Repository navigation
Fix systemd unit dropping the runtime environment (TLS off, no TURN) - #55
Merged
Merged
Conversation
The unit added in #54 read only .env, but deploy.sh computes TLS paths, ICE/TURN servers and the relay host at run time and exports them into the process it starts. systemd does not inherit those exports, so the server came up with PORT alone: [Signal] Signal Server listening on http://localhost:9090 Plain HTTP on the port every client reaches over wss://, and no TURN. Clients failed with an SSL version error and WebRTC could not fall back to a relay. deploy.sh now writes what it computes to /etc/signal-server-rs.env and the unit reads it alongside the secrets file. Also runs as root, matching the previous nohup deployment, since the TLS material it reads lives under /root/certs — the earlier User=azureuser could not have read it even with the paths set. StartLimitIntervalSec moves to [Unit], where systemd expects it; in [Service] it was logged as an unknown key and ignored.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The systemd unit I added in #54 took the signal server down. Fixing it, and being explicit about what went wrong.
What broke
deploy.shcomputes TLS certificate paths, ICE/TURN servers and the relay host at run time, thenexports them into the process it launches. systemd does not inherit those exports. My unit read only.env— which holds the long-lived secrets, not the computed values — so the server started with nothing butPORT:Plain HTTP on the port every client reaches over
wss://. Browsers failed withSSL routines::wrong version number, and withICE_SERVERS/TURN_SERVERalso missing, WebRTC had no relay to fall back to — hence[SSH-WebRTC] Connection state: failed.Fix
deploy.shwrites everything it computes to/etc/signal-server-rs.env(mode 600), and the unit reads it alongside the secrets file.User=azureuserwas wrong regardless of the env problem: the TLS material lives in/root/certs, whichazureusercannot traverse, so it could not have worked even with the paths supplied.ProtectHome=read-onlywould have blocked it too.StartLimitIntervalSecmoves to[Unit]. In[Service]systemd loggedUnknown key 'StartLimitIntervalSec' in section [Service], ignoring— so the restart-limit override I intended was never in effect.Already applied to the live server
I restored the running instance with an equivalent drop-in rather than waiting for this to merge, so it is serving HTTPS again with its gateways reconnected. Once this merges, a normal
deploy.shproduces the same result from the repo, and the drop-in at/etc/systemd/system/signal-server-rs.service.d/10-runtime.confcan be deleted.What I should have done
I shipped a unit I had explicitly flagged as never having been run, and it landed on production. The specific miss was assuming
.envheld the full environment when it holds only the secrets — visible from readingdeploy.sh's export block, which I had already read. A singlesystemctl show -p Environmentagainst a test run would have caught it.