[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[bug#32141] [PATCH] services: Add ddclient service.
From: |
Ludovic Courtès |
Subject: |
[bug#32141] [PATCH] services: Add ddclient service. |
Date: |
Thu, 26 Jul 2018 10:51:30 +0200 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) |
Hi Oleg,
Oleg Pykhalov <address@hidden> skribis:
> address@hidden (Ludovic Courtès) writes:
[...]
>>> address@hidden ddclient Service
>>> +
>>> address@hidden ddclient
>>> address@hidden://sourceforge.net/projects/ddclient/, ddclient} is an address
>>> +updating utility for dynamic DNS services.
>>
>> It would be nice to expound a bit, like:
>>
>> The ddclient service described below runs the ddclient daemon, which
>> takes care of automatically updating DNS entries for service providers
>> such as DynDNS.com.
>
> OK. I improved little bit with “such as @uref{https://dyn.com/dns/,
> Dyn}.” if you don't mind.
Sure.
>> Does it run as root? If there’s no option to run it (mostly) as
>> non-root, perhaps it would make sense to try using
>> ‘make-forkexec-constructor/container’ here (as a separate patch.)
>>
>> WDYT?
>
> It did run as root. I've succeeded to run it with ‘ddclient’ user.
Awesome.
> Also, the generated ‘ddclient.conf’ which contains secrets is stored in
> the store. I probably should change the ‘ddclient-activation’ procedure
>
> (copy-file #$(plain-file "ddclient.conf" config-str) file)
>
> to a procedure which writes ‘config-str’ to the file without storing it
> somewhere else. WDYT?
The problem would be the same: the activation script would contain
‘config-str’, and it would live in the store.
In short we must not manipulate secrets in anything that goes through
the store. The only thing I can suggest is to leave it up to the
user to create a file containing the secret in an out-of-band fashion;
/etc is a good place for such things.
For example, they could create /etc/ddclient-secrets and then we would
somehow arrange to get that file read.
To do that there are two possibilities that come to mind:
1. If the config file syntax has an “include” directive, just include
/etc/ddclient-secrets unconditionally in the generated config file.
2. Write an activation snippet that concatenates the generated config
file with /etc/ddclient-secrets and stores that as
/etc/ddclient.conf (or something like that.)
Thoughts?
Ludo’.