Repository navigation
fix: every PostgreSQL cluster starts after keel-host-keys - #45
Open
marcos-mendez wants to merge 1 commit into
Open
marcos-mendez wants to merge 1 commit into
marcos-mendez wants to merge 1 commit into
Conversation
The step 12 PostgreSQL image of 2026-10-09 started postgresql@17-main before keel-host-keys.service made the snakeoil pair. The cluster stopped with 'could not load server certificate file "/etc/ssl/certs/ssl-cert-snakeoil.pem"', and 35pgsqlpass and 36pgsqlverify failed. keel-host-keys.service is Before=postgresql.service, but that orders no cluster: postgresql.service is the meta unit of postgresql-common, and each [email protected] is itself Before= it. The package now installs the drop-in /usr/lib/systemd/system/[email protected]/keel-host-keys.conf with Wants= and After=keel-host-keys.service. It applies to every instance of the template. It has no Condition, so a fault stays visible. No key goes into the image. tests/test-packaging.bats checks the install line and asks systemd-analyze verify for the order, with the units of postgresql-common 278 as fixtures: a probe that wants the opposite order gives an ordering cycle with the drop-in and none without it.
marcos-mendez
added a commit
to Keel-Linux/keel-postgresql
that referenced
this pull request
Oct 10, 2026
…first boot On the step 12 image of 2026-10-09, postgresql@17-main started before keel-host-keys made the snakeoil certificate and stopped. 35pgsqlpass and 36pgsqlverify failed, then 36pgsqlverify started the cluster again, so the cluster was active at the end. The boot test failed only later, on the declared password. Reproduced on the published layer with keel-host-keys made 10 s slower. tests/boot-test.sh now checks, after the first boot: - bt_db_hooks_verdict: 35pgsqlpass and 36pgsqlverify completed, from /var/log/inithooks.log; - bt_cluster_verdict: there is a cluster unit (systemctl list-units postgresql@*.service) and every cluster is active (running). Seven new tests in tests/boot-test.bats; tests/lib/boot-test-lib.sh stays at 100 percent. The fix is Keel-Linux/inithooks#45.
Collaborator
Author
|
Reproduced on the published postgresql layer in LXC, with keel-host-keys made 10 s slower: the cluster stopped on the missing snakeoil certificate and 35pgsqlpass and 36pgsqlverify failed. With this drop-in in the same rootfs, the cluster starts after keel-host-keys and both hooks complete. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On the step 12 PostgreSQL image (2026-10-09),
35pgsqlpassand36pgsqlverifyfailed at first boot.postgresql@17-mainhad started beforekeel-host-keys.servicemade the snakeoil pair:FATAL: could not load server certificate file "/etc/ssl/certs/ssl-cert-snakeoil.pem": No such file or directory.Cause
keel-host-keys.serviceisBefore=postgresql.service. That orders no cluster:postgresql.serviceis the meta unit of postgresql-common, and each[email protected]is itselfBefore=postgresql.service. The build removes the snakeoil pair (no key in the image), so on the first boot the cluster raced the unit that makes it.Change
The package installs
/usr/lib/systemd/system/[email protected]/keel-host-keys.confwithWants=andAfter=keel-host-keys.service. A drop-in for the template applies to every cluster, in every image that has PostgreSQL (keel-postgresql, unit-postgresql for LAPP, Odoo). No Condition, so a fault stays visible. No key goes into the image. The comment inkeel-host-keys.servicesays where the cluster order comes from.Tests
tests/test-packaging.bats: the install line, the drop-in content, and the order as systemd sees it. With the units of postgresql-common 278 (tests/fixtures/), a probe unit that asks for the opposite order gives an ordering cycle insystemd-analyze verifywith the drop-in, and none without it.systemd-analyze verifyaccepts the template with the drop-in.Changelog 2.3.6+keel26. The keel-postgresql boot test gate gets the assertion that the cluster is active after first boot in a separate PR.