From 97b0804a5f2d761946ee30a72c4640affb1394aa Mon Sep 17 00:00:00 2001 From: Marcos Date: Thu, 23 Jul 2026 02:24:02 -0300 Subject: [PATCH] fix: nginx falhando no firstboot por corrida com 15regen-sslcert MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit O nginx pode subir enquanto o hook comum 15regen-sslcert regenera o par cert/chave e ler um par inconsistente (SSL key values mismatch); como o hook só reinicia serviços ativos, o nginx ficava failed até intervenção manual. Duas camadas: drop-in com Restart=on-failure (auto-recupera sozinho ~10s após a regeneração) e restart incondicional do nginx no fim do inithook do opencloud. --- changelog | 4 ++++ .../etc/systemd/system/nginx.service.d/opencloud.conf | 10 ++++++++++ overlay/usr/lib/inithooks/bin/opencloud.py | 4 ++++ 3 files changed, 18 insertions(+) create mode 100644 overlay/etc/systemd/system/nginx.service.d/opencloud.conf diff --git a/changelog b/changelog index fb052f3..9120e81 100644 --- a/changelog +++ b/changelog @@ -15,4 +15,8 @@ turnkey-opencloud-18.1 (1) turnkey; urgency=low * Firstboot inithooks: regenerate build-time secrets (opencloud.yaml), set admin password and domain (interactive or preseeded). + * Fix nginx failing at firstboot (cert/key mismatch race with the common + 15regen-sslcert hook): nginx drop-in with Restart=on-failure and an + unconditional nginx restart at the end of the opencloud inithook. + -- POP Solutions Tue, 21 Jul 2026 20:30:00 +0000 diff --git a/overlay/etc/systemd/system/nginx.service.d/opencloud.conf b/overlay/etc/systemd/system/nginx.service.d/opencloud.conf new file mode 100644 index 0000000..ed1581d --- /dev/null +++ b/overlay/etc/systemd/system/nginx.service.d/opencloud.conf @@ -0,0 +1,10 @@ +# Firstboot: 15regen-sslcert regenerates the TLS cert/key while nginx may be +# starting; reading a mid-regen mismatched pair fails the unit, and the +# regen hook only restarts services that are still active. Keep retrying so +# nginx comes up on its own once the pair is consistent. +[Unit] +StartLimitIntervalSec=0 + +[Service] +Restart=on-failure +RestartSec=10 diff --git a/overlay/usr/lib/inithooks/bin/opencloud.py b/overlay/usr/lib/inithooks/bin/opencloud.py index c00546d..d9058b3 100755 --- a/overlay/usr/lib/inithooks/bin/opencloud.py +++ b/overlay/usr/lib/inithooks/bin/opencloud.py @@ -101,6 +101,10 @@ def set_domain(domain: str) -> None: # unconditional restart: 20regen-opencloud-secrets stopped the service, # so try-restart would be a no-op and leave OpenCloud down subprocess.run(["systemctl", "restart", "opencloud"], check=False) + # nginx can fail at boot if it starts while 15regen-sslcert is mid-way + # through regenerating the cert/key pair (mismatch); the common hook only + # restarts services that are still active, so recover it here + subprocess.run(["systemctl", "restart", "nginx"], check=False) def main():