v0.22.0 several enhancements and fixes for security, network, doc, test, packaging
This commit is contained in:
lixen committed
1 parent
9ab8c356d2
commit
71d1b82f83
102 files changed
+7102
-2178
No files matched your search
@@ -0,0 +1,46 @@
|
||||
# Maintainer: <name> <email>
|
||||
# Skeleton: source and checksum wait for a tagged release; run namcap and
|
||||
# makepkg --printsrcinfo > .SRCINFO before publishing to the AUR.
|
||||
|
||||
pkgname=logwisp
|
||||
pkgver=0.21.0
|
||||
pkgrel=1
|
||||
pkgdesc='Pipeline-based log transport with TLS and SCRAM authentication'
|
||||
arch=('x86_64' 'aarch64')
|
||||
url='https://github.com/lixenwraith/logwisp'
|
||||
license=('BSD-3-Clause')
|
||||
depends=('glibc')
|
||||
makedepends=('go')
|
||||
backup=('etc/logwisp/logwisp.toml')
|
||||
source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
|
||||
sha256sums=('SKIP')
|
||||
|
||||
prepare() {
|
||||
cd "$pkgname-$pkgver"
|
||||
export GOPATH="$srcdir/gopath"
|
||||
go mod download -modcacherw
|
||||
}
|
||||
|
||||
# The Go package guidelines' flags; -linkmode=external goes through GO_LDFLAGS
|
||||
# because the Makefile's own -ldflags (the version) would override GOFLAGS'.
|
||||
build() {
|
||||
cd "$pkgname-$pkgver"
|
||||
export GOPATH="$srcdir/gopath"
|
||||
export CGO_CPPFLAGS="$CPPFLAGS"
|
||||
export CGO_CFLAGS="$CFLAGS"
|
||||
export CGO_CXXFLAGS="$CXXFLAGS"
|
||||
export CGO_LDFLAGS="$LDFLAGS"
|
||||
export GOFLAGS='-buildmode=pie -trimpath -mod=readonly -modcacherw'
|
||||
make build VERSION="$pkgver" GIT_COMMIT="v$pkgver" GO_LDFLAGS='-linkmode=external'
|
||||
}
|
||||
|
||||
check() {
|
||||
cd "$pkgname-$pkgver"
|
||||
export GOPATH="$srcdir/gopath"
|
||||
go test ./...
|
||||
}
|
||||
|
||||
package() {
|
||||
cd "$pkgname-$pkgver"
|
||||
make install DESTDIR="$pkgdir" PREFIX=/usr SYSCONFDIR=/etc
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
# Skeleton for sysutils/logwisp. GO_MODULE fetches the module by its canonical
|
||||
# path, so it waits for the module rename to github.com/lixenwraith/logwisp
|
||||
# (the -X paths below follow it), a tagged release, a maintainer, and a
|
||||
# UIDs/GIDs entry for logwisp. files/logwisp.in links to ../logwisp.rc: cp -L.
|
||||
|
||||
PORTNAME= logwisp
|
||||
DISTVERSIONPREFIX= v
|
||||
DISTVERSION= 0.21.0
|
||||
CATEGORIES= sysutils
|
||||
|
||||
MAINTAINER= maintainer@example.org
|
||||
COMMENT= Pipeline-based log transport with TLS and SCRAM authentication
|
||||
WWW= https://github.com/lixenwraith/logwisp
|
||||
|
||||
LICENSE= BSD3CLAUSE
|
||||
LICENSE_FILE= ${WRKSRC}/LICENSE
|
||||
|
||||
USES= go:1.27,modules
|
||||
USE_RC_SUBR= logwisp
|
||||
SUB_LIST= BINDIR=${PREFIX}/bin
|
||||
|
||||
GO_MODULE= github.com/lixenwraith/logwisp
|
||||
GO_TARGET= ./cmd/lw
|
||||
GO_BUILDFLAGS= -ldflags="-s -w \
|
||||
-X logwisp/internal/version.Version=${DISTVERSION} \
|
||||
-X logwisp/internal/version.GitCommit=${DISTVERSIONFULL}"
|
||||
|
||||
USERS= logwisp
|
||||
GROUPS= logwisp
|
||||
|
||||
OPTIONS_DEFINE= DOCS
|
||||
PORTDOCS= *
|
||||
|
||||
post-install:
|
||||
${INSTALL_MAN} ${WRKSRC}/doc/lw.1 ${STAGEDIR}${PREFIX}/share/man/man1
|
||||
${MKDIR} ${STAGEDIR}${ETCDIR}
|
||||
${INSTALL_DATA} ${WRKSRC}/config/logwisp.toml ${STAGEDIR}${ETCDIR}/logwisp.toml.sample
|
||||
|
||||
post-install-DOCS-on:
|
||||
${MKDIR} ${STAGEDIR}${DOCSDIR}/doc
|
||||
${INSTALL_DATA} ${WRKSRC}/README.md ${STAGEDIR}${DOCSDIR}
|
||||
${INSTALL_DATA} ${WRKSRC}/doc/*.md ${STAGEDIR}${DOCSDIR}/doc
|
||||
|
||||
.include <bsd.port.mk>
|
||||
+1
@@ -0,0 +1 @@
|
||||
../../logwisp.rc
|
||||
@@ -0,0 +1,5 @@
|
||||
LogWisp collects log entries from files, standard input or other LogWisp
|
||||
nodes; rate-limits, filters and formats them; and distributes them to files,
|
||||
the console, live HTTP (Server-Sent Events) and TCP streams, or downstream
|
||||
nodes. Every network source and sink supports TLS, mutual TLS and
|
||||
Argon2id-SCRAM password authentication, and reloads on SIGHUP.
|
||||
@@ -0,0 +1,3 @@
|
||||
bin/lw
|
||||
@sample %%ETCDIR%%/logwisp.toml.sample
|
||||
share/man/man1/lw.1.gz
|
||||
@@ -0,0 +1,47 @@
|
||||
#!/bin/sh
|
||||
|
||||
# PROVIDE: logwisp
|
||||
# REQUIRE: LOGIN NETWORKING
|
||||
# KEYWORD: shutdown
|
||||
|
||||
# Add to /etc/rc.conf (sysrc logwisp_enable=YES):
|
||||
# logwisp_enable "YES" starts LogWisp at boot (default "NO")
|
||||
# logwisp_config configuration file (default %%PREFIX%%/etc/logwisp/logwisp.toml)
|
||||
# logwisp_user account lw runs as (default "logwisp")
|
||||
# logwisp_chdir working directory (default /var/db/logwisp)
|
||||
# logwisp_args extra lw options, e.g. --logging.level=debug (default empty);
|
||||
# rc.subr hands logwisp_flags to daemon(8), not to lw
|
||||
|
||||
. /etc/rc.subr
|
||||
|
||||
name=logwisp
|
||||
rcvar=logwisp_enable
|
||||
desc="LogWisp log transport"
|
||||
|
||||
load_rc_config $name
|
||||
|
||||
: ${logwisp_enable:="NO"}
|
||||
: ${logwisp_config:="%%PREFIX%%/etc/logwisp/logwisp.toml"}
|
||||
: ${logwisp_user:="logwisp"}
|
||||
: ${logwisp_chdir:="/var/db/logwisp"}
|
||||
: ${logwisp_args:=""}
|
||||
|
||||
# daemon(8) records the child's pid, so stop and reload (SIGHUP) signal lw
|
||||
# itself, and sends its output to syslog under the tag logwisp.
|
||||
pidfile="/var/run/${name}/${name}.pid"
|
||||
procname="%%BINDIR%%/lw"
|
||||
command="/usr/sbin/daemon"
|
||||
command_args="-f -S -T ${name} -p ${pidfile} ${procname} -c ${logwisp_config} ${logwisp_args}"
|
||||
required_files="${logwisp_config}"
|
||||
extra_commands="reload"
|
||||
start_precmd="${name}_prestart"
|
||||
|
||||
# rc.subr starts daemon(8) as logwisp_user, which must own the pidfile directory.
|
||||
# An existing logwisp_chdir keeps its owner: it may be a shared directory.
|
||||
logwisp_prestart()
|
||||
{
|
||||
install -d -o "${logwisp_user}" -m 0755 "/var/run/${name}"
|
||||
[ -d "${logwisp_chdir}" ] || install -d -o "${logwisp_user}" -m 0750 "${logwisp_chdir}"
|
||||
}
|
||||
|
||||
run_rc_command "$1"
|
||||
@@ -0,0 +1,54 @@
|
||||
[Unit]
|
||||
Description=LogWisp log transport
|
||||
Documentation=man:lw(1) https://github.com/lixenwraith/logwisp
|
||||
Wants=network-online.target
|
||||
After=network-online.target
|
||||
# A broken configuration stops after five tries instead of looping forever.
|
||||
StartLimitIntervalSec=60
|
||||
StartLimitBurst=5
|
||||
|
||||
[Service]
|
||||
Type=exec
|
||||
User=logwisp
|
||||
Group=logwisp
|
||||
ExecStart=@BINDIR@/lw -c @SYSCONFDIR@/logwisp/logwisp.toml
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
Restart=on-failure
|
||||
RestartSec=5s
|
||||
TimeoutStopSec=15s
|
||||
|
||||
# logwisp.tmpfiles creates both directories. A file sink elsewhere needs a
|
||||
# drop-in with ReadWritePaths=, a source under /home one with ProtectHome=read-only,
|
||||
# and a port below 1024 CapabilityBoundingSet= and AmbientCapabilities= both
|
||||
# set to CAP_NET_BIND_SERVICE.
|
||||
WorkingDirectory=/var/lib/logwisp
|
||||
ReadWritePaths=/var/lib/logwisp /var/log/logwisp
|
||||
UMask=0027
|
||||
|
||||
NoNewPrivileges=yes
|
||||
CapabilityBoundingSet=
|
||||
AmbientCapabilities=
|
||||
PrivateDevices=yes
|
||||
PrivateTmp=yes
|
||||
ProtectClock=yes
|
||||
ProtectControlGroups=yes
|
||||
ProtectHome=yes
|
||||
ProtectHostname=yes
|
||||
ProtectKernelLogs=yes
|
||||
ProtectKernelModules=yes
|
||||
ProtectKernelTunables=yes
|
||||
ProtectProc=invisible
|
||||
ProcSubset=pid
|
||||
ProtectSystem=strict
|
||||
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
||||
RestrictNamespaces=yes
|
||||
RestrictRealtime=yes
|
||||
RestrictSUIDSGID=yes
|
||||
RemoveIPC=yes
|
||||
SystemCallArchitectures=native
|
||||
SystemCallFilter=@system-service
|
||||
LockPersonality=yes
|
||||
MemoryDenyWriteExecute=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,2 @@
|
||||
# Type Name ID Description Home Shell
|
||||
u logwisp - "LogWisp log transport" /var/lib/logwisp -
|
||||
@@ -0,0 +1,3 @@
|
||||
# Type Path Mode User Group Age Argument
|
||||
d /var/lib/logwisp 0750 logwisp logwisp - -
|
||||
d /var/log/logwisp 0750 logwisp logwisp - -
|
||||
Reference in new issue
Block a user