From e77d288e2d237d200c3c36f0afc2a7dca99c4a73 Mon Sep 17 00:00:00 2001 From: Jeremy Davis Date: Thu, 1 Jan 2026 11:43:42 +1100 Subject: [PATCH 1/3] Initial refactor to migrate turnkey-init-fence to systemd service --- {turnkey-init-fence => bin}/turnkey-init-fence | 0 debian/inithooks.install | 4 ++-- turnkey-init-fence/turnkey-init-fence.service | 0 3 files changed, 2 insertions(+), 2 deletions(-) rename {turnkey-init-fence => bin}/turnkey-init-fence (100%) create mode 100644 turnkey-init-fence/turnkey-init-fence.service diff --git a/turnkey-init-fence/turnkey-init-fence b/bin/turnkey-init-fence similarity index 100% rename from turnkey-init-fence/turnkey-init-fence rename to bin/turnkey-init-fence diff --git a/debian/inithooks.install b/debian/inithooks.install index 2bf7897..2e83fde 100644 --- a/debian/inithooks.install +++ b/debian/inithooks.install @@ -5,8 +5,8 @@ everyboot.d/* /usr/lib/inithooks/everyboot.d run /usr/lib/inithooks rsyslog.d/* /etc/rsyslog.d -turnkey-init-fence/turnkey-init-fence /etc/init.d -turnkey-init-fence/htdocs /var/lib/inithooks/turnkey-init-fence +turnkey-init-fence/turnkey-init-fence.service /usr/lib/systemd/system +turnkey-init-fence/htdocs /usr/lib/inithooks/turnkey-init-fence turnkey-init /usr/sbin turnkey-sudoadmin /usr/sbin diff --git a/turnkey-init-fence/turnkey-init-fence.service b/turnkey-init-fence/turnkey-init-fence.service new file mode 100644 index 0000000..e69de29 From 2421736a97551287af8ce9b197439ad41f590968 Mon Sep 17 00:00:00 2001 From: Jeremy Davis Date: Thu, 1 Jan 2026 12:22:20 +1100 Subject: [PATCH 2/3] init-fence: write systemd service & convert init script to plain script --- bin/turnkey-init-fence | 216 ++++-------------- default/turnkey-init-fence | 4 +- turnkey-init-fence/turnkey-init-fence.service | 14 ++ 3 files changed, 56 insertions(+), 178 deletions(-) diff --git a/bin/turnkey-init-fence b/bin/turnkey-init-fence index 19f4eb1..b001f21 100755 --- a/bin/turnkey-init-fence +++ b/bin/turnkey-init-fence @@ -1,95 +1,46 @@ -#!/bin/bash -e -### BEGIN INIT INFO -# Provides: turnkey-init-fence -# Required-Start: $remote_fs $syslog -# Required-Stop: $remote_fs $syslog -# Default-Start: 2 3 4 5 -# Default-Stop: 0 1 6 -# Short-Description: Fences off appliance ports until after initialization -### END INIT INFO -# -# Author: Liraz Siri -# -# how it works: iptables redirects http/https TCP connections to simplehttpd.py -# -# redirect $HTTP_PORTS-> $HTTP_FENCE_PORT -# redirect $HTTPS_PORTS -> $HTTPS_FENCE_PORT -# -# configuration @ /etc/default/turnkey-init-fence -# -# HTTP_FENCE_PORT=60080 -# HTTPS_FENCE_PORT=60443 -# HTTP_PORT=80 -# HTTPS_PORTS=443 -# +#!/bin/bash -eu -# PATH should only include /usr/* if it runs after the mountnfs.sh script -PATH=/sbin:/usr/sbin:/bin:/usr/bin -DESC="Description of the service" -NAME=turnkey-init-fence -DAEMON=/usr/lib/inithooks/bin/simplehttpd.py -PIDFILE=/var/run/$NAME/simplehttpd.pid -SCRIPTNAME=/etc/init.d/$NAME +# TurnKey web interface fence - blocks access to web app until system is +# initialized (admin password configure, etc) -# Exit if the package is not installed -[ -x "$DAEMON" ] || exit 0 - -# Create pidfile directory -mkdir -p $(dirname $PIDFILE) - -# Read configuration variable file if it is present -[ -r /etc/default/$NAME ] && . /etc/default/$NAME -chown -R $RUNAS $(dirname $PIDFILE) - -# Load the VERBOSE setting and other rcS variables -. /lib/init/vars.sh - -# Define LSB log_* functions. -# Depend on lsb-base (>= 3.2-14) to ensure that this file is present -# and status_of_proc is working. -. /lib/lsb/init-functions - -iptables_delete_redirect() -{ - dport=$1 - to_port=$2 +iptables_delete_redirect() { + local dport=$1 + local to_port=$2 while true; do - (2>&1 iptables -t nat -D PREROUTING -p tcp --dport $dport -j REDIRECT --to-port $to_port) > /dev/null || break + (2>&1 iptables -t nat -D PREROUTING -p tcp --dport "$dport" -j REDIRECT --to-port "$to_port") > /dev/null || break done } -iptables_add_redirect() -{ - dport=$1 - to_port=$2 +iptables_add_redirect() { + local dport=$1 + local to_port=$2 - iptables_delete_redirect $1 $2 - iptables -t nat -A PREROUTING -p tcp --dport $dport -j REDIRECT --to-port $to_port + iptables_delete_redirect "$dport" "$to_port" + iptables -t nat -A PREROUTING -p tcp --dport "$dport" -j REDIRECT --to-port "$to_port" } -iptables_unensure_accept() -{ +iptables_unensure_accept() { # remove ACCEPT line for fence ports (used in appliances that have a # `filter` policy of `DROP`) - dport=$1 + local dport=$1 while true; do - (2>&1 iptables -t filter -D INPUT -p tcp -m tcp --dport $dport -j ACCEPT) > /dev/null || break + (2>&1 iptables -t filter -D INPUT -p tcp -m tcp --dport "$dport" -j ACCEPT) > /dev/null || break done } -iptables_ensure_accept() -{ +iptables_ensure_accept() { # add ACCEPT line for fence ports (used in appliances that have a # `filter` policy of `DROP`) - dport=$1 - iptables_unensure_accept $1 - iptables -t filter -A INPUT -p tcp -m tcp --dport $dport -j ACCEPT + local dport=$1 + iptables_unensure_accept "$dport" + iptables -t filter -A INPUT -p tcp -m tcp --dport "$dport" -j ACCEPT } - -iptables_redirect() -{ +iptables_redirect() { + local op + local mop + local port case "$1" in start) op=iptables_add_redirect @@ -101,116 +52,29 @@ iptables_redirect() ;; esac - for port in $HTTP_PORTS; do - $op $port $HTTP_FENCE_PORT + for port in "${HTTP_PORTS[@]}"; do + $op "$port" "$HTTP_FENCE_PORT" done - for port in $HTTPS_PORTS; do - $op $port $HTTPS_FENCE_PORT + for port in "${HTTPS_PORTS[@]}"; do + $op "$port" "$HTTPS_FENCE_PORT" done - $mop $HTTP_FENCE_PORT - $mop $HTTPS_FENCE_PORT -} - -# -# Function that starts the daemon/service -# -do_start() -{ - # Return - # 0 if daemon has been started - # 1 if daemon was already running - # 2 if daemon could not be started - start-stop-daemon --start --quiet --pidfile $PIDFILE --name $(basename $DAEMON) --startas $DAEMON --test > /dev/null \ - || return 1 - start-stop-daemon --start --pidfile $PIDFILE --exec $DAEMON -- --runas=$RUNAS \ - --daemonize=$PIDFILE $WEBROOT $HTTP_FENCE_PORT $HTTPS_FENCE_PORT $HTTPS_FENCE_CERTFILE $HTTPS_FENCE_KEYFILE - - # Add code here, if necessary, that waits for the process to be ready - # to handle requests from services started subsequently which depend - # on this one. As a last resort, sleep for some time. - - iptables_redirect start -} - -# -# Function that stops the daemon/service -# -do_stop() -{ - iptables_redirect stop - - # Return - # 0 if daemon has been stopped - # 1 if daemon was already stopped - # 2 if daemon could not be stopped - # other if a failure occurred - start-stop-daemon --stop --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $(basename $DAEMON) - RETVAL="$?" - [ "$RETVAL" = 2 ] && return 2 - # Wait for children to finish too if this is a daemon that forks - # and if the daemon is only ever run from this initscript. - # If the above conditions are not satisfied then add some other code - # that waits for the process to drop all resources that could be - # needed by services started subsequently. A last resort is to - # sleep for some time. - start-stop-daemon --stop --quiet --oknodo --retry=TERM/30/KILL/5 --user $RUNAS --name $(basename $DAEMON) - - [ "$?" = 2 ] && return 2 - # Many daemons don't delete their pidfiles when they exit. - rm -f $PIDFILE - - return "$RETVAL" + $mop "$HTTP_FENCE_PORT" + $mop "$HTTPS_FENCE_PORT" } case "$1" in - start) - [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME" - do_start - case "$?" in - 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;; - 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;; - esac - ;; - stop) - [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME" - do_stop - case "$?" in - 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;; - 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;; - esac - ;; - status) - status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $? - ;; - restart) - # - # If the "reload" option is implemented then remove the - # 'force-reload' alias - # - log_daemon_msg "Restarting $DESC" "$NAME" - do_stop - case "$?" in - 0|1) - do_start - case "$?" in - 0) log_end_msg 0 ;; - 1) log_end_msg 1 ;; # Old process is still running - *) log_end_msg 1 ;; # Failed to start - esac - ;; - *) - # Failed to stop - log_end_msg 1 + start) + echo "Starting turnkey-init-fence" + iptables_redirect start + ;; + stop) + echo "Stopping turnkey-init-fence" + iptables_redirect stop + ;; + *) + echo "Unknown command: $1" >&2 + exit 1 ;; - esac - ;; - *) - echo "Usage: $SCRIPTNAME {start|stop|status|restart}" >&2 - exit 3 - ;; esac - -: - diff --git a/default/turnkey-init-fence b/default/turnkey-init-fence index 0ec3a18..2837eb0 100644 --- a/default/turnkey-init-fence +++ b/default/turnkey-init-fence @@ -1,6 +1,6 @@ WEBROOT=/var/lib/inithooks/turnkey-init-fence/htdocs -HTTP_PORTS=80 -HTTPS_PORTS="443 12321 12320" +HTTP_PORTS=(80) +HTTPS_PORTS=(443 12321 12322) RUNAS=nobody diff --git a/turnkey-init-fence/turnkey-init-fence.service b/turnkey-init-fence/turnkey-init-fence.service index e69de29..1c0c12e 100644 --- a/turnkey-init-fence/turnkey-init-fence.service +++ b/turnkey-init-fence/turnkey-init-fence.service @@ -0,0 +1,14 @@ +[Unit] +Description=TurnKey Initialization web interface fence +After=network.target network-online.target +After=iptables.service firewalld.service ip6tables.service ipset.service nftables.service +Before=apache2.service nginx.service lighttpd.service + +[Service] +Type=one-shot +EnvironmentFile=/etc/default/turnkey-init-fence +ExecStart=/usr/lib/inithooks/bin/turnkey-init-fence start +ExecStop=/usr/lib/inithooks/bin/turnkey-init-fence stop + +[Install] +WantedBy=multi-user.target From 6ce0c255403675b093e0ee6388cd0d7e2bf8c3aa Mon Sep 17 00:00:00 2001 From: Jeremy Davis Date: Thu, 1 Jan 2026 12:59:59 +1100 Subject: [PATCH 3/3] Update exectuable path in /etc/default fail --- default/turnkey-init-fence | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/default/turnkey-init-fence b/default/turnkey-init-fence index 2837eb0..2970ecd 100644 --- a/default/turnkey-init-fence +++ b/default/turnkey-init-fence @@ -1,4 +1,4 @@ -WEBROOT=/var/lib/inithooks/turnkey-init-fence/htdocs +WEBROOT=/usr/lib/inithooks/turnkey-init-fence/htdocs HTTP_PORTS=(80) HTTPS_PORTS=(443 12321 12322)