Keel-Linux/inithooks
1
0
Fork 1
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions 2

fix: every PostgreSQL cluster starts after keel-host-keys #45

Open
marcos-mendez wants to merge 1 commit from fix/postgresql-cluster-after-host-keys into master
pull from: fix/postgresql-cluster-after-host-keys
merge into: Keel-Linux:master
Conversation 1 Commits 1 Files changed 7 +173
marcos-mendez commented 2026-10-10 16:12:52 -03:00 (Migrated from github.com)
Copy link

On the step 12 PostgreSQL image (2026-10-09), 35pgsqlpass and 36pgsqlverify failed at first boot. postgresql@17-main had started before keel-host-keys.service made the snakeoil pair: FATAL: could not load server certificate file "/etc/ssl/certs/ssl-cert-snakeoil.pem": No such file or directory.

Cause

keel-host-keys.service is Before=postgresql.service. That orders no cluster: postgresql.service is the meta unit of postgresql-common, and each postgresql@VERSION-CLUSTER.service is itself Before=postgresql.service. The build removes the snakeoil pair (no key in the image), so on the first boot the cluster raced the unit that makes it.

Change

The package installs /usr/lib/systemd/system/postgresql@.service.d/keel-host-keys.conf with Wants= and After=keel-host-keys.service. A drop-in for the template applies to every cluster, in every image that has PostgreSQL (keel-postgresql, unit-postgresql for LAPP, Odoo). No Condition, so a fault stays visible. No key goes into the image. The comment in keel-host-keys.service says where the cluster order comes from.

Tests

tests/test-packaging.bats: the install line, the drop-in content, and the order as systemd sees it. With the units of postgresql-common 278 (tests/fixtures/), a probe unit that asks for the opposite order gives an ordering cycle in systemd-analyze verify with the drop-in, and none without it. systemd-analyze verify accepts the template with the drop-in.

Changelog 2.3.6+keel26. The keel-postgresql boot test gate gets the assertion that the cluster is active after first boot in a separate PR.

On the step 12 PostgreSQL image (2026-10-09), `35pgsqlpass` and `36pgsqlverify` failed at first boot. `postgresql@17-main` had started before `keel-host-keys.service` made the snakeoil pair: `FATAL: could not load server certificate file "/etc/ssl/certs/ssl-cert-snakeoil.pem": No such file or directory`. **Cause** `keel-host-keys.service` is `Before=postgresql.service`. That orders no cluster: `postgresql.service` is the meta unit of postgresql-common, and each `postgresql@VERSION-CLUSTER.service` is itself `Before=postgresql.service`. The build removes the snakeoil pair (no key in the image), so on the first boot the cluster raced the unit that makes it. **Change** The package installs `/usr/lib/systemd/system/postgresql@.service.d/keel-host-keys.conf` with `Wants=` and `After=keel-host-keys.service`. A drop-in for the template applies to every cluster, in every image that has PostgreSQL (keel-postgresql, unit-postgresql for LAPP, Odoo). No Condition, so a fault stays visible. No key goes into the image. The comment in `keel-host-keys.service` says where the cluster order comes from. **Tests** `tests/test-packaging.bats`: the install line, the drop-in content, and the order as systemd sees it. With the units of postgresql-common 278 (`tests/fixtures/`), a probe unit that asks for the opposite order gives an ordering cycle in `systemd-analyze verify` with the drop-in, and none without it. `systemd-analyze verify` accepts the template with the drop-in. Changelog 2.3.6+keel26. The keel-postgresql boot test gate gets the assertion that the cluster is active after first boot in a separate PR.
marcos-mendez commented 2026-10-10 16:26:36 -03:00 (Migrated from github.com)
Copy link

Reproduced on the published postgresql layer in LXC, with keel-host-keys made 10 s slower: the cluster stopped on the missing snakeoil certificate and 35pgsqlpass and 36pgsqlverify failed. With this drop-in in the same rootfs, the cluster starts after keel-host-keys and both hooks complete.

Reproduced on the published postgresql layer in LXC, with keel-host-keys made 10 s slower: the cluster stopped on the missing snakeoil certificate and 35pgsqlpass and 36pgsqlverify failed. With this drop-in in the same rootfs, the cluster starts after keel-host-keys and both hooks complete.
This pull request has changes conflicting with the target branch.
  • debian/changelog
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/postgresql-cluster-after-host-keys:fix/postgresql-cluster-after-host-keys
git switch fix/postgresql-cluster-after-host-keys
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
accessibility

Barrier affecting people with disabilities

  
bug

Something isn't working

  
documentation

Improvements or additions to documentation

  
duplicate

This issue or pull request already exists

  
enhancement

New feature or request

  
good first issue

Good for newcomers

  
help wanted

Extra attention is needed

  
invalid

This doesn't seem right

  
question

Further information is requested

  
wontfix

This will not be worked on

No labels
accessibility
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Keel-Linux/inithooks!45
No description provided.