more updates - #13
Open
mymanga wants to merge 46 commits into
Open
Conversation
Removed predefined certbot settings in default site
Made OpenVPN folder and Easy-RSA folder more permissible
- Added Valkey - Removed Redis - Moved Freeradius configs to after DB optimizatiom
added ubuntu 20.04 compatibility
Added touch REDIS_MIGRATION
Fix the bash script permissions and run them to resolve error 500 on the web ui when trying to access some pages like SMS gateway configs
Leave Valkey on default
added additional permission configs
disabled rest module and switched to full SQL for accounting
Updated composer install command to allow superuser and added options for no audit and prefer dist.
Swapped simplespot to sql from rest accounting
MariaDB, FreeRadius, and PHP-FPM optimizations
…shell scripts to resolve encoding issues.
…tallers - Rename: optimized simpleisp.sh/simplespot.sh take over the ubuntu_simpleisp.sh/ubuntu_simplespot.sh install entry-point names; previous ubuntu_ scripts kept as *_old.sh - Installers now download universal.sh, db_cleanup.sh, ovpn_fix.sh from this repo into /var/www/html/sh, schedule universal.sh daily at 3 AM and on @reboot (delayed 120s), db_cleanup.sh at 04:30, run universal.sh once for initial tuning and ovpn_fix.sh once as sandbox verification - Remove the embedded legacy update_memory_config.sh (restart-everything tuning) from the installers entirely - universal.sh: remove legacy update_memory_config.sh file + cron on servers that still have it; prune side-by-side .bak.TIMESTAMP config backups to KEEP=3 so daily/reboot runs cannot grow them unbounded; strip BOM and mojibake - Installers: strip BOM breaking the shebang, define missing log_warning, backport COMPOSER_ALLOW_SUPERUSER/--no-security-blocking composer fix Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…dule Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Ubuntu only ships valkey packages from noble onward, so the installers failed on 20.04/22.04 with "Unable to locate package valkey-server". Restore the Percona repo path that the old installers used: focal/jammy now enable Percona's valkey repo and install valkey/valkey-compat (service "valkey"), while noble+ keeps the Ubuntu archive packages (service "valkey-server"). All systemctl calls, the systemd override dir, and the generated valkey-debug.sh now use the per-version service name - the override dir and final verification were previously hardcoded to the wrong unit on noble. Also rename the [mariadbd] section in the generated 50-server.cnf to [mysqld]: [mariadbd] only exists from MariaDB 10.4.6, so focal's 10.3 silently ignored the whole block (bind-address, InnoDB tuning, utf8mb4). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The installers curl universal.sh, db_cleanup.sh, ovpn_fix.sh and openvpn.sh from simpleisp/bash main, but only openvpn.sh exists there - the maintenance scripts were never pushed upstream, so the install aborted with "Failed to download universal.sh". Point all raw URLs at this fork, which has all four files. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Percona's valkey 8.0.0 deb ships /var/lib/valkey and /var/log/valkey owned by root and only chowns /etc/valkey/*.conf in its postinst, while valkey.service runs as user valkey. The package's own default config survives this (logfile "", dir ./), but our tuned config points logfile and the AOF dir at those root-owned paths, so the service exited at startup and "systemctl restart valkey" failed. The 7.2.x builds the existing fleet was installed with did not have this problem. Create and chown the data/log directories before restarting, and make the IPv6 bind optional (bind 0.0.0.0 -::0, same prefix Percona's default config uses) so hosts without IPv6 can still start Valkey. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Stop valkey-sentinel (Percona postinst enables it) and openvpn@server - Strip installer-added root crontab entries (scheduler, valkey-debug, universal.sh, legacy jobs) - the installers append on every run, so leftovers duplicated on reinstall - Wipe valkey data/logs, valkey-debug.sh, and the valkey systemd override dirs for both unit names - Remove php-fpm/supervisor sandbox override drop-ins and daemon-reload - Remove appended www-data sudoers entries, with visudo validation and rollback so a bad edit can never brick sudo - Remove legacy update_memory_config.sh; glob ionCube ini cleanup across all PHP versions Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The panel has hardcoded code that breaks on PHP > 7.4, so PHP_VERSION stays 7.4 on every Ubuntu release (ondrej PPA ships 7.4 builds through noble). Comment the pin in the installer and note it in the README so it does not get bumped during future OS work. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Percona's valkey postinst runs "systemctl start valkey" directly with set -e, so every dpkg configure of the package - fresh install, apt upgrade, or recovery of a half-configured state left by a previously failed run - requires the service to actually start. A leftover tuned config pointing at root-owned /var/lib/valkey//var/log/valkey wedged dpkg: apt-get upgrade failed at Step 7 before the Step 10 ownership fix could ever run. Pre-create the valkey account and writable data/log dirs, and relax a leftover "bind 0.0.0.0 ::0" to the optional-IPv6 form, in the Valkey package-source step - before apt update/upgrade/install touch the package. This also self-heals servers currently stuck with valkey half-configured. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…nsumed The cleanup marker was deleted at the START of a run, so an install that failed later left subsequent retries in normal mode, where apt does not restore the conffiles clean_server.sh deleted. That surfaced as "mv: cannot stat /etc/nginx/sites-available/default" at the Nginx step, with the same trap waiting at the supervisor step (/etc/supervisor is wiped by cleanup). - Only back up nginx's default site if it exists (the script rewrites it immediately anyway) - Restore supervisor's package config via --force-confmiss if supervisord.conf is missing, and mkdir conf.d before writing into it - Delete the cleanup marker only after a fully successful install, so failed runs keep reinstall mode active for the next attempt Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A retried run on a partially installed server previously failed or left duplicates: CREATE DATABASE/CREATE USER errored because the previous attempt already created them (credentials are reused from db.txt), each retry appended another copy of every cron entry, and the www-data sudoers block was appended on every run. - CREATE DATABASE/USER IF NOT EXISTS, plus ALTER USER to keep the password in sync with db.txt - Cron installs strip their own previous entries before appending - The sudoers block is only appended if not already present Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
simpleisp/radius uses main as its default branch, so "git clone -b master" failed with "Remote branch master not found". Clone without -b so the repo's default branch is used for both products. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The reuse path ran certbot interactively and piped a single "1" answer, but certbot also asks about the HTTP->HTTPS redirect; with stdin exhausted it exited non-zero after reinstalling the cert, aborting the install with "Failed to reuse SSL certificate". Collapse both paths into one non-interactive call: --keep-until-expiring reinstalls an existing valid certificate into the rewritten nginx config without reissuing (no rate-limit usage) and requests a new certificate only when none exists; --redirect answers the redirect question. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… real Packaging: focal/jammy keep the NetworkRADIUS repo (their archives only have FreeRADIUS 3.0.x); noble and newer install FreeRADIUS 3.2 from the Ubuntu archive (3.2.5 in main with security updates) and remove any NetworkRADIUS repo/pin leftovers. The two packagings use different config roots (/etc/freeradius vs /etc/freeradius/3.0), so all FreeRADIUS paths now go through FREERADIUS_CONF_DIR. New Ubuntu releases take the archive path by default instead of hard-failing. Accounting: previously the default site wrote accounting directly to SQL while the enabled buffered-sql site sat idle (the detail writer was commented out, so it had nothing to read). Wire it up properly: the default site's accounting section writes to a single local detail file, and a deterministic buffered-sql virtual server (track = yes) replays it into SQL - accounting survives MariaDB stalls and restarts. The detail module is rewritten as a single-file writer with locking; auth paths (authorize/session/post-auth) stay direct SQL. Validate the final config with freeradius -XC before services restart. clean_server.sh handles both config roots and removes the buffered accounting queue; README documents the split. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…Step 6b) Rolls the installers' detail -> buffered-sql accounting out to the already-installed fleet on the next universal.sh run. Rewrites the detail module (single-file writer, locking), the buffered-sql virtual server (track = yes), and the default site's accounting section (detail/exec/attr_filter instead of direct sql), each with cmp-guarded writes, .bak.TIMESTAMP backups and prune_baks retention, so converted servers see no change and no restart on later runs. Validates the result with freeradius -XC before the end-of-run restart; on failure restores every touched file and removes freshly created enable symlinks. A successful change reuses the existing RADIUS_CHANGED restart-only-if-changed path. Full --dry-run support. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The default-site edit historically ran awk against sites-enabled/default and mv'd the result over it, replacing the packaged symlink with a regular file and leaving sites-available/default stale. Installers: recover an existing regular sites-enabled/default into sites-available/default when needed, apply the -sql/accounting edits to sites-available/default, and re-link sites-enabled/default to it. universal.sh Step 6b: generate the desired default site from the EFFECTIVE config (sites-enabled entry if present, else sites-available) with the same sed+awk the installers use, install it into sites-available/default, and normalize sites-enabled/default back to a symlink - backing up the old regular file and restoring it on failed validation (rollback now removes the path before copying the backup so it cannot write through a fresh symlink). Verified with 18 functional checks run under WSL for real symlink semantics: fleet-file conversion, source selection, backup, idempotent rerun, full rollback to the regular-file state, dry-run no-op, and pristine-tree (already-symlinked) conversion. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The panel invokes systemctl by bare name, which sudo resolves via
secure_path to /usr/bin/systemctl, and its OpenVPN status check queries
the umbrella "openvpn" unit - neither matches the existing sudoers
entries (/bin/systemctl + openvpn@server only), so on 24.04 the check
was denied ("command not allowed") and the panel displayed OpenVPN as
stopped while the service was running fine.
Append a second guarded sudoers block with /usr/bin/systemctl and
/usr/bin/supervisorctl variants of every existing entry plus both path
forms for the "openvpn" umbrella unit. Own guard line so already-
installed servers gain the block on rerun.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Rolls the installers' second sudoers block out to already-installed servers: /usr/bin/systemctl and /usr/bin/supervisorctl variants of every www-data grant plus both path forms for the umbrella "openvpn" unit. Without these the panel's status checks (bare systemctl resolved via sudo secure_path, querying "openvpn") were denied and OpenVPN showed as stopped while running. Guarded so already-fixed servers see no change; backs up /etc/sudoers with the usual .bak.TIMESTAMP + prune_baks retention, validates with visudo -c and restores the backup on failure. Full --dry-run support. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A NAS reboot's Accounting-On record jammed the buffered-sql detail reader for ~7h on 2026-07-23: its bulk close-all-sessions query failed and the reader retried it forever, freezing accounting while the detail backlog grew to 159MB. Two defenses: - buffered-sql site (universal.sh Step 6b + both installers): if sql fails on an Accounting-On/Off record, acknowledge and drop it instead of retrying forever; session records keep retry-until-accepted. - universal.sh Step 6d: install radacct-watchdog.sh + cron.d entry that detects a detail.work mtime frozen >15m while FreeRADIUS is up and auto-applies the unjam (stop, set work file aside, start). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The v3.3 tolerance never executed: a module returning fail in an
accounting section returns from the section by default, so the
if (fail) check after sql was dead code and a NAS reboot jammed the
detail reader again with the fix deployed. Override the action with
sql { fail = 1 } so processing continues into the check; ordinary
records still leave the section as fail and keep being retried.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
STALE_MIN 15->5 and the cron entry runs every minute, cutting wedge detection from 15-20 minutes to ~5-6. To keep the shorter fuse from discarding legitimately buffered records, the watchdog now exits without acting when mysqladmin ping fails: a frozen reader during a DB outage is the buffer working as designed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Root cause of today's repeated jams was not a failing SQL query: the detail reader thread dies silently when it processes a NAS-reboot record. Evidence: frozen detail.work with the Accounting-On at its head (three for three today), all FreeRADIUS DB connections idle during the freeze, nothing in radius.log until "Reader thread exited without informing the master: Bad file descriptor" at the next stop. The v3.3.x unlang tolerance sat inside the reader's virtual server, so it could never fire. The default site now handles Accounting-On/Off synchronously via sql (fail = 1 + ok so the NAS is always acked; the bulk stale-session close is best-effort) and queues only session records to detail. Both default-site rewriters count braces (comments stripped) instead of ending at the first "}", keeping regeneration idempotent now that the emitted section nests. Verified: stock and flat inputs convert correctly and re-running on the output is byte-stable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Decision after a day of jams: the buffer protected little (auth already
needs the DB synchronously, and 1-minute cumulative interims rebuild
counters within a minute of any DB blip) while its real-world failure
mode - the detail reader thread dying silently on NAS-reboot records -
froze accounting until a human or watchdog intervened.
universal.sh Step 6b now converges the default site to
accounting { sql } and disables the buffered-sql site and detail module
links (available files kept for reference; symlinks restored on failed
-XC validation). Step 6d removes the radacct watchdog it previously
installed - there is no detail.work left to unjam. Installers no longer
create the buffered-sql site or detail module. Rewriter verified: v3.4
nested and stock flat sections both convert cleanly and re-runs are
byte-stable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
With interim-update=1m, acctupdatetime freshness IS liveness. Every minute: close open rows silent 5+ minutes (lost Stop), reopen closed rows still receiving interims (live sessions caught by a sweep or bulk close - interims update closed rows but nothing else reopens them). The reopen requires updates fresher than 5 minutes so backdated or replayed timestamps cannot resurrect dead rows - the trap today's manual reopen fell into. The pair is self-correcting across server outages: silence closes, the first interim after recovery reopens. Adds idx_radacct_stop_update (acctstoptime, acctupdatetime) to the ensure list so both statements stay index-covered. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
radiusd.conf does "$INCLUDE sites-enabled/" (and mods-enabled/), so the .bak.TIMESTAMP files Step 6b wrote next to sites-enabled/default and sites-enabled/buffered-sql were parsed as config: "Duplicate virtual server 'default'" made freeradius fail to start on the next restart or nightly reboot, while the step's own -XC validation kept failing and rolling back the conversion - leaving servers unconverted AND unable to restart freeradius. - All backups of files living in sites-enabled/ or mods-enabled/ now go to CONF_BACKUP_DIR (pruned by the existing Step 3 retention), tracked as live:backup pairs and restored from there on failed validation - Step 6b sweeps stray *.bak.* files out of both directories first, which by itself repairs servers already stuck in the broken state, and triggers validation + restart so they recover in the same run Verified with 15 functional checks in WSL: damaged-tree recovery (stray swept, direct sql conversion, re-link, buffered wiring disabled with relocated backups), idempotent rerun, rollback that restores everything except the sweep, and dry-run no-op. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The end-of-run restart only fired when RADIUS_CHANGED=1, so a server whose freeradius failed at boot (e.g. stray sites-enabled backups pre-v3.5.2) stayed down if the current run had nothing to converge. universal.sh fires @reboot, making it the natural recovery point: if neither freeradius nor radiusd is active and the config passes -XC, attempt a start; if the config fails validation, log an explicit manual-attention error instead. Skipped under --dry-run. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Reinstalling over a server damaged by universal.sh v3.1-v3.5 (stray .bak files in sites-enabled/, parsed by FreeRADIUS as duplicate virtual servers) aborted at the installers' -XC validation. Before validating, move stray *.bak.* files out of sites-enabled/ and mods-enabled/ into /var/backups/universal/conf, and drop the retired buffered-sql site / detail module links so they do not survive a reinstall. Mirrors universal.sh v3.5.2. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
more updares