shadowdaoandClaude Opus 5
80b03c884e
Code review caught that dumb-init is not a drop-in replacement for tini as invoked. tini without -g forwards a signal only to its direct child; dumb-init without --single-child calls setsid() and forwards to the entire process group. Verified against dumb-init 1.2.5 with a parent that catches SIGTERM and does not forward it: under the default the grandchild is still signalled, under --single-child it is not. Without the flag, `docker stop` delivered SIGTERM to the tenant's node process directly and simultaneously with pm2, bypassing pm2's kill_timeout shutdown sequencing. Since the wedged-container fix in #1 introduced tini specifically for its signal forwarding, the previous commit's claim that the two are equivalent did not hold. Also corrects MEMORY-GUIDE.md, which still described header buffers as "reduced" after they were raised from 2 1k to the nginx default of 4 8k. The nginx memory budget is unchanged: these buffers are allocated per request only when a request needs them, not preallocated per connection. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
113 lines
3.7 KiB
Bash
Executable File
113 lines
3.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
if [ -z "$NODEVER" ]; then
|
|
NODEVER="20";
|
|
fi
|
|
|
|
if [ -z "$environment" ]; then
|
|
environment="PROD"
|
|
fi
|
|
|
|
# Create user with proper error handling
|
|
if ! id -u $user >/dev/null 2>&1; then
|
|
echo "Creating user $user with UID $uid"
|
|
adduser -u $uid -m -s /bin/bash $user || {
|
|
echo "Failed to create user $user with UID $uid"
|
|
exit 1
|
|
}
|
|
else
|
|
echo "User $user already exists"
|
|
fi
|
|
|
|
mkdir -p /home/$user/app
|
|
mkdir -p /home/$user/logs/{nginx,nodejs}
|
|
|
|
# Link log directories
|
|
rm -rf /var/log/nginx
|
|
ln -s /home/$user/logs/nginx /var/log/nginx
|
|
ln -s /home/$user/logs/nodejs /var/log/nodejs
|
|
|
|
# Configure nginx for reverse proxy
|
|
/scripts/create-nginx-config.sh
|
|
|
|
# Set ownership and permissions
|
|
chown -R $user:$user /home/$user
|
|
chmod -R 755 /home/$user
|
|
|
|
# Start nginx
|
|
nginx
|
|
|
|
if [[ $environment == 'DEV' ]]; then
|
|
echo "Starting Dev Deployment"
|
|
|
|
# Ensure microdnf is available for installing additional packages in DEV mode
|
|
if ! command -v microdnf &> /dev/null; then
|
|
echo "microdnf not found, installing with dnf..."
|
|
dnf install -y microdnf && dnf clean all
|
|
fi
|
|
|
|
# Install Memcached for session storage in DEV mode with memory limit
|
|
microdnf install -y memcached
|
|
# Start memcached with 32MB memory limit
|
|
nohup memcached -d -u $user -p 11211 -m 32
|
|
|
|
fi
|
|
|
|
# Start cron for log rotation and backups
|
|
/usr/sbin/crond
|
|
|
|
# Create app directory if it doesn't exist
|
|
if [ ! -d /home/$user/app ]; then
|
|
echo "Creating app directory at /home/$user/app"
|
|
mkdir -p /home/$user/app
|
|
chown -R $user:$user /home/$user/app
|
|
fi
|
|
|
|
# If app directory is empty, copy the simple-website example
|
|
if [ -z "$(ls -A /home/$user/app)" ]; then
|
|
echo "App directory is empty, copying simple-website example..."
|
|
cp -r /examples/simple-website/* /home/$user/app/
|
|
chown -R $user:$user /home/$user/app
|
|
echo "Copied simple-website example to provide a working application"
|
|
fi
|
|
|
|
# Now there's always an app in the user directory (either user's or example)
|
|
cd /home/$user/app
|
|
|
|
# Verify user exists and show info
|
|
echo "Verifying user setup:"
|
|
id $user || { echo "ERROR: User $user does not exist!"; exit 1; }
|
|
|
|
# Install dependencies as the user
|
|
echo "Installing npm dependencies as user $user..."
|
|
su -c "npm install" $user
|
|
|
|
# Check if ecosystem.config.js exists, if not generate it
|
|
if [ ! -f /home/$user/app/ecosystem.config.js ]; then
|
|
echo "No ecosystem.config.js found, generating from package.json..."
|
|
/scripts/generate-ecosystem-config.sh "$user" "/home/$user/app"
|
|
chown $user:$user /home/$user/app/ecosystem.config.js
|
|
fi
|
|
|
|
# Mirror logs to docker logs in the background.
|
|
# Use -F (capital) so logrotate-recreated files keep streaming.
|
|
tail -F /home/$user/logs/nginx/access.log \
|
|
/home/$user/logs/nginx/error.log \
|
|
/home/$user/logs/nodejs/app.log \
|
|
/home/$user/logs/nodejs/out.log \
|
|
/home/$user/logs/nodejs/error.log 2>/dev/null &
|
|
|
|
# Start PM2 under dumb-init so it becomes PID 1 (with proper signal forwarding
|
|
# and zombie reaping for nginx/crond/memcached children that reparent here).
|
|
# When pm2 exits (e.g. max_restarts exhausted), dumb-init exits and Docker's
|
|
# restart policy brings the container back.
|
|
# (dumb-init replaces tini, which is not packaged in EPEL 10.)
|
|
#
|
|
# --single-child is required for parity with tini. dumb-init defaults to
|
|
# setsid() plus forwarding signals to the whole process group, whereas tini
|
|
# without -g forwards only to its direct child. Without this flag a
|
|
# `docker stop` would signal the tenant's node process directly and at the
|
|
# same moment as pm2, bypassing pm2's kill_timeout shutdown sequencing.
|
|
echo "Starting PM2 as user $user (under dumb-init as PID 1)..."
|
|
cd /home/$user/app
|
|
exec dumb-init --single-child -- su - $user -c "cd /home/$user/app && NODE_ENV=production pm2 start ecosystem.config.js --no-daemon" |