From 28f6319b77d35c6da6b99ad7e35d0d5602dc2ee6 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Fri, 10 Apr 2026 18:03:29 +0300 Subject: Fix known-hosts trust deadlock, host key stat, and optional nozstd build - stdout logger: release mutex while waiting on pause resume so prompt callbacks can log (fixes hang after trusting new hosts; known_hosts was written but Resume never ran). - known hosts callback: stop borrowing the SSH dial throttle channel (could block or interact badly with parallel handshakes). - host key path: use errors.Is(..., fs.ErrNotExist) for RootedPath.Stat wrapped errors; stat errors now fail fast instead of mis-read. - public key path: same ErrNotExist check for authorized_keys miss. - Build: optional DTAIL_NO_ZSTD=yes / nozstd tag for CGO-free builds; split zstd readers into tagged files. - Docs/examples: firewalld note for port 2222, log prune timer+script, SSHBindAddress note, dserver unit disabled-by-default comment; firewalld helper script example. - Regression test for stdout pause/mutex behavior. Made-with: Cursor --- examples/firewalld-dserver-port.sh.example | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 examples/firewalld-dserver-port.sh.example (limited to 'examples/firewalld-dserver-port.sh.example') diff --git a/examples/firewalld-dserver-port.sh.example b/examples/firewalld-dserver-port.sh.example new file mode 100644 index 0000000..f10ce08 --- /dev/null +++ b/examples/firewalld-dserver-port.sh.example @@ -0,0 +1,21 @@ +#!/bin/bash +# Allow inbound TCP to dserver (default port 2222) when firewalld is used. +# Run once on the server as root, or fold into your config management. + +set -euo pipefail + +PORT="${DTAIL_FIREWALL_PORT:-2222}" + +if ! command -v firewall-cmd >/dev/null 2>&1; then + echo "firewall-cmd not found; skip or configure your firewall manually." >&2 + exit 0 +fi + +if ! firewall-cmd --state >/dev/null 2>&1; then + echo "firewalld not running; nothing to do." >&2 + exit 0 +fi + +firewall-cmd --permanent "--add-port=${PORT}/tcp" +firewall-cmd --reload +echo "Opened ${PORT}/tcp. Current ports: $(firewall-cmd --list-ports)" -- cgit v1.2.3