j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-10 04:06:47 +00:00
Code Issues Projects Releases Wiki Activity

fix(backup): TLS client certificates persist in Docker and are backed up

Browse source 
libvirt reads a TLS compute's client certificate from the panel user's
~/.pki/libvirt. In Docker that was /var/www/.pki inside the container,
so `docker compose up -d --build` dropped it and every TLS compute
stopped connecting; no backup held it on either install type, although
"Moving to a new machine" says the backup carries what the computes
accept, and the README never said where the certificates go.

Docker keeps /var/www/.pki in a webvirtcloud-pki volume, owned by
www-data and private like ~/.ssh; the backup copies ~/.pki into pki/;
the moving steps put it back; and "Adding a Compute Node" says where the
files go.
This commit is contained in:
catborise 2026-11-06 09:11:43 +03:00
parent 77f85832c9
commit 482f5bc16d
6 changed files with 33 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

6
conf/runit/10_webvirtcloud_init.sh
View file

@ -3,7 +3,7 @@ set -e
APP_DIR="/srv/webvirtcloud"
DATA_DIR="$APP_DIR/data"
mkdir -p "$DATA_DIR" "/var/www/.ssh" "$APP_DIR/backups"
mkdir -p "$DATA_DIR" "/var/www/.ssh" "/var/www/.pki" "$APP_DIR/backups"
# If settings.py doesn't exist, generate from template
if [ ! -f "$APP_DIR/webvirtcloud/settings.py" ]; then
@ -32,9 +32,9 @@ echo "* Running database migrations..."
"$APP_DIR/venv/bin/python3" "$APP_DIR/manage.py" migrate --noinput
# Set proper permissions on runtime and data directories
chown -R www-data:www-data "$DATA_DIR" "/var/www/.ssh" "$APP_DIR/backups"
chown -R www-data:www-data "$DATA_DIR" "/var/www/.ssh" "/var/www/.pki" "$APP_DIR/backups"
chown www-data:www-data "$APP_DIR/webvirtcloud/settings.py" 2>/dev/null || true
chmod 700 "/var/www/.ssh" 2>/dev/null || true
chmod 700 "/var/www/.ssh" "/var/www/.pki" 2>/dev/null || true
# The database holds compute passwords and password hashes; keep it, the
# secret key and settings private to the app user (as the installer does)
chmod 700 "$DATA_DIR" "$APP_DIR/backups"