Add packaging #10
Labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
keyop-go/nfq_forwarder#10
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
RPM and DEB required, also need to include systemd configuration.
mentioned in issue #7
Note: Installation should be in /usr/local/bin, since we will need to also include the 'iptables' binary with it's enhanced capabilities. The systemd user service file should be included in a 'docs' directory (packaged in correct location for the packaging mechanism expectations).
This is still intended to run as a '--user' systemd service, so the packages should not attempt to actually install or start the service - that will be up to the user. We should include a README.md in the docs detailing how to do this, along with the sample configuration also.
We should also consider other Linux packaging formats for other distributions. Arch, Alpine and Nix all come to mind, but there may be others which are worth considering. Anything which goreleaser can handle for us should be handled. Anything stepping outside of goreleaser is probably too much work to maintain.
mentioned in commit
a103a09430mentioned in merge request !61
mentioned in commit
b792f81ce2Resolved via MR !61 (merged in
b792f81), and published end-to-end as the project's first release, v1.0.0: https://gitlab.keyop.co.uk/keyop/go/nfq_forwarder/-/releases/v1.0.0What shipped
nfpms:block in.goreleaser.yaml(wrongbindir, placeholder description, missing files) and addedapk/archlinuxformats alongsidedeb/rpm- Nix confirmed out of scope (nfpm has no Nix output at all).postinstallscriptlet (scripts/nfpm-postinstall.sh) against the installed paths - nfpm has no native capability field, and capabilities are xattrs that don't reliably survive.deb/.rpm/.apkarchive packaging.nfq_forwarder.service,config.example.yaml, and a new packaging-quickstartdocs/README.mdare shipped as inert reference copies under/usr/share/doc/nfq_forwarder/- packages never touch systemd themselves, matching the--user-service design from the discussion above.nfq_forwarder.pamis the one file that does install to a live path (/etc/pam.d/nfq_forwarder), since it's dormant until actively used.make package(snapshot, safe anywhere) andmake release(real publish, CI-only) target, and a tag-triggered GitLab CIreleasestage - pushing avX.Y.Ztag now automatically builds, packages, and publishes a GitLab Release with all four package formats uploaded to the Package Registry.Bonus fix, outside this repo
Getting the release pipeline working end-to-end surfaced an instance-wide nginx bug: path-based project addressing (
/api/v4/projects/keyop%2Fgo%2Fnfq_forwarder/...) was 404ing for every project on this GitLab instance, due to aproxy_pass https://gitlab.keyop.co.uk:8443/;trailing-slash incompose-configs' nginx config causing%2Fto get decoded before reaching GitLab. Fixed by removing the trailing slash. This was blockinggoreleaser's GitLab client entirely (it only ever addresses projects by path, never numeric ID), and may have been silently affecting other tooling too.Still needs real-host verification (tracked separately)
.deb/.rpmon real Debian/RHEL hosts and confirmingsetcap -vshows both capability grants post-install..apk/Arch packages on real Alpine/Arch hosts, including confirming thelibcapdependency name resolves correctly on each.mentioned in commit
e925bbe2ae