chore: Debian 12 → 13 (Trixie) migration, service hardening
- Update all references from Debian 12 (Bookworm) to Debian 13 (Trixie) - Enable SystemCallArchitectures, RestrictAddressFamilies, RestrictRealtime in archipelago.service (safe on systemd 256+ which respects NoNewPrivileges=no) - Update GLIBC compatibility checks from 2.36 to 2.40 - ISO filename, build container, and docs updated throughout Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Dorian
co-authored by
Claude Opus 4.6
Claude Opus 4.6
parent
fe3c844fe6
commit
a0a7aadcb3
@@ -74,7 +74,7 @@ From your dev server (192.168.1.228):
|
||||
|
||||
## Current Status
|
||||
|
||||
**Latest Working ISO**: `archipelago-debian-12-x86_64.iso` (469M, built 18:28)
|
||||
**Latest Working ISO**: `archipelago-debian-13-x86_64.iso` (469M, built 18:28)
|
||||
- This ISO was built earlier today
|
||||
- Contains the auto-installer
|
||||
- **Should be tested** - might already have your live server state
|
||||
|
||||
@@ -35,7 +35,7 @@ See the Architecture documentation for detailed system information.
|
||||
|
||||
## What's Included
|
||||
|
||||
- **Debian Linux Base**: Stable Debian 12 (Bookworm) distribution
|
||||
- **Debian Linux Base**: Stable Debian 13 (Trixie) distribution
|
||||
- **Podman**: Container runtime for apps (rootless by default)
|
||||
- **Archipelago Backend**: Rust-based API server
|
||||
- **Archipelago Frontend**: Vue.js web interface
|
||||
@@ -44,7 +44,7 @@ See the Architecture documentation for detailed system information.
|
||||
|
||||
## Build Output
|
||||
|
||||
- `results/archipelago-debian-12-x86_64.iso` - Bootable hybrid ISO image
|
||||
- `results/archipelago-debian-13-x86_64.iso` - Bootable hybrid ISO image
|
||||
|
||||
## Supported Platforms
|
||||
|
||||
|
||||
@@ -905,10 +905,9 @@ mkdir -p "$ARCH_DIR"
|
||||
mkdir -p "$ARCH_DIR/bin"
|
||||
mkdir -p "$ARCH_DIR/scripts"
|
||||
|
||||
# netavark + aardvark-dns are installed in the rootfs via Dockerfile.rootfs (Debian 12 packages).
|
||||
# Do NOT copy from the build host — the host may run a newer glibc (e.g. Debian 13)
|
||||
# and the resulting binary will fail on the Debian 12 target with GLIBC_2.39 not found.
|
||||
echo " netavark + aardvark-dns: included in rootfs (Debian 12 packages)"
|
||||
# netavark + aardvark-dns are installed in the rootfs via Dockerfile.rootfs (Debian 13 packages).
|
||||
# Do NOT copy from the build host — the host may run a different glibc version.
|
||||
echo " netavark + aardvark-dns: included in rootfs (Debian 13 packages)"
|
||||
|
||||
# Copy the pre-built rootfs
|
||||
echo " Including root filesystem..."
|
||||
@@ -967,9 +966,9 @@ BACKENDFILE
|
||||
fi
|
||||
|
||||
# Extract NostrVPN binary from container image (native system service, not a container app)
|
||||
# NOTE: The container image must be built against Debian 12's GLIBC (2.36).
|
||||
# If built against a newer GLIBC (e.g. 2.39 from Ubuntu 24.10), the binary will fail
|
||||
# at runtime with "GLIBC_2.39 not found". Rebuild with: FROM debian:12 AS builder
|
||||
# NOTE: The container image must be built against Debian 13's GLIBC (2.40).
|
||||
# If built against a newer GLIBC, the binary will fail at runtime.
|
||||
# Rebuild with: FROM debian:13 AS builder
|
||||
echo " Extracting NostrVPN binary..."
|
||||
_NVPN_IMG="${NOSTR_VPN_IMAGE:-80.71.235.15:3000/archipelago/nostr-vpn:v0.3.7}"
|
||||
NVPN_IMAGE_ID="$($CONTAINER_CMD images -q "$_NVPN_IMG" 2>/dev/null)"
|
||||
@@ -982,17 +981,17 @@ if [ -n "$NVPN_CONTAINER" ]; then
|
||||
chmod +x "$ARCH_DIR/bin/nvpn" && \
|
||||
echo " ✅ NostrVPN binary extracted ($(du -h "$ARCH_DIR/bin/nvpn" | cut -f1))"
|
||||
$CONTAINER_CMD rm "$NVPN_CONTAINER" 2>/dev/null || true
|
||||
# Check GLIBC compatibility — Debian 12 has GLIBC 2.36
|
||||
# Check GLIBC compatibility — Debian 13 (Trixie) has GLIBC 2.40
|
||||
if [ -f "$ARCH_DIR/bin/nvpn" ]; then
|
||||
NVPN_GLIBC=$(objdump -T "$ARCH_DIR/bin/nvpn" 2>/dev/null | grep -oP 'GLIBC_\K[0-9.]+' | sort -V | tail -1)
|
||||
if [ -n "$NVPN_GLIBC" ]; then
|
||||
# Compare: if required GLIBC > 2.36, warn
|
||||
if printf '%s\n' "2.36" "$NVPN_GLIBC" | sort -V | tail -1 | grep -qv "^2\.36$"; then
|
||||
echo " ⚠ WARNING: nvpn binary requires GLIBC $NVPN_GLIBC but Debian 12 has 2.36"
|
||||
echo " ⚠ The nvpn daemon will fail at runtime. Rebuild the container against Debian 12."
|
||||
# Compare: if required GLIBC > 2.40, warn
|
||||
if printf '%s\n' "2.40" "$NVPN_GLIBC" | sort -V | tail -1 | grep -qv "^2\.40$"; then
|
||||
echo " ⚠ WARNING: nvpn binary requires GLIBC $NVPN_GLIBC but Debian 13 has 2.40"
|
||||
echo " ⚠ The nvpn daemon will fail at runtime. Rebuild the container against Debian 13."
|
||||
echo " ⚠ VPN invite/status will still work via Rust backend config.toml fallback."
|
||||
else
|
||||
echo " ✅ nvpn GLIBC compatibility OK (requires $NVPN_GLIBC, target has 2.36)"
|
||||
echo " ✅ nvpn GLIBC compatibility OK (requires $NVPN_GLIBC, target has 2.40)"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
@@ -2048,7 +2047,7 @@ REGCONF
|
||||
chown -R 1000:1000 /mnt/target/home/archipelago/.config
|
||||
|
||||
# Configure podman to use netavark backend (enables container DNS on archy-net).
|
||||
# netavark + aardvark-dns binaries come from the rootfs (Debian 12 apt packages).
|
||||
# netavark + aardvark-dns binaries come from the rootfs (Debian 13 apt packages).
|
||||
if [ -f /mnt/target/usr/lib/podman/netavark ]; then
|
||||
mkdir -p /mnt/target/home/archipelago/.config/containers
|
||||
cat > /mnt/target/home/archipelago/.config/containers/containers.conf <<'CONTAINERSCONF'
|
||||
|
||||
@@ -34,12 +34,11 @@ NoNewPrivileges=no
|
||||
PrivateDevices=no
|
||||
SupplementaryGroups=dialout debian-tor
|
||||
|
||||
# Network, syscall, and realtime restrictions DISABLED on Debian 12:
|
||||
# RestrictAddressFamilies, SystemCallArchitectures, and RestrictRealtime all use
|
||||
# seccomp filters that force no_new_privs=1 in the kernel (systemd 252).
|
||||
# This blocks sudo, which is required for archipelago-wg (WireGuard peer management).
|
||||
# Debian 13+ (systemd 256) respects NoNewPrivileges=no as an override, but Debian 12 does not.
|
||||
# Re-enable these when dropping Debian 12 support.
|
||||
# Syscall and network restrictions — safe on Debian 13 (systemd 256+)
|
||||
# which respects NoNewPrivileges=no as an explicit override for seccomp filters
|
||||
SystemCallArchitectures=native
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
||||
RestrictRealtime=yes
|
||||
|
||||
# MemoryDenyWriteExecute removed: ring (rustls) and secp256k1 (bitcoin/nostr)
|
||||
# use assembly code that requires executable memory mappings on some platforms
|
||||
|
||||
@@ -20,7 +20,7 @@ if [ -z "$1" ]; then
|
||||
fi
|
||||
|
||||
USB_DISK="$1"
|
||||
ISO_FILE="$SCRIPT_DIR/results/archipelago-debian-12-x86_64.iso"
|
||||
ISO_FILE="$SCRIPT_DIR/results/archipelago-debian-13-x86_64.iso"
|
||||
WORK_DIR="$SCRIPT_DIR/build/usb-extract"
|
||||
|
||||
if [ ! -f "$ISO_FILE" ]; then
|
||||
|
||||
@@ -32,7 +32,7 @@ if [ "$USE_DOCKER" = true ]; then
|
||||
-v "$PROJECT_ROOT:/workspace" \
|
||||
-v "$OUTPUT_DIR:/output" \
|
||||
-w /workspace/core/archipelago \
|
||||
rust:bookworm \
|
||||
rust:trixie \
|
||||
sh -c '
|
||||
echo "📦 Installing build dependencies..."
|
||||
apt-get update && apt-get install -y pkg-config libssl-dev
|
||||
|
||||
@@ -17,7 +17,7 @@ fi
|
||||
|
||||
USB_DISK="$1"
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||
ISO_FILE="$SCRIPT_DIR/results/archipelago-debian-12-x86_64.iso"
|
||||
ISO_FILE="$SCRIPT_DIR/results/archipelago-debian-13-x86_64.iso"
|
||||
|
||||
if [ ! -f "$ISO_FILE" ]; then
|
||||
echo "❌ ISO not found: $ISO_FILE"
|
||||
|
||||
Reference in New Issue
Block a user