various issues, for example one should go through the rpmlint duplicate file complains and see which ones are really relevant for the Laravel issue, and the apache2 subpackage should be cleaned up to not be a core dependency of the software. But that should be done as a separate improvement.
Updated by crameleon 4 months ago
Relocation of status.o.o to status1 succeeded now, some more issues with actually serving it, it seems it was directly exposed to the internet in the past but now is behind ipx-proxy1 which had a severely outdated (unsalted.. https://progress.opensuse.org/issues/151124) HAProxy configuration missing the needed listen blocks. I tried to adjust it but eventually purged it and wrote a minimal one which just acts as a TCP proxy for 80/443 to the status1.i.o.o backend as the backend already had the needed TLS setup and the automatic certificates from our central server. Once this proxy gets reconfigured properly with Salt it should of course be a HTTP/HTTPS proxy again, but for now this setup makes it simple enough given it does not currently serve any other backends.
DNS adjusted:
-status.opensuse.org 3600 IN CNAME status2.opensuse.org
+status.opensuse.org 3600 IN CNAME proxy-ipx1.opensuse.org