mirror of
https://github.com/unifi-utilities/unifios-utilities.git
synced 2024-08-30 18:32:21 +00:00
Adds example for multicast-relay (#545)
- Also walks user through using overlayfs to use a common base image
This commit is contained in:
Derek Ditch
GitHub
parent
34ef36e0d0
commit
466ab71140
149
nspawn-container/examples/multicast-relay/README.md
Normal file
149
nspawn-container/examples/multicast-relay/README.md
Normal file
@ -0,0 +1,149 @@
|
|||||||
|
## Create the filesystem overlay
|
||||||
|
|
||||||
|
If you're going to create several nspawn containers, you can save some disk
|
||||||
|
space by using overlayfs to use a common base. Follow the instructions in the
|
||||||
|
unifi-utilities [documentation](https://github.com/unifi-utilities/unifios-utilities/blob/main/nspawn-container/README.md)
|
||||||
|
for UnifiOS 3.0+ containers. I called my container `debian-base`.
|
||||||
|
|
||||||
|
Next, we need an `upperdir` where the file changes are saved and a `workdir`
|
||||||
|
where temporary file changes are saved. I'm going to create a container for
|
||||||
|
multicast-relay, replacing the [podman container](https://github.com/scyto/multicast-relay)
|
||||||
|
that I used prior to 3.x. An important note is that upperdir and workdir
|
||||||
|
must not be on the overlayfs that UnifiOS uses. I opted to store this data
|
||||||
|
on the hard drive that I use for video storage at `/volume1`.
|
||||||
|
|
||||||
|
So, we have the following directories, which you need to create:
|
||||||
|
|
||||||
|
- `/var/lib/machines/multicast-relay`: This will be the root directory of
|
||||||
|
our new container.
|
||||||
|
- `/volume1/machines/multicast-relay/upper`: This stores the differences from
|
||||||
|
the base container.
|
||||||
|
- `/volume1/machines/multicast-relay/work`: This is a temporary directory for
|
||||||
|
changes before they're saved to `upper`. This could possibly be on a `tmpfs`
|
||||||
|
mount, but I didn't want to mess with available memory.
|
||||||
|
- `/data/custom/machines/debian-base`: This is the base container directory
|
||||||
|
created by following the README linked above.
|
||||||
|
|
||||||
|
Do it:
|
||||||
|
```shell
|
||||||
|
mkdir -p /var/lib/machines/multicast-relay /volume1/machines/multicast-relay/{upper,work}
|
||||||
|
```
|
||||||
|
|
||||||
|
Now add the matching entry to your fstab. I'm not 100% sure how permanent this is,
|
||||||
|
but I'll find out when I either reboot or do a firmware upgrade.
|
||||||
|
|
||||||
|
Append this to `/etc/fstab`
|
||||||
|
```
|
||||||
|
overlay /var/lib/machines/multicast-relay overlay noauto,x-systemd.automount,lowerdir=/data/custom/machines/debian-base,upperdir=/volume1/machines/multicast-relay/upper,workdir=/volume1/machines/multicast-relay/work 0 0
|
||||||
|
```
|
||||||
|
|
||||||
|
If everything is good, you can `mount /var/lib/machines/multicast-relay`. If
|
||||||
|
there's any error from that, you have some homework to do. This _should_ automount
|
||||||
|
on reboot, but I haven't tested by rebooting my UDM Pro yet. We'll see 🤞.
|
||||||
|
|
||||||
|
## Configure the container
|
||||||
|
|
||||||
|
With your overlay in place, you can start the container and install your stuff.
|
||||||
|
```
|
||||||
|
systemd-nspawn -M multicast-relay -D /var/lib/machines/multicast-relay
|
||||||
|
```
|
||||||
|
|
||||||
|
You should now be at a root shell inside the container. I configured this all
|
||||||
|
manually, but you can use the [script](./configure-container.sh) I created during
|
||||||
|
my trial and error to save yourself some time. Minimal Debian doesn't have
|
||||||
|
`curl` or `wget`, so you can install one of those and download the script,
|
||||||
|
or copy-paste into `vi` or something. This is left as an exercise to the reader.
|
||||||
|
|
||||||
|
To escape this container, you'll have to press the cheat code given at the start
|
||||||
|
of your session. (HINT: Press <kbd>Ctrl</kbd> + <kbd>]</kbd> 3 times.)
|
||||||
|
|
||||||
|
NOTE: I didn't set the root password, which you will see in many tutorials. It
|
||||||
|
isn't needed. The host can bypass any login prompt using `machinectl shell <container>`.
|
||||||
|
You might want to set a root password and/or other user if you are using the
|
||||||
|
container as a lightweight VM.
|
||||||
|
|
||||||
|
## Run the container
|
||||||
|
|
||||||
|
If this is your first systemd-nspawn service, you'll need to create the config
|
||||||
|
directory.
|
||||||
|
|
||||||
|
```
|
||||||
|
mkdir -p /etc/systemd/nspawn
|
||||||
|
```
|
||||||
|
|
||||||
|
Now create the container launch configuration in the file indicated. `multicast-relay`
|
||||||
|
requires the ability to open raw sockets, so we grant that capability and strip the rest. Be sure you specify the interfaces you wish to use in the `Environment=` line.
|
||||||
|
Optionally, you can specify additional `multicast-relay` options in `OPTS`
|
||||||
|
|
||||||
|
```
|
||||||
|
# /etc/systemd/nspawn/multicast-relay.nspawn
|
||||||
|
[Exec]
|
||||||
|
Boot=on
|
||||||
|
Capability=CAP_NET_RAW
|
||||||
|
Environment=INTERFACES="br0 br50"
|
||||||
|
Environment=OPTS=
|
||||||
|
|
||||||
|
[Network]
|
||||||
|
Private=off
|
||||||
|
VirtualEthernet=off
|
||||||
|
ResolvConf=off
|
||||||
|
```
|
||||||
|
|
||||||
|
Once that file is in place, you're ready to enable the container on boot and run it.
|
||||||
|
|
||||||
|
```
|
||||||
|
machinectl enable multicast-relay
|
||||||
|
machinectl start multicast-relay
|
||||||
|
```
|
||||||
|
|
||||||
|
## Troubleshooting
|
||||||
|
|
||||||
|
You can view the stdout of the container in the host journal.
|
||||||
|
|
||||||
|
```
|
||||||
|
journalctl -xe
|
||||||
|
```
|
||||||
|
|
||||||
|
Output from multicast-relay itself won't be found here though. You _should_ be
|
||||||
|
able to view a containers journal from the host, but I got an error when I tried
|
||||||
|
suggesting the Debian container has a newer journal format than the UnifiOS host.
|
||||||
|
|
||||||
|
No matter, you can just enter the container and get a root shell (no login required).
|
||||||
|
|
||||||
|
```
|
||||||
|
machinectl shell multicast-relay
|
||||||
|
```
|
||||||
|
|
||||||
|
Now, we're setting the interface and options via environment variables set on the
|
||||||
|
host. If you want to double check that's working correctly, check the environment
|
||||||
|
of systemd from within the container.
|
||||||
|
|
||||||
|
```
|
||||||
|
cat /proc/1/environ | tr '\0' '\n'
|
||||||
|
```
|
||||||
|
output:
|
||||||
|
```
|
||||||
|
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||||
|
container=systemd-nspawn
|
||||||
|
HOME=/root
|
||||||
|
USER=root
|
||||||
|
LOGNAME=root
|
||||||
|
container_uuid=c05b41ce-0995-412d-bd2d-338759b24e54
|
||||||
|
NOTIFY_SOCKET=/run/host/notify
|
||||||
|
container_host_version_id=11
|
||||||
|
container_host_id=debian
|
||||||
|
INTERFACES=br0 br50
|
||||||
|
```
|
||||||
|
|
||||||
|
You could use the same command to view the environment of our service. In this case,
|
||||||
|
we can use the PID of `dash`, the shell script interpreter from `start.sh`.
|
||||||
|
|
||||||
|
```
|
||||||
|
root@DreamMachinePro:~# cat /proc/$(pidof dash)/environ | tr '\0' '\n'
|
||||||
|
LANG=C.UTF-8
|
||||||
|
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||||
|
INVOCATION_ID=d1cfaf43a00b4e79bcddca6a1595837c
|
||||||
|
JOURNAL_STREAM=8:51317778
|
||||||
|
SYSTEMD_EXEC_PID=47
|
||||||
|
INTERFACES=br0 br50
|
||||||
|
```
|
||||||
@ -0,0 +1,40 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
set -eux -o pipefail
|
||||||
|
|
||||||
|
# Install dependencies
|
||||||
|
apt install -y --no-install-recommends python3 python3-netifaces git ca-certificates
|
||||||
|
|
||||||
|
# Checkout latest commit of default branch of multicast-relay
|
||||||
|
cd /opt
|
||||||
|
git clone --depth=1 https://github.com/alsmith/multicast-relay.git
|
||||||
|
|
||||||
|
# Drop a startup script
|
||||||
|
cat <<'EOF' | tee /opt/multicast-relay/start.sh
|
||||||
|
#!/bin/dash
|
||||||
|
# This script adapted from scyto
|
||||||
|
# https://github.com/scyto/multicast-relay/blob/master/start.sh
|
||||||
|
SCRIPT_DIR=$(dirname $(readlink -f $0))
|
||||||
|
|
||||||
|
echo "starting multicast-relay"
|
||||||
|
echo "Using Interfaces: ${INTERFACES}"
|
||||||
|
echo "Using Options --foreground " $OPTS
|
||||||
|
python3 "${SCRIPT_DIR}/multicast-relay.py" --interfaces ${INTERFACES} --foreground $OPTS
|
||||||
|
EOF
|
||||||
|
|
||||||
|
chmod +x /opt/multicast-relay/start.sh
|
||||||
|
|
||||||
|
# Install and enable a systemd service
|
||||||
|
cat <<'EOF' | tee /etc/systemd/system/multicast-relay.service
|
||||||
|
[Unit]
|
||||||
|
Description=multicast relay service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
PassEnvironment=INTERFACES OPTS
|
||||||
|
ExecStart=/opt/multicast-relay/start.sh
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOF
|
||||||
|
|
||||||
|
systemctl enable multicast-relay.service
|
||||||
Loading…
Reference in New Issue
Block a user