Commit Graph

1139 Commits

Author SHA1 Message Date
Girish Ramakrishnan
9c7e9e25ca scheduler: respect cloudron timezone setting 2025-01-02 10:11:14 +01:00
Girish Ramakrishnan
4ffe736d46 mail: dns list crash fix 2025-01-02 09:24:51 +01:00
Girish Ramakrishnan
13d82e5a4d mail: fix issue with dkim signing 2025-01-01 18:33:04 +01:00
Girish Ramakrishnan
a7f083dbd1 gandi: get token type in setup view 2025-01-01 15:43:46 +01:00
Girish Ramakrishnan
c31da4eb2a add to changelog 2024-12-19 15:40:58 +01:00
Girish Ramakrishnan
68431ae357 rename functions to avoid mistakes
the remove fields are not clear enough. we sent notes by mistake to
normal users. changing the name and passing role as the argument
will avoid these errors
2024-12-19 12:24:08 +01:00
Girish Ramakrishnan
6b7edbd552 docker: fallback to quay if docker hub does not work 2024-12-14 15:22:12 +01:00
Johannes Zellner
9ed424a5d9 Add some changes 2024-12-12 11:22:15 +01:00
Girish Ramakrishnan
be340580d4 various notification fixes 2024-12-11 23:58:17 +01:00
Girish Ramakrishnan
98058f600e archive: prefill secondary domain correctly 2024-12-10 19:27:19 +01:00
Girish Ramakrishnan
ada878c939 hetzner: add helsinki object storage location 2024-12-09 09:44:35 +01:00
Girish Ramakrishnan
bb392207ea remove global lock
Currently, the update/apptask/fullbackup/platformstart take a
global lock and cannot run in parallel. This causes situations
where when a user tries to trigger an apptask, it says "waiting for
backup to finish..." etc

The solution is to let them run in parallel. We need a lock at the
app level as app operations running in parallel would be bad (tm).
In addition, the update task needs a lock just for the update part.
We also need multi-process locks. Running tasks as processes is core
to our "kill" strategy.

Various inter process locks were explored:

* node's IPC mechanism with process.send(). But this only works for direct node.js
children. taskworker is run via sudo and the IPC does not work.

* File lock using O_EXCL. Basic ideas to create lock files. While file creation
can be done atomically, it becomes complicated to clean up lock files when
the tasks crash. We need a way to know what locks were held by the crashing task.
flock and friends are not built-into node.js

* sqlite/redis were options but introduce additional deps

* Settled on MySQL based locking. Initial plan was to have row locks
or table locks. Each row is a kind of lock. While implementing, it was found that
we need many types of locks (and not just update lock and app locks). For example,
we need locks for each task type, so that only one task type is active at a time.

* Instead of rows, we can just lock table and have a json blob in it. This hit a road
block that LOCK TABLE is per session and our db layer cannot handle this easily! i.e
when issing two db.query() it might use two different connections from the pool. We have to
expose the connection, release connection etc.

* Next idea was atomic blob update of the blob checking if old blob was same. This approach,
was finally refined into a version field.

Phew!
2024-12-07 20:41:22 +01:00
Girish Ramakrishnan
a5b9ff0c3a add to changelog 2024-12-07 11:27:52 +01:00
Girish Ramakrishnan
3b9d617e37 groups: add events to eventlog 2024-12-04 11:30:30 +01:00
Girish Ramakrishnan
872705d58d oidc: use the cloudron name as provider name 2024-12-02 12:01:19 +01:00
Girish Ramakrishnan
1ecb853309 mail: attachment search 2024-11-30 17:42:26 +01:00
Girish Ramakrishnan
2a6c52800b system: filesystems in exclude are excluded from content analysis
some disks can be very slow and noisy (at home). this allows users to simply skip them.
also, applicable for large storage boxes
2024-11-30 13:08:21 +01:00
Girish Ramakrishnan
948efbaa76 docker: upgrade docker to 27.3.1 2024-11-23 20:31:44 +05:30
Girish Ramakrishnan
f8cd0b5f52 add sqlite3 addon 2024-11-21 00:13:17 +05:30
Girish Ramakrishnan
18abc214a6 mail: update haraka to 3.0.5 2024-11-20 06:32:13 +05:30
Girish Ramakrishnan
fd96665e97 rsync: show better error message with too many empty dirs, symlinks or executables 2024-11-18 08:11:14 +05:30
Girish Ramakrishnan
32e3665b7a more changes 2024-11-08 17:15:40 +01:00
Johannes Zellner
620ad13427 Add more changes 2024-11-01 16:03:19 +01:00
Girish Ramakrishnan
ce5a2b1f0a gandi: use PAT token instead
https://api.gandi.net/docs/authentication/
2024-10-08 17:51:01 +02:00
Girish Ramakrishnan
b70747de6f Add Cloudron Container Registry as option 2024-09-26 20:35:28 +02:00
Girish Ramakrishnan
0504e0423a backups: add hetzner object storage 2024-09-25 12:21:42 +02:00
Girish Ramakrishnan
e8850eeac2 8.0.6 changelog 2024-09-18 15:33:42 +02:00
Girish Ramakrishnan
a932a5251a update: all operators to update an app
previously, the update info was restricted to admins. this can now be queried
by any authenticated user. update information can be gathered from listing apps and
then checking against appstore anyway.
2024-09-13 16:46:58 +02:00
Girish Ramakrishnan
0647a3a233 unbound: prefer ip4 on ubuntu 24 and above
ip6 queries seems to be blocked by spamhaus
2024-09-12 17:13:50 +02:00
Girish Ramakrishnan
e9a422b657 logs: handle logs not found (logrotated)
we show an error message in the UI now
2024-09-12 10:32:00 +02:00
Girish Ramakrishnan
23df6bdfbf add to changes 2024-09-11 17:55:35 +02:00
Girish Ramakrishnan
63457d2de4 Revert "docker: use the system dns for app containers"
This reverts commit 92bce26e22.
2024-09-10 19:37:39 +02:00
Girish Ramakrishnan
732c944e98 changelog: update release version 2024-09-10 17:43:18 +02:00
Girish Ramakrishnan
8c0c9981de remove usage of nsyslog-parser-2
this module is somehow parsing the syslog incorrectly causing
incorrect directories being created in the logs directory
(since appName got parsed incorrectly)
2024-09-10 13:09:43 +02:00
Girish Ramakrishnan
92bce26e22 docker: use the system dns for app containers 2024-09-10 09:42:31 +02:00
Girish Ramakrishnan
6742cdf373 backups: remount remote if not mounted before a backup 2024-09-09 18:15:49 +02:00
Girish Ramakrishnan
565ad83399 add to changes 2024-09-09 09:29:54 +02:00
Girish Ramakrishnan
4301c70ba7 exoscale: add sos AT-VIE-2 region 2024-09-02 22:01:29 +02:00
Girish Ramakrishnan
d5e9e556ab digitalocean: add LON1 region 2024-09-02 20:58:14 +02:00
Girish Ramakrishnan
bdf9e04963 memory: ensure slider is always usable 2024-08-30 12:07:55 +02:00
Girish Ramakrishnan
b95285365d 8.1.0 changes 2024-08-28 11:51:01 +02:00
Girish Ramakrishnan
a865320e3a 8.0.4 changes 2024-08-18 10:40:40 +02:00
Girish Ramakrishnan
1e5e4e3189 ionos: add contract-owned eu-central-3 2024-08-12 15:56:18 +02:00
Girish Ramakrishnan
468d4dd9b0 ami: imdsv2 support
https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/

One has to get a token now via PUT. This is because there is a bunch of
open proxies out there which blindly forwarded everything to internal network
including metadata requests. They have found that PUT requests don't cleanly
proxy and also AWS rejects token requests with X-Forwarded-For.
2024-07-27 14:48:42 +02:00
Girish Ramakrishnan
06e46e0f1e 8.0.3 changes 2024-07-26 09:09:35 +02:00
Girish Ramakrishnan
3132b3035a 8.0.2 changes 2024-07-23 08:34:26 +02:00
Girish Ramakrishnan
885aac69c5 tgz: handle addEntryToPack to error 2024-07-18 14:47:31 +02:00
Girish Ramakrishnan
421567ff14 Add to changes 2024-07-15 21:52:04 +02:00
Girish Ramakrishnan
1dc6b40a68 tgz: extract using tar-stream directly
we used have a fork of tar-fs. using tar-stream directly gives us
more control
2024-07-08 13:06:56 +02:00
Girish Ramakrishnan
86530df37e mailer: add html version of test mail 2024-07-05 11:07:51 +02:00