j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-10 12:16:49 +00:00
Code Issues Projects Releases Wiki Activity

fix(backup): TLS client certificates persist in Docker and are backed up

Browse source 
libvirt reads a TLS compute's client certificate from the panel user's
~/.pki/libvirt. In Docker that was /var/www/.pki inside the container,
so `docker compose up -d --build` dropped it and every TLS compute
stopped connecting; no backup held it on either install type, although
"Moving to a new machine" says the backup carries what the computes
accept, and the README never said where the certificates go.

Docker keeps /var/www/.pki in a webvirtcloud-pki volume, owned by
www-data and private like ~/.ssh; the backup copies ~/.pki into pki/;
the moving steps put it back; and "Adding a Compute Node" says where the
files go.
This commit is contained in:
catborise 2026-11-06 09:11:43 +03:00
parent 77f85832c9
commit 482f5bc16d
6 changed files with 33 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

9
appsettings/tests/test_backup.py
View file

@ -63,6 +63,15 @@ class BackupTests(SimpleTestCase):
self.assertEqual(oct((backup / "db.sqlite3").stat().st_mode & 0o777), "0o600")
self.assertEqual(oct((backup / "ssh/id_ed25519").stat().st_mode & 0o777), "0o600")
def test_a_backup_holds_the_tls_certificates_of_the_panel_user(self):
key = self.base / "home/.pki/libvirt/clientkey.pem"
key.parent.mkdir(parents=True)
key.write_text("tls key")
key.chmod(0o600)
copy = self.backup() / "pki/libvirt/clientkey.pem"
self.assertEqual(copy.read_text(), "tls key")
self.assertEqual(oct(copy.stat().st_mode & 0o777), "0o600")
def test_only_the_newest_backups_and_no_partial_one_are_kept(self):
for name in ("webvirtcloud-backup-20260101-000000", "webvirtcloud-backup-20260102-000000",
".webvirtcloud-backup-20260103-000000"):