From 581b53d4477881e82c9e820b28f3cf2d3a2a6047 Mon Sep 17 00:00:00 2001 From: Slawomir Koszewski Date: Sat, 24 Oct 2026 21:32:00 +0200 Subject: [PATCH] fix: the web service manages users also when it started before setup. --- ADR.md | 6 ++++-- debian-package/debian/changelog | 10 ++++++++++ .../debian/vpn-router.vpn-router-web.service | 4 +++- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/ADR.md b/ADR.md index d2fa8fd..5552f6a 100644 --- a/ADR.md +++ b/ADR.md @@ -143,8 +143,10 @@ Decision: `vpnrouter_users.py` holds the user operations, the checks and a sessi lock and the connection of the user manager account. The web service imports it and maps a `Failure` to the HTTP status; `vpn-router-user` imports it and adds the argument parsing and the output, text for people and JSON with `--json`. The web unit allows writing the paths the -operations need: `/run/vpn-router` for the lock, `/etc/vpn-router/pki` for the certificates and -the CA's state, and `/etc/swanctl/x509crl` for the published CRL. +operations need: `/run/vpn-router` for the lock, its `RuntimeDirectory`, which systemd creates +before the service starts, also before setup has run, and keeps when it stops, as setup's state +files are there too; `/etc/vpn-router/pki` for the certificates and the CA's state, and +`/etc/swanctl/x509crl` for the published CRL. Consequences: The rules exist once. A request starts no process, and a password never leaves the process that received it. The web service imports `python3-ldap` and the package's diff --git a/debian-package/debian/changelog b/debian-package/debian/changelog index ae9edef..1902665 100644 --- a/debian-package/debian/changelog +++ b/debian-package/debian/changelog @@ -1,3 +1,13 @@ +vpn-router (0.12.2-1) unstable; urgency=medium + + fix: the web service manages users also when it started before setup. + + * vpn-router-web creates /run/vpn-router when it starts, so the user + operations take their lock there; started before vpn-router-setup had + made the directory, they failed with "Read-only file system". + + -- Slawomir Koszewski Sun, 25 Oct 2026 12:00:00 +0200 + vpn-router (0.12.1-1) unstable; urgency=medium fix: the status page shows whether the Router Manager runs. diff --git a/debian-package/debian/vpn-router.vpn-router-web.service b/debian-package/debian/vpn-router.vpn-router-web.service index 7277c7a..390bcbb 100644 --- a/debian-package/debian/vpn-router.vpn-router-web.service +++ b/debian-package/debian/vpn-router.vpn-router-web.service @@ -13,7 +13,9 @@ Restart=on-failure RestartSec=15 NoNewPrivileges=yes ProtectSystem=strict -ReadWritePaths=-/run/vpn-router -/etc/vpn-router -/etc/swanctl/x509crl +RuntimeDirectory=vpn-router +RuntimeDirectoryPreserve=yes +ReadWritePaths=-/etc/vpn-router -/etc/swanctl/x509crl ProtectHome=yes PrivateTmp=yes