820d23fd9d
There's a usecase for running workers at a different machine than the composer. For example when there's need for making images for architecture different then the composer is running at. Although osbuild has some kind of support for cross-architecture builds, we still consider it as experimental, not-yet-production-ready feature. This commit adds a support to composer and worker to communicate using TCP. To ensure safe communication through the wild worlds of Internet, TLS is not only supported but even required when using TCP. Both server and client TLS authentication are required. This means both sides must have their own private key/certificate pair and both certificates must be signed using one certificate authority. Examples how to generate all this fancy crypto stuff can be found in Makefile. Changes on the composer side: When osbuild-remote-worker.socket is started before osbuild-composer.service, osbuild-composer also serves jobqueue API on this socket. The unix domain socket is not affected by this changes - it is enabled at all times independently on the remote one. The osbuild-remote-worker.socket listens by default on TCP port 8700. When running the composer with remote worker socket enabled, the following files are required: - /etc/osbuild-composer/ca-crt.pem (CA certificate) - /etc/osbuild-composer/composer-key.pem (composer private key) - /etc/osbuild-composer/composer-crt.pem (composer certificate) Changes on the worker side: osbuild-worker has now --remote argument taking the address to a composer instance. When present, the worker will try to establish TLS secured TCP connection with the composer. When not present, the worker will use the unix domain socket method. The unit template file osbuild-remote-worker was added to simplify the spawning of workers. For example systemctl start osbuild-remote-worker@example.com starts a worker which will attempt to connect to the composer instance running on the address example.com. When running the worker with --remote argument, the following files are required: - /etc/osbuild-composer/ca-crt.pem (CA certificate) - /etc/osbuild-composer/worker-key.pem (worker private key) - /etc/osbuild-composer/worker-crt.pem (worker certificate) By default osbuild-composer.service will always spawn one local worker. If you don't want it you need to mask the default worker unit by: systemctl mask osbuild-worker@1.service Closing remarks: Remember that both composer and worker certificate must be signed by the same CA!
13 lines
300 B
Desktop File
13 lines
300 B
Desktop File
[Unit]
|
|
Description=OSBuild Composer Remote Worker (%i)
|
|
After=multi-user.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
PrivateTmp=true
|
|
ExecStart=/usr/libexec/osbuild-composer/osbuild-worker --remote %i
|
|
CacheDirectory=osbuild-composer
|
|
Restart=on-failure
|
|
RestartSec=10s
|
|
CPUSchedulingPolicy=batch
|
|
IOSchedulingClass=idle
|