This repository has been archived by the owner on Jan 12, 2022. It is now read-only.
Systemd, ENV, latest stable Moodle #6
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,6 @@ | ||
|
|
||
| # Moodle version | ||
| MOODLE_DOWNLOAD_FILE=moodle-latest-35.tgz | ||
| MOODLE_TRACK=stable35 | ||
| MOODLE_VERSION=3.5 | ||
| ONELOGIN_PLUGIN_VER=v2.5.1 | ||
|
|
@@ -10,7 +11,11 @@ PHP_VERSION=7.2 | |
| # Nginx version | ||
| NGINX_VERSION=1.14.0-0+xenial1 | ||
|
|
||
| # Docker | ||
| DOCKER_REGISTRY_URL=docker.sdelements.com:443/moodle | ||
|
|
||
| # Moodle variables | ||
| # WWWROOT MUST be IP or FQDN | ||
| MOODLE_WWWROOT=https://localhost | ||
| MOODLE_DATAROOT=/opt/moodle/moodledata | ||
| [email protected] | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| [Unit] | ||
| Description=Docker based Moodle Deployment | ||
| Documentation=https://github.com/SecurityCompass/moodle-docker | ||
| After=docker.service | ||
| Requires=docker.service | ||
|
|
||
| [Service] | ||
| WorkingDirectory=/etc/moodle-docker | ||
| Type=oneshot | ||
| RemainAfterExit=yes | ||
|
|
||
| ExecStartPre=-/usr/local/bin/docker-compose --file /etc/moodle-docker/docker-compose.yml pull --quiet | ||
| ExecStart=/usr/local/bin/docker-compose --file /etc/moodle-docker/docker-compose.yml --file /etc/moodle-docker/dc.prod.yml up --detach | ||
|
There was a problem hiding this comment. Since the container is managed with systemd we don't want to detach from the container here. There was a problem hiding this comment. Its cleaner to detach and let There was a problem hiding this comment. Why not keep it attached and let systemd handling the logging also? Then systemd can detect if the container crashes or stops for some reason. You will also be able to access the logs through docker but it's easier to use journalctl and get all logs at once. There was a problem hiding this comment. The syslog logging driver should dump everything to a log file, but we could also try the journald logging driver instead: https://docs.docker.com/config/containers/logging/journald/#options |
||
|
|
||
| ExecReload=-/usr/local/bin/docker-compose --file /etc/moodle-docker/docker-compose.yml pull --quiet | ||
| ExecReload=/usr/local/bin/docker-compose --file /etc/moodle-docker/docker-compose.yml --file /etc/moodle-docker/dc.prod.yml up --detach | ||
|
|
||
| ExecStop=/usr/local/bin/docker-compose --file /etc/moodle-docker/docker-compose.yml stop | ||
|
|
||
| [Install] | ||
| WantedBy=multi-user.target | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| #!/bin/sh | ||
| after_upgrade() { | ||
| : | ||
|
|
||
| systemctl --system daemon-reload >/dev/null || true | ||
| if ! systemctl is-enabled moodle-docker >/dev/null | ||
| then | ||
| systemctl enable moodle-docker >/dev/null || true | ||
| systemctl start moodle-docker >/dev/null || true | ||
| else | ||
| systemctl restart moodle-docker >/dev/null || true | ||
| fi | ||
| } | ||
|
|
||
| after_install() { | ||
| : | ||
| #!/usr/bin/env bash | ||
|
|
||
| systemctl --system daemon-reload >/dev/null || true | ||
| systemctl enable moodle-docker >/dev/null || true | ||
| # Skip starting since we need to configure `.env` | ||
| #systemctl start moodle-docker >/dev/null || true | ||
|
There was a problem hiding this comment. Should remove this line if it's not needed. There was a problem hiding this comment. I'm going to uncomment once I automate a couple more things:
There was a problem hiding this comment. Ah alright let's leave this part in for now then. |
||
| } | ||
|
|
||
| if [ "${1}" = "configure" ] && [ -z "${2}" ] || \ | ||
| [ "${1}" = "abort-remove" ] | ||
| then | ||
| # "after install" here | ||
| # "abort-remove" happens when the pre-removal script failed. | ||
| # In that case, this script, which should be idemptoent, is run | ||
| # to ensure a clean roll-back of the removal. | ||
| after_install | ||
| elif [ "${1}" = "configure" ] && [ -n "${2}" ] | ||
| then | ||
| upgradeFromVersion="${2}" | ||
| # "after upgrade" here | ||
| # NOTE: This slot is also used when deb packages are removed, | ||
| # but their config files aren't, but a newer version of the | ||
| # package is installed later, called "Config-Files" state. | ||
| # basically, that still looks a _lot_ like an upgrade to me. | ||
| after_upgrade "${upgradeFromVersion}" | ||
| elif echo "${1}" | grep -E -q "(abort|fail)" | ||
| then | ||
| echo "Failed to install before the post-installation script was run." >&2 | ||
| exit 1 | ||
| fi | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| #!/bin/sh | ||
| before_remove() { | ||
| : | ||
|
|
||
| systemctl stop moodle-docker >/dev/null || true | ||
| systemctl disable moodle-docker >/dev/null || true | ||
| systemctl --system daemon-reload >/dev/null || true | ||
| } | ||
|
|
||
| dummy() { | ||
| : | ||
| } | ||
|
|
||
| if [ "${1}" = "remove" ] && [ -z "${2}" ] | ||
| then | ||
| # "before remove" goes here | ||
| before_remove | ||
| elif [ "${1}" = "upgrade" ] | ||
| then | ||
| # Executed before the old version is removed | ||
| # upon upgrade. | ||
| # We should generally not do anything here. The newly installed package | ||
| # should do the upgrade, not the uninstalled one, since it can't anticipate | ||
| # what new things it will have to do to upgrade for the new version. | ||
| dummy | ||
| elif echo "${1}" | grep -E -q "(fail|abort)" | ||
| then | ||
| echo "Failed to install before the pre-removal script was run." >&2 | ||
| exit 1 | ||
| fi |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is this a oneshot service? generally that's used for scripts that exit, but this will remain running as a service.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
docker-composedoesn't stay running, the actual containers are managed bydockerThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If you remove the --detach it will stay running, that way the logs show up properly with journalctl.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
--detachis safer in prod because it saves on resources.. plus we should have a proper logging solution vsdocker->docker-compose->journalctlSome more notes here:
docker/compose#4266 (comment)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
FYI, I would much rather we use the 'syslog' docker logging driver and leave compose detached. This is what I'm doing for SDE, and instead of dumping logs into the compose stdout, it will send them to syslog with an appropriate container tag. Let me know if you have questions about this.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What resources would it be using exactly? The example posted before that comment is the correct way to do this IMO. The proper logging solution is to use this as a simple service and not oneshot. If we send the logs to journald it's easy to then move them elsewhere to a centralized location.
What's the behaviour with stopping a container in a oneshot service? once docker-compose exits the oneshot service will report it's exited successfully. This could leave you in a weird state where the container is running/crashed but systemd is not aware of this.
Also what happens when docker-compose exits but the container stops right after due to an error or some other reason? In this case systemd wont print any errors and the oneshot service will report success even though the container is not running.
Another reason to make this a simple service would be then we can use the Restart and related config fields to ensure the container is brought back up if it exits for some reason.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@adamgilbert just pointed me to this:
https://docs.docker.com/config/containers/logging/journald/#usage
Thoughts?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Discussed further with @hrpatel, I think we are good to go with the oneshot approach.