Deploying packit-service via quadlets - #3167
Conversation
|
🤖 Finished Review · ✅ Success · Started 6:14 AM UTC · Completed 6:34 AM UTC Commit: |
|
CC @FrostyX you would probably be interested to try this out (once we figure out the actual components). Could also be interesting for copr to check |
|
Build succeeded. ✔️ pre-commit SUCCESS in 1m 57s |
ReviewFindingsHigh
Medium
Low
Next steps:
Previous runReviewFindingsLow
Labels: PR adds systemd quadlet deployment configuration files under quadlets/ |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
ready-for-merge
Signed-off-by: Cristian Le <git@lecris.dev>
Signed-off-by: Cristian Le <git@lecris.dev>
Signed-off-by: Cristian Le <git@lecris.dev>
Signed-off-by: Cristian Le <git@lecris.dev>
Signed-off-by: Cristian Le <git@lecris.dev>
Signed-off-by: Cristian Le <git@lecris.dev>
|
🤖 Review · ❌ Terminated · Started 6:41 AM UTC · Ended 7:00 AM UTC Commit: |
|
Build succeeded. ✔️ pre-commit SUCCESS in 1m 56s |
|
|
||
| http_flags=( | ||
| --http2 | ||
| ) |
There was a problem hiding this comment.
[medium] logic-error
The --http2 flag is unconditionally added to http_flags, including the plain HTTP code path. Apache's mod_http2 requires TLS for h2. Passing --http2 with --port (plain HTTP) may cause mod_wsgi-express to fail to start or silently ignore the flag.
Suggested fix: Move --http2 into the TLS branch (inside the if [[ -f /secrets/privkey.pem ]] block).
| http_flags+=( | ||
| --https-port "${PORT:-8443}" | ||
| --ssl-certificate-file /secrets/fullchain.pem | ||
| --ssl-certificate-key-file /secrets/privkey.pem |
There was a problem hiding this comment.
[medium] fail-open
Silent fallback to plain HTTP (port 8080) when /secrets/privkey.pem is absent. Previously the server always attempted HTTPS and would fail if certificates were missing (fail-closed). This also affects the existing docker-compose deployment path — a misconfiguration could cause unencrypted traffic.
Suggested fix: Add an explicit warning log in the else branch. Consider restricting the HTTP fallback to dev/local deployments only (e.g., gating on DEPLOYMENT env var).
| vars: | ||
| home_path: "{{ lookup('env', 'HOME') }}" | ||
| packit_service_path: /src | ||
| editable_install: "{{ lookup('env', 'DEPLOYMENT') == 'dev' }}" |
There was a problem hiding this comment.
[low] build-time environment
editable_install reads DEPLOYMENT at Ansible execution time. The existing Dockerfile build path does not set this variable, so editable install only works via the new quadlet build path. Likely intentional but undocumented.
| SERVER_NAME=$(sed -nr 's/^server_name: ([^:]+)(:([0-9]+))?$/\1/p' "$PACKIT_SERVICE_CONFIG") | ||
| HTTPS_PORT=$(sed -nr 's/^server_name: ([^:]+)(:([0-9]+))?$/\3/p' "$PACKIT_SERVICE_CONFIG") | ||
| PORT=$(sed -nr 's/^server_name: ([^:]+)(:([0-9]+))?$/\3/p' "$PACKIT_SERVICE_CONFIG") | ||
|
|
There was a problem hiding this comment.
[low] naming-convention
http_flags uses lowercase while all other substantive variables in the file use UPPER_CASE (ATTEMPTS, SERVER_NAME, PORT, PACKIT_SERVICE_CONFIG).
| vars: | ||
| home_path: "{{ lookup('env', 'HOME') }}" | ||
| packit_service_path: /src | ||
| editable_install: "{{ lookup('env', 'DEPLOYMENT') == 'dev' }}" |
There was a problem hiding this comment.
[low] scope-creep
Adding editable_install to the shared Ansible recipe couples the new quadlet workflow to the existing Dockerfile build pipeline. Existing behavior is preserved (DEPLOYMENT unset = non-editable), but the coupling is undocumented.
fullsend-ai-review
Bot
removed
the
ready-for-merge
|
🤖 Finished Review · ✅ Success · Started 6:41 AM UTC · Completed 7:00 AM UTC Commit: |
LecrisUT
changed the title
2 participants
The goal of such a setup is to have a more composable deployment setup than the docker-compose setup. This makes use of the systemd drop-in configuration files to be able to select the components that you want, e.g.
devbeing a setup that would use the current sources and pick up the live edits. In principle the user would simply run(after setting up systemd to pick up these quadlets file, see
quadlet/README.mdfor more info)TODO: