tinc - Sep 2015 - tinc initialization (in both Red Hat and Debian families)

Hello all,


Thank you for tinc, that is an **excellent** and useful package!

Taking into account that both Red Hat and Debian (8.x) families now use
systemd, there is, IMHO, one small. but important correction to be done:
tinc's initialization.

IMHO, we need:



1. A proper tinc.service file, included by default (prepackaged) in the
stock .deb and .rpm packages in Fedora, Debian, Ubuntu, CentOS, etc.

By "proper" I mean it will start tinc at the correct time during
system's
initialization, have proper permissions, etc.



2. On Red Hat systems, an /etc/sysconfig/tinc file, as a standard place to
pass initialization parameters to the tincd daemon. For example, the
network name (-n) to be used.

A similar configuration file should exist in Debian, but I'm less familiar
with the Debian initialization scheme.


As a long time CentOS and Fedora user, I may confirm such a systemd
initialization mechanism is still not present in CentOS 7.x (EPEL) or
Fedora 22. And I suspect that the situation is no better in soon-to-be
Fedora 23 (already beta stage, final will be available in October).

Please see:

https://bugzilla.redhat.com/show_bug.cgi?id=1078237
https://bugzilla.redhat.com/show_bug.cgi?id=1261717


Thanks a lot!


Best & friendly regards,
R?zvan
-------------- partea urm?toare --------------
Un ata?ament HTML a fost eliminat   
URL:
<http://www.tinc-vpn.org/pipermail/tinc/attachments/20150924/c0a1e0d1/attachment.html>

On Thu, Sep 24, 2015 at 05:51:30PM +0300, R?zvan Sandu wrote:
> Taking into account that both Red Hat and Debian (8.x) families now use
> systemd, there is, IMHO, one small. but important correction to be done:
> tinc's initialization.
> 
> IMHO, we need:
> 
> 1. A proper tinc.service file, included by default (prepackaged) in the
> stock .deb and .rpm packages in Fedora, Debian, Ubuntu, CentOS, etc.
> 
> By "proper" I mean it will start tinc at the correct time during
system's
> initialization, have proper permissions, etc.
I agree. I would like it to follow systemd's way of doing things as much
of possible. For example, in order to support multiple tinc daemons
running, I'd like to use unit instances, so one can say:

systemctl start tinc at NETNAME.service

Where NETNAME is passed to tincd using the -n option of course. So that
means no more nets.boot. Anyone having any ideas about this?
> 2. On Red Hat systems, an /etc/sysconfig/tinc file, as a standard place to
> pass initialization parameters to the tincd daemon. For example, the
> network name (-n) to be used.
> 
> A similar configuration file should exist in Debian, but I'm less
familiar
> with the Debian initialization scheme.
I'm not too fond of supporting distribution specific stuff in tinc
upstream. As mentioned above, the netname issue can be handled by
systemd using instances. As for other parameters, I know it is possible
to specify a file with the format VARIABLE=VALUE and have it read by
systemd, so you can use those variables in the unit files. It works with
Debian's /etc/default/tinc more or less. I don't know about Red
Hat's
sysconfig files. Or I might add some extra configuration options to tinc
for those command line switches that do not have a configuration file
equivalent.

-- 
Met vriendelijke groet / with kind regards,
     Guus Sliepen <guus at tinc-vpn.org>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL:
<http://www.tinc-vpn.org/pipermail/tinc/attachments/20150924/0cbfdd75/attachment.sig>

Hi!
> Guus Sliepen <guus at tinc-vpn.org> hat am 24. September 2015 um
17:45
> geschrieben:
> 
> On Thu, Sep 24, 2015 at 05:51:30PM +0300, R?zvan Sandu wrote:
> 
> > Taking into account that both Red Hat and Debian (8.x) families now
use
> > systemd, there is, IMHO, one small. but important correction to be
done:
> > tinc's initialization.
> > 
> > IMHO, we need:
> > 
> > 1. A proper tinc.service file, included by default (prepackaged) in
the
> > stock .deb and .rpm packages in Fedora, Debian, Ubuntu, CentOS, etc.
> > 
> > By "proper" I mean it will start tinc at the correct time
during system's
> > initialization, have proper permissions, etc.
> 
> I agree. I would like it to follow systemd's way of doing things as
much
> of possible. For example, in order to support multiple tinc daemons
> running, I'd like to use unit instances, so one can say:
> 
> systemctl start tinc at NETNAME.service
> 
> Where NETNAME is passed to tincd using the -n option of course. So that
> means no more nets.boot. Anyone having any ideas about this?
+1 something like that would be nice to have.
> > 2. On Red Hat systems, an /etc/sysconfig/tinc file, as a standard
place to
> > pass initialization parameters to the tincd daemon. For example, the
> > network name (-n) to be used.
> > 
> > A similar configuration file should exist in Debian, but I'm less
familiar
> > with the Debian initialization scheme.
> 
> I'm not too fond of supporting distribution specific stuff in tinc
> upstream. As mentioned above, the netname issue can be handled by
> systemd using instances. As for other parameters, I know it is possible
> to specify a file with the format VARIABLE=VALUE and have it read by
> systemd, so you can use those variables in the unit files. It works with
> Debian's /etc/default/tinc more or less. I don't know about Red
Hat's
> sysconfig files. Or I might add some extra configuration options to tinc
> for those command line switches that do not have a configuration file
> equivalent.
Indeed. In the end, packagers will have to manually do something about those
files anyway. So it's one thing to provide a base implementation of a unit
file
upstream and ship it with tinc source. Or even just put a reference file into
the wiki. Finally leave such distribution specific details to the package
maintainer of the distribution. That's what they are good at.

I created a package for openSUSE and the init script, I added, was the (IMHO)
best of all the init scripts I found out there + some extras. I borrowed from
gentoo, debian and arch, IIRC. Unfortunately I didn't have the time to dive
into
systemd, yet. So I don't have systemd support ready, at the moment.

Just my 2ct
Julian

On Thu, Sep 24, 2015 at 05:45:36PM +0200, Guus Sliepen wrote:
> On Thu, Sep 24, 2015 at 05:51:30PM +0300, R?zvan Sandu wrote:
> 
> > IMHO, we need:
> > 
> > 1. A proper tinc.service file, included by default (prepackaged) in
the
> > stock .deb and .rpm packages in Fedora, Debian, Ubuntu, CentOS, etc.
> > 
> > By "proper" I mean it will start tinc at the correct time
during system's
> > initialization, have proper permissions, etc.
I had already experimented with systemd service files before, I just
added them to the 1.1 branch. You can see them here:

http://tinc-vpn.org/git/browse?p=tinc;a=tree;f=systemd;hb=refs/heads/1.1

There are two service files; tinc at .service
and tinc.service. The first is a template that allows you to enable and
start/stop individual instances of tinc, like in:

systemctl enable tinc at foo
systemctl start tinc at foo

This starts tincd -n foo. The second service file is itself a dummy, but
all template instances are slaved to this one (using PartOf), so you can
start/stop all tinc daemons in one go, like:

systemctl start tinc

Let me know if these work for you or not.

-- 
Met vriendelijke groet / with kind regards,
     Guus Sliepen <guus at tinc-vpn.org>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL:
<http://www.tinc-vpn.org/pipermail/tinc/attachments/20150924/023b4580/attachment.sig>