Commit Graph

1139 Commits

Author SHA1 Message Date
Girish Ramakrishnan 9c7e9e25ca scheduler: respect cloudron timezone setting 2025-01-02 10:11:14 +01:00
Girish Ramakrishnan 4ffe736d46 mail: dns list crash fix 2025-01-02 09:24:51 +01:00
Girish Ramakrishnan 13d82e5a4d mail: fix issue with dkim signing 2025-01-01 18:33:04 +01:00
Girish Ramakrishnan a7f083dbd1 gandi: get token type in setup view 2025-01-01 15:43:46 +01:00
Girish Ramakrishnan c31da4eb2a add to changelog 2024-12-19 15:40:58 +01:00
Girish Ramakrishnan 68431ae357 rename functions to avoid mistakes
the remove fields are not clear enough. we sent notes by mistake to
normal users. changing the name and passing role as the argument
will avoid these errors
2024-12-19 12:24:08 +01:00
Girish Ramakrishnan 6b7edbd552 docker: fallback to quay if docker hub does not work 2024-12-14 15:22:12 +01:00
Johannes Zellner 9ed424a5d9 Add some changes 2024-12-12 11:22:15 +01:00
Girish Ramakrishnan be340580d4 various notification fixes 2024-12-11 23:58:17 +01:00
Girish Ramakrishnan 98058f600e archive: prefill secondary domain correctly 2024-12-10 19:27:19 +01:00
Girish Ramakrishnan ada878c939 hetzner: add helsinki object storage location 2024-12-09 09:44:35 +01:00
Girish Ramakrishnan bb392207ea remove global lock
Currently, the update/apptask/fullbackup/platformstart take a
global lock and cannot run in parallel. This causes situations
where when a user tries to trigger an apptask, it says "waiting for
backup to finish..." etc

The solution is to let them run in parallel. We need a lock at the
app level as app operations running in parallel would be bad (tm).
In addition, the update task needs a lock just for the update part.
We also need multi-process locks. Running tasks as processes is core
to our "kill" strategy.

Various inter process locks were explored:

* node's IPC mechanism with process.send(). But this only works for direct node.js
children. taskworker is run via sudo and the IPC does not work.

* File lock using O_EXCL. Basic ideas to create lock files. While file creation
can be done atomically, it becomes complicated to clean up lock files when
the tasks crash. We need a way to know what locks were held by the crashing task.
flock and friends are not built-into node.js

* sqlite/redis were options but introduce additional deps

* Settled on MySQL based locking. Initial plan was to have row locks
or table locks. Each row is a kind of lock. While implementing, it was found that
we need many types of locks (and not just update lock and app locks). For example,
we need locks for each task type, so that only one task type is active at a time.

* Instead of rows, we can just lock table and have a json blob in it. This hit a road
block that LOCK TABLE is per session and our db layer cannot handle this easily! i.e
when issing two db.query() it might use two different connections from the pool. We have to
expose the connection, release connection etc.

* Next idea was atomic blob update of the blob checking if old blob was same. This approach,
was finally refined into a version field.

Phew!
2024-12-07 20:41:22 +01:00
Girish Ramakrishnan a5b9ff0c3a add to changelog 2024-12-07 11:27:52 +01:00
Girish Ramakrishnan 3b9d617e37 groups: add events to eventlog 2024-12-04 11:30:30 +01:00
Girish Ramakrishnan 872705d58d oidc: use the cloudron name as provider name 2024-12-02 12:01:19 +01:00
Girish Ramakrishnan 1ecb853309 mail: attachment search 2024-11-30 17:42:26 +01:00
Girish Ramakrishnan 2a6c52800b system: filesystems in exclude are excluded from content analysis
some disks can be very slow and noisy (at home). this allows users to simply skip them.
also, applicable for large storage boxes
2024-11-30 13:08:21 +01:00
Girish Ramakrishnan 948efbaa76 docker: upgrade docker to 27.3.1 2024-11-23 20:31:44 +05:30
Girish Ramakrishnan f8cd0b5f52 add sqlite3 addon 2024-11-21 00:13:17 +05:30
Girish Ramakrishnan 18abc214a6 mail: update haraka to 3.0.5 2024-11-20 06:32:13 +05:30
Girish Ramakrishnan fd96665e97 rsync: show better error message with too many empty dirs, symlinks or executables 2024-11-18 08:11:14 +05:30
Girish Ramakrishnan 32e3665b7a more changes 2024-11-08 17:15:40 +01:00
Johannes Zellner 620ad13427 Add more changes 2024-11-01 16:03:19 +01:00
Girish Ramakrishnan ce5a2b1f0a gandi: use PAT token instead
https://api.gandi.net/docs/authentication/
2024-10-08 17:51:01 +02:00
Girish Ramakrishnan b70747de6f Add Cloudron Container Registry as option 2024-09-26 20:35:28 +02:00
Girish Ramakrishnan 0504e0423a backups: add hetzner object storage 2024-09-25 12:21:42 +02:00
Girish Ramakrishnan e8850eeac2 8.0.6 changelog 2024-09-18 15:33:42 +02:00
Girish Ramakrishnan a932a5251a update: all operators to update an app
previously, the update info was restricted to admins. this can now be queried
by any authenticated user. update information can be gathered from listing apps and
then checking against appstore anyway.
2024-09-13 16:46:58 +02:00
Girish Ramakrishnan 0647a3a233 unbound: prefer ip4 on ubuntu 24 and above
ip6 queries seems to be blocked by spamhaus
2024-09-12 17:13:50 +02:00
Girish Ramakrishnan e9a422b657 logs: handle logs not found (logrotated)
we show an error message in the UI now
2024-09-12 10:32:00 +02:00
Girish Ramakrishnan 23df6bdfbf add to changes 2024-09-11 17:55:35 +02:00
Girish Ramakrishnan 63457d2de4 Revert "docker: use the system dns for app containers"
This reverts commit 92bce26e22.
2024-09-10 19:37:39 +02:00
Girish Ramakrishnan 732c944e98 changelog: update release version 2024-09-10 17:43:18 +02:00
Girish Ramakrishnan 8c0c9981de remove usage of nsyslog-parser-2
this module is somehow parsing the syslog incorrectly causing
incorrect directories being created in the logs directory
(since appName got parsed incorrectly)
2024-09-10 13:09:43 +02:00
Girish Ramakrishnan 92bce26e22 docker: use the system dns for app containers 2024-09-10 09:42:31 +02:00
Girish Ramakrishnan 6742cdf373 backups: remount remote if not mounted before a backup 2024-09-09 18:15:49 +02:00
Girish Ramakrishnan 565ad83399 add to changes 2024-09-09 09:29:54 +02:00
Girish Ramakrishnan 4301c70ba7 exoscale: add sos AT-VIE-2 region 2024-09-02 22:01:29 +02:00
Girish Ramakrishnan d5e9e556ab digitalocean: add LON1 region 2024-09-02 20:58:14 +02:00
Girish Ramakrishnan bdf9e04963 memory: ensure slider is always usable 2024-08-30 12:07:55 +02:00
Girish Ramakrishnan b95285365d 8.1.0 changes 2024-08-28 11:51:01 +02:00
Girish Ramakrishnan a865320e3a 8.0.4 changes 2024-08-18 10:40:40 +02:00
Girish Ramakrishnan 1e5e4e3189 ionos: add contract-owned eu-central-3 2024-08-12 15:56:18 +02:00
Girish Ramakrishnan 468d4dd9b0 ami: imdsv2 support
https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/

One has to get a token now via PUT. This is because there is a bunch of
open proxies out there which blindly forwarded everything to internal network
including metadata requests. They have found that PUT requests don't cleanly
proxy and also AWS rejects token requests with X-Forwarded-For.
2024-07-27 14:48:42 +02:00
Girish Ramakrishnan 06e46e0f1e 8.0.3 changes 2024-07-26 09:09:35 +02:00
Girish Ramakrishnan 3132b3035a 8.0.2 changes 2024-07-23 08:34:26 +02:00
Girish Ramakrishnan 885aac69c5 tgz: handle addEntryToPack to error 2024-07-18 14:47:31 +02:00
Girish Ramakrishnan 421567ff14 Add to changes 2024-07-15 21:52:04 +02:00
Girish Ramakrishnan 1dc6b40a68 tgz: extract using tar-stream directly
we used have a fork of tar-fs. using tar-stream directly gives us
more control
2024-07-08 13:06:56 +02:00
Girish Ramakrishnan 86530df37e mailer: add html version of test mail 2024-07-05 11:07:51 +02:00