systemd: integrate http module with systemd

diff --git a/distro/arch/PKGBUILD b/distro/arch/PKGBUILD
index 919ee87ab63a825fac3964664b0f64dbd7408a58..94080fddd50c4ffe96406df9f70f4428c8e60b25 100644 (file)
--- a/distro/arch/PKGBUILD
+++ b/distro/arch/PKGBUILD
@@ -62,9 +62,14 @@ package() {
     DESTDIR=${pkgdir} ninja -C build_arch install
 
     # add kresd.target to multi-user.target.wants to support enabling kresd services
-    install -dm 0755 "${pkgdir}/usr/lib/systemd/system/multi-user.target.wants"
+    install -d -m 0755 "${pkgdir}/usr/lib/systemd/system/multi-user.target.wants"
     ln -s ../kresd.target "${pkgdir}/usr/lib/systemd/system/multi-user.target.wants/kresd.target"
 
+    # mask kresd-doh.socket, kresd-webmgmt.socket by default (unmask if using http module)
+    install -d -m 0755 "${pkgdir}/etc/systemd/system"
+    ln -s /dev/null "${pkgdir}/etc/systemd/system/kresd-doh.socket"
+    ln -s /dev/null "${pkgdir}/etc/systemd/system/kresd-webmgmt.socket"
+
     # remove modules with missing dependencies
     rm "${pkgdir}/usr/lib/knot-resolver/kres_modules/etcd.lua"
 }

diff --git a/distro/deb/control b/distro/deb/control
index 7640d3d5bbf93e11946dc4b1d85a7b4f27a54eea..3120d375d291f1dd86d14c2d964d5aced74591c2 100644 (file)
--- a/distro/deb/control
+++ b/distro/deb/control
@@ -62,11 +62,13 @@ Description: caching, DNSSEC-validating DNS resolver
 Package: knot-resolver-module-http
 Architecture: all
 Depends:
+ knot-resolver,
  libjs-bootstrap,
  libjs-d3,
  libjs-jquery,
  lua-http,
  lua-mmdb,
+ systemd,
  ${misc:Depends},
  ${shlibs:Depends},
 Breaks:

diff --git a/distro/deb/knot-resolver-module-http.install b/distro/deb/knot-resolver-module-http.install
index ffa04d01a9ad5bdb273b3d9d2154e15644975382..75cb9f40fe82bf3ba5e5de619d07c9da2ece0705 100644 (file)
--- a/distro/deb/knot-resolver-module-http.install
+++ b/distro/deb/knot-resolver-module-http.install
@@ -1,3 +1,6 @@
+usr/lib/systemd/system/kresd@.service.d/module-http.conf lib/systemd/system/kresd@.service.d/
+usr/lib/systemd/system/kresd-doh.socket lib/systemd/system/
+usr/lib/systemd/system/kresd-webmgmt.socket lib/systemd/system/
 usr/lib/knot-resolver/kres_modules/http*.lua
 usr/lib/knot-resolver/kres_modules/prometheus.lua
 usr/lib/knot-resolver/kres_modules/http/*.css

diff --git a/distro/deb/knot-resolver-module-http.links b/distro/deb/knot-resolver-module-http.links
index 4963c5cb946ecde4732e18a4c63bd59067958c1a..bf86610c2508cfc835193b33c2b42ab409e72252 100644 (file)
--- a/distro/deb/knot-resolver-module-http.links
+++ b/distro/deb/knot-resolver-module-http.links
@@ -1,3 +1,4 @@
+dev/null etc/systemd/system/kresd-doh.socket
 usr/share/javascript/bootstrap/css/bootstrap-theme.min.css usr/lib/knot-resolver/kres_modules/http/bootstrap-theme.min.css
 usr/share/javascript/bootstrap/css/bootstrap.min.css usr/lib/knot-resolver/kres_modules/http/bootstrap.min.css
 usr/share/javascript/bootstrap/js/bootstrap.min.js usr/lib/knot-resolver/kres_modules/http/bootstrap.min.js

diff --git a/distro/deb/knot-resolver.dirs b/distro/deb/knot-resolver.dirs
index bb5a4f1f6903a621bef855ca90373e5cd74124a1..975e769fe6fade2c4cd3d2551d0ca114fec5e9a6 100644 (file)
--- a/distro/deb/knot-resolver.dirs
+++ b/distro/deb/knot-resolver.dirs
@@ -1 +1,2 @@
+/lib/systemd/system/kresd@.service.d
 /var/lib/knot-resolver

diff --git a/distro/deb/knot-resolver.install b/distro/deb/knot-resolver.install
index db72f30b86a4079f723f057e9bda9dfde2087f42..88bfff2afa786966180fba0eb6665d1114204c71 100644 (file)
--- a/distro/deb/knot-resolver.install
+++ b/distro/deb/knot-resolver.install
@@ -1,5 +1,9 @@
 etc/knot-resolver/kresd.conf
-usr/lib/systemd/system/* lib/systemd/system/
+usr/lib/systemd/system/kresd@.service lib/systemd/system/
+usr/lib/systemd/system/kresd.target lib/systemd/system/
+usr/lib/systemd/system/kresd.socket lib/systemd/system/
+usr/lib/systemd/system/kresd-tls.socket lib/systemd/system/
+usr/lib/systemd/system/kresd-control@.socket lib/systemd/system/
 usr/lib/*.so.*
 usr/lib/tmpfiles.d/knot-resolver.conf
 usr/lib/knot-resolver/*.so

diff --git a/distro/rpm/knot-resolver.spec b/distro/rpm/knot-resolver.spec
index 90f9cd494085d817e5aeda414fd943d0a841f2b3..5c4bc3c467b4f634ad7bf393bd30ab0f54640f13 100644 (file)
--- a/distro/rpm/knot-resolver.spec
+++ b/distro/rpm/knot-resolver.spec
@@ -117,6 +117,7 @@ Documentation for Knot Resolver
 %if "x%{?suse_version}" == "x"
 %package module-http
 Summary:        HTTP/2 module for Knot Resolver
+Requires:       knot-resolver
 %if 0%{?fedora}
 Requires:       compat-lua-http
 Requires:       compat-lua-mmdb
@@ -180,11 +181,21 @@ install -m 0750 -d %{buildroot}/run/%{name}
 
 # remove modules with missing dependencies
 rm %{buildroot}%{_libdir}/knot-resolver/kres_modules/etcd.lua
+
 %if 0%{?suse_version}
 rm %{buildroot}%{_libdir}/knot-resolver/kres_modules/experimental_dot_auth.lua
 rm -r %{buildroot}%{_libdir}/knot-resolver/kres_modules/http
 rm %{buildroot}%{_libdir}/knot-resolver/kres_modules/http*.lua
 rm %{buildroot}%{_libdir}/knot-resolver/kres_modules/prometheus.lua
+rm %{buildroot}%{_unitdir}/kresd@.service.d/module-http.conf
+rm %{buildroot}%{_unitdir}/kresd-doh.socket
+rm %{buildroot}%{_unitdir}/kresd-webmgmt.socket
+%endif
+
+%if 0%{?fedora}
+# mask kresd-doh.socket by default
+install -d -m 0755 %{buildroot}%{_sysconfdir}/systemd/system
+ln -s /dev/null %{buildroot}%{_sysconfdir}/systemd/system/kresd-doh.socket
 %endif
 
 # rename doc directory for centos, opensuse
@@ -228,12 +239,15 @@ getent passwd knot-resolver >/dev/null || useradd -r -g knot-resolver -d %{_sysc
 %attr(664,root,knot-resolver) %config(noreplace) %{_sysconfdir}/knot-resolver/root.keys
 %attr(644,root,knot-resolver) %config(noreplace) %{_sysconfdir}/knot-resolver/root.hints
 %attr(644,root,knot-resolver) %config(noreplace) %{_sysconfdir}/knot-resolver/icann-ca.pem
-%{_unitdir}/kresd*.service
+%{_unitdir}/kresd@.service
 %{_unitdir}/kresd.target
 %dir %{_unitdir}/multi-user.target.wants
 %{_unitdir}/multi-user.target.wants/kresd.target
 %if "x%{?rhel}" == "x"
-%{_unitdir}/kresd*.socket
+%dir %{_unitdir}/kresd@.service.d
+%{_unitdir}/kresd.socket
+%{_unitdir}/kresd-tls.socket
+%{_unitdir}/kresd-control@.socket
 %ghost /run/%{name}/
 %{_mandir}/man7/kresd.systemd.7.gz
 %else
@@ -285,6 +299,12 @@ getent passwd knot-resolver >/dev/null || useradd -r -g knot-resolver -d %{_sysc
 
 %if "x%{?suse_version}" == "x"
 %files module-http
+%if 0%{?fedora}
+%{_unitdir}/kresd@.service.d/module-http.conf
+%{_unitdir}/kresd-doh.socket
+%{_sysconfdir}/systemd/system/kresd-doh.socket
+%{_unitdir}/kresd-webmgmt.socket
+%endif
 %{_libdir}/knot-resolver/kres_modules/http
 %{_libdir}/knot-resolver/kres_modules/http*.lua
 %{_libdir}/knot-resolver/kres_modules/prometheus.lua

diff --git a/systemd/kresd-doh.socket b/systemd/kresd-doh.socket
new file mode 100644 (file)
index 0000000..ec0dde5
--- /dev/null
+++ b/systemd/kresd-doh.socket
@@ -0,0 +1,17 @@
+[Unit]
+Description=Knot Resolver DNS-over-HTTPS socket
+Documentation=man:kresd.systemd(7)
+Documentation=man:kresd(8)
+Before=sockets.target
+
+[Socket]
+FreeBind=true
+BindIPv6Only=both
+FileDescriptorName=doh
+ListenStream=[::1]:443
+ListenStream=127.0.0.1:443
+Service=kresd@1.service
+Slice=system-kresd.slice
+
+[Install]
+WantedBy=sockets.target

diff --git a/systemd/kresd-doh.socket.d/all-interfaces.conf b/systemd/kresd-doh.socket.d/all-interfaces.conf
new file mode 100644 (file)
index 0000000..3a02aaf
--- /dev/null
+++ b/systemd/kresd-doh.socket.d/all-interfaces.conf
@@ -0,0 +1,11 @@
+# /etc/systemd/system/kresd-doh.socket.d/override.conf
+
+# Configure kresd-doh.socket to listen on all IPv4 and IPv6 interfaces.
+
+# Empty ListenStream= directive is required to avoid port clash with default
+# localhost. If you've disabled IPv6 support in kernel, use 0.0.0.0 instead of
+# [::]
+
+[Socket]
+ListenStream=
+ListenStream=[::]:44353

diff --git a/systemd/kresd-doh.socket.d/specific-interfaces.conf b/systemd/kresd-doh.socket.d/specific-interfaces.conf
new file mode 100644 (file)
index 0000000..d4dab85
--- /dev/null
+++ b/systemd/kresd-doh.socket.d/specific-interfaces.conf
@@ -0,0 +1,9 @@
+# /etc/systemd/system/kresd-doh.socket.d/override.conf
+
+# Configure which interfaces should kresd-doh.socket listen on.
+
+# ListenStream can be added multiple times.
+
+[Socket]
+ListenStream=192.0.2.115:44353
+ListenStream=[2001:db8::115]:44353

diff --git a/systemd/kresd-tls.socket b/systemd/kresd-tls.socket
index 2847a1f2ecefa49b0ce5be60838bf1dbe2ce0d90..22cddcd8f9eef8c4c310065ba537825c3b2e8ec1 100644 (file)
--- a/systemd/kresd-tls.socket
+++ b/systemd/kresd-tls.socket
@@ -1,5 +1,5 @@
 [Unit]
-Description=Knot Resolver TLS network listener
+Description=Knot Resolver DNS-over-TLS socket
 Documentation=man:kresd.systemd(7)
 Documentation=man:kresd(8)
 Before=sockets.target

diff --git a/systemd/kresd-webmgmt.socket b/systemd/kresd-webmgmt.socket
new file mode 100644 (file)
index 0000000..1106bb9
--- /dev/null
+++ b/systemd/kresd-webmgmt.socket
@@ -0,0 +1,17 @@
+[Unit]
+Description=Knot Resolver web management and API socket
+Documentation=man:kresd.systemd(7)
+Documentation=man:kresd(8)
+Before=sockets.target
+
+[Socket]
+FreeBind=true
+BindIPv6Only=both
+FileDescriptorName=webmgmt
+ListenStream=[::1]:8453
+ListenStream=127.0.0.1:8453
+Service=kresd@1.service
+Slice=system-kresd.slice
+
+[Install]
+WantedBy=sockets.target

diff --git a/systemd/kresd.socket b/systemd/kresd.socket
index 8f263ef9eb9029fe352df9f6d92db3a39b1c9f10..cf844b733a9f10505055819a37be6610ee2fa63b 100644 (file)
--- a/systemd/kresd.socket
+++ b/systemd/kresd.socket
@@ -1,5 +1,5 @@
 [Unit]
-Description=Knot Resolver network listeners
+Description=Knot Resolver DNS socket
 Documentation=man:kresd.systemd(7)
 Documentation=man:kresd(8)
 Before=sockets.target
@@ -7,6 +7,7 @@ Before=sockets.target
 [Socket]
 FreeBind=true
 BindIPv6Only=both
+FileDescriptorName=dns
 ListenDatagram=[::1]:53
 ListenStream=[::1]:53
 ListenDatagram=127.0.0.1:53

diff --git a/systemd/kresd.systemd.7.in b/systemd/kresd.systemd.7.in
index a3405e7e365e0128176378f393d31889e6988757..758341864ceb6dab1a24ff2f399aa5ce7e2d04ef 100644 (file)
--- a/systemd/kresd.systemd.7.in
+++ b/systemd/kresd.systemd.7.in
@@ -17,6 +17,8 @@ kresd@.service
 kresd.socket
 kresd-tls.socket
 kresd-control@.socket
+kresd-doh.socket
+kresd-webmgmt.socket
 kresd.target
 system-kresd.slice
 .fi
@@ -34,14 +36,16 @@ additional capabilities. The network interface sockets are created by systemd
 and then passed to the daemon.
 
 Network configuration has to take place in \fIsystemd.socket(5)\fR, which can
-be done using drop-in files.  Each instance of \fIkresd@.service\fR has three
-systemd sockets associated with it:
+be done using drop-in files.  Each instance of \fIkresd@.service\fR may have
+these systemd sockets associated with it:
 
 .nf
 .RS
 \fIkresd.socket\fR - UDP/TCP network socket (default: localhost:53)
 \fIkresd-tls.socket\fR - network socket for DNS-over-TLS (default: localhost:853)
 \fIkresd-control@.socket\fR - UNIX socket with control terminal
+\fIkresd-doh.socket\fR - DNS-over-HTTPS (with http module: localhost:44353)
+\fIkresd-webmgmt.socket\fR - web management and APIs (with http module: localhost:8453)
 .RE
 .fi
 
@@ -54,6 +58,7 @@ To configure \fBkresd\fR to listen on public interfaces, drop-in files (see
 .RS 4n
 .B systemctl edit kresd.socket
 .B systemctl edit kresd-tls.socket
+.B systemctl edit kresd-doh.socket
 .RE
 .fi
 
@@ -163,7 +168,8 @@ the sockets:
 .RE
 .fi
 
-To disable the TLS socket, you can mask it:
+To disable optional sockets, you can mask them. For example, to disable
+DNS-over-TLS socket:
 
 .RS 4n
 .B systemctl mask kresd-tls.socket

diff --git a/systemd/kresd@.service.d/module-http.conf b/systemd/kresd@.service.d/module-http.conf
new file mode 100644 (file)
index 0000000..9534400
--- /dev/null
+++ b/systemd/kresd@.service.d/module-http.conf
@@ -0,0 +1,3 @@
+[Service]
+Sockets=kresd-doh.socket
+Sockets=kresd-webmgmt.socket

diff --git a/systemd/meson.build b/systemd/meson.build
index d013ae2913d140623df56b71fbb84512f836afc7..662a3ec29bd43b36ddfa0f42adecbd3a3a18370f 100644 (file)
--- a/systemd/meson.build
+++ b/systemd/meson.build
@@ -34,10 +34,18 @@ if systemd_files == 'enabled'
     sources: [
       'kresd.socket',
       'kresd-tls.socket',
+      'kresd-doh.socket',
+      'kresd-webmgmt.socket',
       'kresd.target',
     ],
     install_dir: systemd_unit_dir,
   )
+  install_data(
+    sources: [
+      'kresd@.service.d/module-http.conf',
+    ],
+    install_dir: join_paths(systemd_unit_dir, 'kresd@.service.d'),
+  )
 
   ## man page
   kresd_systemd_man = configure_file(
@@ -70,6 +78,13 @@ if systemd_files == 'enabled'
     ],
     install_dir: join_paths(examples_dir, 'kresd-tls.socket.d'),
   )
+  install_data(
+    sources: [
+      'kresd-doh.socket.d/all-interfaces.conf',
+      'kresd-doh.socket.d/specific-interfaces.conf',
+    ],
+    install_dir: join_paths(examples_dir, 'kresd-doh.socket.d'),
+  )
 elif systemd_files == 'nosocket'
   subdir('nosocket')
 endif