Skip to content

Commit

Permalink
systemd: Enable systemd's auto-restart feature for server profiles
Browse files Browse the repository at this point in the history 
Systemd supervises services it has started and can act upon unexpected
scenarios.  This change will restart OpenVPN after 5 seconds if the OpenVPN
process exits unexpectedly.

The on-failure mode is the recommended mode by upstream systemd.

This change have been tested on a test server for some month, and it
works indeed as intended when provoking the OpenVPN process to stop.

Signed-off-by: David Sommerseth <davids@openvpn.net>
Acked-by: David Sommerseth <davids@openvpn.net>
Message-Id: <20170906235202.26551-1-davids@openvpn.net>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15370.html
Signed-off-by: David Sommerseth <davids@openvpn.net>
  • Loading branch information
@dsommers
dsommers committed Sep 21, 2017
1 parent 682e7fe commit a4686e9
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions distro/systemd/openvpn-server@.service.in
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@ DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true
KillMode=process
RestartSec=5s
Restart=on-failure

[Install]
WantedBy=multi-user.target

5 comments on commit a4686e9

@alogoc
Copy link

@alogoc alogoc commented on a4686e9 Jun 2, 2018 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems that this systemd service is not working with sytemd --version

systemd 232
+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN

systemctl cat  openvpn-server\@.service
# /lib/systemd/system/openvpn-server@.service
[Unit]
Description=OpenVPN service for %I
After=network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
Type=notify
PrivateTmp=true
WorkingDirectory=/etc/openvpn/server
ExecStart=@sbindir@/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true
KillMode=process
RestartSec=5s
Restart=on-failure

[Install]
WantedBy=multi-user.target

systemctl enable openvpn-server\@.service
The unit files have no installation config (WantedBy, RequiredBy, Also, Alias
settings in the [Install] section, and DefaultInstance for template units).
This means they are not meant to be enabled using systemctl.
Possible reasons for having this kind of units are:
1) A unit may be statically enabled by being symlinked from another unit's
   .wants/ or .requires/ directory.
2) A unit's purpose may be to act as a helper for some other unit which has
   a requirement dependency on it.
3) A unit may be started when needed via activation (socket, path, timer,
   D-Bus, udev, scripted systemctl call, ...).
4) In case of template units, the unit is meant to be enabled with some
   instance name specified.

Will keep you posted if I find out why :)

@dsommers
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please do. It's interesting it is complaining about missing installation configs which, at least to my eyes, exists.

@akarollil
Copy link

@akarollil akarollil commented on a4686e9 May 24, 2019 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The server systemd service is working fine on systemd v232 on Debian Stretch for me. @dsommers, I am curious about why the Restart/RestartSec configuration lines were added only to the server service and not the client. Any reason for doing so only for the server and not for the client systemd service? I ran into a case where the openvpn client could not reconnect to the server because of a permissions issue (because it had dropped privileges and needed it to re-establish connection to a newer version of the server). The client service then stops and doesn't come back up because it doesn't have the Restart config that the server has. It might make sense to have the client restart on failure too?

@dsommers
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It was a fairly thorough discussion in the developers community before this change got accepted and merged. Most use cases for a server profile is that it should be available by default. If the server crashes or needs to be restarted, that was considered a good feature.

The client side can be much more differentiated in the expectations. Some would like to have the client be restarted automatically, while for others that could be disastrous as it might to be started in a special order to avoid other issues on the client. Some users have more VPN profiles setup as well, while some of them would benefit from this features other profiles might not. So by not changing the client side, we would therefore not break any existing client setups. If we changed this behaviour, it would be far more unclear what the consequences for all of our Linux users would be.

All this said, it is fairly easy to enable this feature on-the-fly. Just use systemctl edit openvpn-client@CONFIGNAME and add the [Service] section as well as the appropriate Restart= settings. This gives you a much more fine-grained control of which services would automatically be restarted or not. And it is preserved through upgrades using this approach.

@akarollil
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the explanation David. Yes, I added a drop-in config file (/etc/systemd/system/openvpn-client@.service.d/restart-client-always.conf) with the following content for adding restart configuration to the client service:

[Service]
RestartSec=5s
Restart=always

Please sign in to comment.