Repository navigation
fix: apply RPS on re-run and preserve nftables service ownership - #44
Merged
Merged
Conversation
jestivald
changed the title
…рез na-firewall.service); optimize на ре-ране явно перезапускает na-rps (RPS реально применяется, отказ = warn); changelog v4.1.2, NA_REF-примеры, комментарии и тесты — на языке репо Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two re-run defects left the fleet in a different state from what the installer reported.
protectenabled the distribution'snftables.servicealongside NA's own boot unit. The distribution's default configuration starts withflush ruleset, so a later boot can erase NA, CrowdSec and Docker tables depending on service ordering. Enable onlyna-firewall.serviceand leave the operator's distribution service state unchanged. The changelog describes migration without triggering the distribution unit's potentially destructiveExecStop.optimizeupdated the RPS helper but usedenable --nowon an already-active oneshot. On a three-CPU node,rps_cpusstayed zero after upgrade while the installer reported success. Explicitly restart the RPS setup unit after updating it and report failed activation. This setup unit changes queue settings and does not restart the VPN process.Validation: behavioral regressions reproduce both defects against v4.1.1; the fixed tests check service ownership, the resulting RPS CPU mask, and activation failure. All nine shell suites passed locally for the firewall change; the updated RPS suite and ShellCheck gate pass with the second fix. Changed modules are signed with minisign. Linux distribution checks run in CI on the final branch head.
Релизная обвязка v4.1.2 (два коммита поверх фиксов):
NA_VERSION4.1.1 → 4.1.2, секция## v4.1.2 — 2026-09-06в CHANGELOG (с инструкцией миграции существующих нод:systemctl disable nftables.serviceбез--now),NA_REF=v4.1.2в README/install.sh, новые комментарии и сообщения тестов — на языке репо; все 6 модулей переподписаны minisign последним коммитом (verify 6/6). Локально: 9/9 тест-сюит, shellcheck gate чист.