services

package
v1.230.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 14, 2026 License: MPL-2.0 Imports: 11 Imported by: 0

Documentation

Overview

============================================================================= NFTBan v1.73 - Installer Stale File Cleanup ============================================================================= SPDX-License-Identifier: MPL-2.0 SPDX-FileCopyrightText: Copyright (c) 2024-2026 Antonios Voulvoulis <contact@nftban.com> meta:name="installer-services-cleanup" meta:type="lib" meta:owner="Antonios Voulvoulis <contact@nftban.com>" meta:created_date="2026-04-04" meta:description="Remove stale files, polkit rules, and legacy units from prior versions" meta:inventory.files="internal/installer/services/cleanup.go" meta:inventory.binaries="" meta:inventory.env_vars="" meta:inventory.config_files="" meta:inventory.systemd_units="" meta:inventory.network="" meta:inventory.privileges="root" =============================================================================

============================================================================= NFTBan v1.73 - Installer Daemon Start ============================================================================= SPDX-License-Identifier: MPL-2.0 SPDX-FileCopyrightText: Copyright (c) 2024-2026 Antonios Voulvoulis <contact@nftban.com> meta:name="installer-services-daemon" meta:type="lib" meta:owner="Antonios Voulvoulis <contact@nftban.com>" meta:created_date="2026-04-04" meta:description="Enable and start nftband socket+service with retry" meta:inventory.files="internal/installer/services/daemon.go" meta:inventory.binaries="" meta:inventory.env_vars="" meta:inventory.config_files="" meta:inventory.systemd_units="nftband.socket, nftband.service" meta:inventory.network="" meta:inventory.privileges="root" =============================================================================

SPDX-License-Identifier: MPL-2.0 SPDX-FileCopyrightText: Copyright (c) 2024-2026 Antonios Voulvoulis <contact@nftban.com> meta:name="health_resource.go" meta:type="go" meta:owner="Antonios Voulvoulis <contact@nftban.com>" meta:description="v1.222.1 HEALTH-OOM hotfix Lane 2 installer wiring: phaseConfigure reconciler for the profile-derived nftban-health.service memory drop-in. Renders the canonical safety policy (healthresource.Render/Validate), writes atomically via the Executor ONLY when bytes change (no-churn), daemon-reloads only on change, then VERIFIES effective systemd properties via `systemctl show` (not file presence), classifies protection state (healthresource.ClassifyEffective), and persists the structured HEALTH_RESOURCE_* result to install_state. Returns a healthresource.Verdict for the phaseValidate assertion — one policy path, one shared verification method. No RAM/CPU/size classifier here (consumes internal/safety)."

============================================================================= NFTBan v1.73 - Installer Login Monitoring Enable ============================================================================= SPDX-License-Identifier: MPL-2.0 SPDX-FileCopyrightText: Copyright (c) 2024-2026 Antonios Voulvoulis <contact@nftban.com> meta:name="installer-services-login" meta:type="lib" meta:owner="Antonios Voulvoulis <contact@nftban.com>" meta:created_date="2026-04-04" meta:description="Enable login monitoring via nftban login enable" meta:inventory.files="internal/installer/services/login.go" meta:inventory.binaries="" meta:inventory.env_vars="" meta:inventory.config_files="" meta:inventory.systemd_units="" meta:inventory.network="" meta:inventory.privileges="root" =============================================================================

============================================================================= NFTBan v1.75.1 - Installer Panel Enable ============================================================================= SPDX-License-Identifier: MPL-2.0 SPDX-FileCopyrightText: Copyright (c) 2024-2026 Antonios Voulvoulis <contact@nftban.com> meta:name="installer-services-panel" meta:type="lib" meta:owner="Antonios Voulvoulis <contact@nftban.com>" meta:created_date="2026-04-04" meta:description="Enable panel integration for detected hosting panels" meta:inventory.files="internal/installer/services/panel.go" meta:inventory.binaries="" meta:inventory.env_vars="" meta:inventory.config_files="" meta:inventory.systemd_units="" meta:inventory.network="" meta:inventory.privileges="root" =============================================================================

============================================================================= NFTBan v1.76.0 - Installer systemd Helpers ============================================================================= SPDX-License-Identifier: MPL-2.0 SPDX-FileCopyrightText: Copyright (c) 2024-2026 Antonios Voulvoulis <contact@nftban.com> meta:name="installer-services-systemd" meta:type="lib" meta:owner="Antonios Voulvoulis <contact@nftban.com>" meta:created_date="2026-04-05" meta:description="systemd-tmpfiles --create and polkit restart for installer parity" meta:inventory.files="internal/installer/services/systemd.go" meta:inventory.binaries="" meta:inventory.env_vars="" meta:inventory.config_files="" meta:inventory.systemd_units="" meta:inventory.network="" meta:inventory.privileges="root" =============================================================================

============================================================================= NFTBan v1.75.1 - Installer Timer Reconciliation ============================================================================= SPDX-License-Identifier: MPL-2.0 SPDX-FileCopyrightText: Copyright (c) 2024-2026 Antonios Voulvoulis <contact@nftban.com> meta:name="installer-services-timers" meta:type="lib" meta:owner="Antonios Voulvoulis <contact@nftban.com>" meta:created_date="2026-04-04" meta:description="Reconcile core systemd timers (enable+start)" meta:inventory.files="internal/installer/services/timers.go" meta:inventory.binaries="" meta:inventory.env_vars="" meta:inventory.config_files="/etc/nftban/nftban.conf" meta:inventory.systemd_units="nftban-maintenance.timer, nftban-health.timer, nftban-unified-exporter.timer, nftban-core-geoip.timer, nftban-core-feeds.timer, nftban-watchdog.timer, nftban-queue.timer, nftban-update-check.timer, nftban-geoban-refresh.timer" meta:inventory.network="" meta:inventory.privileges="root" =============================================================================

============================================================================= NFTBan v1.154.0 - Installer Post-Install Timer Wedge Recovery ============================================================================= SPDX-License-Identifier: MPL-2.0 SPDX-FileCopyrightText: Copyright (c) 2024-2026 Antonios Voulvoulis <contact@nftban.com> meta:name="installer-services-timers-post-install" meta:type="lib" meta:owner="Antonios Voulvoulis <contact@nftban.com>" meta:created_date="2026-06-06" meta:description="D-INSTALL-TIMER-RELOAD: conditional daemon-reload + restart of wedged nftban timers at end of phaseValidate" meta:inventory.files="internal/installer/services/timers_post_install.go" meta:inventory.binaries="" meta:inventory.env_vars="" meta:inventory.config_files="" meta:inventory.systemd_units="nftban-*.timer" meta:inventory.network="" meta:inventory.privileges="root" =============================================================================

============================================================================= NFTBan v1.73 - Installer Whitelist Sync ============================================================================= SPDX-License-Identifier: MPL-2.0 SPDX-FileCopyrightText: Copyright (c) 2024-2026 Antonios Voulvoulis <contact@nftban.com> meta:name="installer-services-whitelist" meta:type="lib" meta:owner="Antonios Voulvoulis <contact@nftban.com>" meta:created_date="2026-04-04" meta:description="Run nftban sync to load whitelists and feeds after rebuild" meta:inventory.files="internal/installer/services/whitelist.go" meta:inventory.binaries="" meta:inventory.env_vars="" meta:inventory.config_files="" meta:inventory.systemd_units="" meta:inventory.network="" meta:inventory.privileges="root" =============================================================================

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ApplyTmpfiles added in v1.76.0 

func ApplyTmpfiles(exec executor.Executor, log *logging.Logger)

ApplyTmpfiles runs systemd-tmpfiles --create to create runtime directories with correct ownership. The tmpfiles.d config is installed by the package manager to /usr/lib/tmpfiles.d/nftban.conf. This call ensures /run/nftban and other tmpfiles-managed paths exist with correct owner/mode immediately after install (not just on next boot).

func CleanStaleFiles 

func CleanStaleFiles(exec executor.Executor, log *logging.Logger)

CleanStaleFiles removes all known stale files from prior NFTBan versions. Errors are logged but never fatal.

func CriticalCoreTimers added in v1.135.0 

func CriticalCoreTimers() []string

CriticalCoreTimers returns the critical core timer unit names, for the install_state critical-timer validator (which lives in another package).

func EnableLogin 

func EnableLogin(exec executor.Executor, log *logging.Logger)

EnableLogin runs "nftban login enable" to activate login monitoring. Non-fatal — logs warnings.

func EnablePanel 

func EnablePanel(exec executor.Executor, panel detect.PanelType, log *logging.Logger)

EnablePanel runs "nftban panel <name> enable" for the detected panel. Non-fatal — logs warnings.

func KnownTimers added in v1.154.0 

func KnownTimers() []string

KnownTimers returns a copy of the canonical full list of nftban timer unit names (every install/systemd/*.timer). Callers that need to iterate all nftban timers — such as the post-install wedge-recovery hardening — use this rather than duplicating a const list. The returned slice is a copy; callers may sort/mutate it freely.

func ReconcileHealthResource added in v1.222.1 

func ReconcileHealthResource(exec executor.Executor, sf *state.StateFile, log *logging.Logger, sourceVersion string) healthresource.Verdict

ReconcileHealthResource generates + activates + verifies the health-service resource drop-in and returns a structured verdict. Called from phaseConfigure (install/upgrade/repair) before failed-unit/health validation. It never fails the phase itself — the phaseValidate assertion turns an unacceptable verdict into installer DEGRADED (medium/large fallback) per contract.

func ReconcileTimers 

func ReconcileTimers(exec executor.Executor, log *logging.Logger)

ReconcileTimers enables and starts all core timers. Controlled by NFTBAN_RECONCILE_CORE_TIMERS in nftban.conf (default: true).

func RemoveHealthResourceDropin added in v1.222.1 

func RemoveHealthResourceDropin(exec executor.Executor, log *logging.Logger) (changed bool, err error)

RemoveHealthResourceDropin removes the NFTBan-generated health-resource drop-in (rollback to a release that does not own it, and uninstall/purge). It is the GENERATED_DROPIN_OWNER cleanup path — Executor-based so DEB/RPM removal scriptlets and the installer uninstall mode share one implementation. It NEVER touches administrator-owned sibling drop-ins (only the exact NFTBan path). Idempotent: absent → (false, nil). changed=true means daemon-reload happened.

func ResolveHealthResourceVerdict added in v1.223.0 

func ResolveHealthResourceVerdict(exec executor.Executor, sf *state.StateFile, log *logging.Logger, current healthresource.Verdict, sourceVersion string, profile *safety.HealthResourceProfile) healthresource.Verdict

ResolveHealthResourceVerdict returns ONE authoritative health-resource verdict for validation, regardless of which installer entry point is running. v1.223.0 (BUG-REPAIR-HEALTH-VERDICT-EMPTY + BUG-REVALIDATE-MASKS-HEALTH-DEGRADE): the verdict previously existed only as transient phaseConfigure output, so configure-skipping paths (repair-resume-at-validate, revalidate, update force) fed a ZERO verdict into the assertion — a false DEGRADED on repair and a false COMMIT on revalidate. Precedence (owner scope §5): live systemd effective policy > current calculated canonical policy > cautious persisted reconstruction > explicit UNAVAILABLE. It NEVER returns an unmarked zero-value verdict. ResolveHealthResourceVerdict resolves ONE authoritative verdict. The optional profile is DATA dependency-injection (no global seam): PRODUCTION passes nil and the canonical safety.HealthServiceMemoryLimits (DetectServerProfile → ClassifyResourceTier → the single RAM-tier authority) is used; execution-path tests pass a fixture *HealthResourceProfile to force a deterministic tier on any host. No new classifier, no new threshold table, no mutable package global.

func RestartPolkit added in v1.76.0 

func RestartPolkit(exec executor.Executor, log *logging.Logger)

RestartPolkit restarts the polkit service so that newly installed or removed polkit rules take effect. Non-fatal — polkit may not be installed.

func RestartWedgedTimers added in v1.154.0 

func RestartWedgedTimers(ctx context.Context, exec executor.Executor, log *logging.Logger, installedTimers []string)

RestartWedgedTimers performs the D-INSTALL-TIMER-RELOAD post-install hardening pass: a defensive, CONDITIONAL daemon-reload + timer-restart for any nftban timer left in the "wedged" state after install.

Background (fleet finding, V1_142_0_FLEET_ROLLOUT_RECORD §3.3): on one of ten hosts (dns2), nftban-unified-exporter.timer ended up: 

Active:  active (elapsed)   ← active but NOT "waiting"
Trigger: n/a                ← never scheduled
0 runs in 24h               ← never fired

The manual fix that resolved it was exactly: 

systemctl daemon-reload && systemctl restart nftban-unified-exporter.timer

after which the timer returned to `active (waiting), Trigger in Xs`.

This function reproduces that fix defensively at the END of phaseValidate. It is CONDITIONAL (audit-bot 2026-06-01): only timers that are actually wedged are restarted — healthy and inactive timers are left untouched, so the blast radius is "restart only the wedged ones" rather than "restart all timers on every install".

Failure policy is WARN-ONLY / non-fatal (operator-locked), matching the existing installer daemon-reload at phases.go (phaseSwitch step 6). Any error from daemon-reload, the wedge probe, or a restart is logged at Warn and iteration continues; the install state machine is never affected.

installedTimers is the canonical full timer set to consider (pass services.KnownTimers()); timers whose unit file is not installed on this host are skipped.

func ShouldReconcile added in v1.135.0 

func ShouldReconcile(exec executor.Executor) bool

ShouldReconcile checks if NFTBAN_RECONCILE_CORE_TIMERS is set to true in nftban.conf or nftban.conf.local. Default: true (reconcile).

func StartDaemon 

func StartDaemon(exec executor.Executor, log *logging.Logger)

StartDaemon enables nftband.socket and nftband.service. Retries up to 3 times with 1s delay. Non-fatal — logs warnings.

func SyncWhitelist 

func SyncWhitelist(exec executor.Executor, log *logging.Logger) error

SyncWhitelist runs "nftban sync" to load whitelists and feeds.

v1.228.5 BUG-REBUILD-DISCARDS-FAILED-WHITELIST-RECONCILE: this is the SOLE installer convergence authority for the durable whitelist.d layer. The pre-daemon switchop.Rebuild explicitly DEFERS that projection (it passes --install-context), because it runs before StartDaemon and before AddSessionWhitelist writes 00-session.conf.

It therefore MUST NOT be a silent warning. Previously a total failure here left only a log line while the install could still be reported COMMITTED — which relocates the false-success defect to a later phase instead of closing it. It now returns a verdict the caller records in install_state.

Returns nil on convergence; a non-nil error when the durable whitelist could not be projected after all retries.

Types

This section is empty.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.