systemd imisa isevisi ye-VPN: vumelanisa i-Type= neklayenti

Amayunithi angabonakala elungile, i-systemctl start ingabika impumelelo, bese kuthi ngemva kwemizuzwana eyishumi isevisi ihlezi ingasebenzi. Noma iqala kabusha njalo ngengxenye yomzuzu kuze kuyimise umkhawulo wokuqalisa. Azikho kulezi zimo ezimbili eziyiphutha lenethiwekhi: iyunithi ichaza ukuphila kwenqubo okungahambisani nalokho iklayenti elikwenzayo ngempela. Iklayenti lingenza i-fork bese liphuma, noma lihlele iseshini bese liphuma ngokushesha.

Kungani iyunithi iyeka ukusebenza ngemva kwemizuzwana yokuqalisa okuphumelelayo

I-systemd ithola isimo enqulweni eyayiqalisiwe yiyo, ngakho i-Type= iyisitatimende mayelana naleyo nqubo, hhayi umbhalo. Nge-Type=simple iyunithi ibalwa njengesebenzayo ngesikhathi umyalo ugxuma futhi iyeka ukusebenza lapho umyalo ubuya. Ngakho iklayenti elidlulisela ukuxhumana kumsizi bese liphuma libonakala njengokuwohloka, ngisho nalapho umhubhe usebenza. Ngemva kwalokho ijenele libonisa iphethini yokuqalisa nokuma elifundwa njengebhayinari ephukile.

Funda uhlobo lweyunithi eduze nokuziphatha kweklayenti ngaphambi kokuthinta ukucushwa kwenethiwekhi.

Khetha uhlobo oluvumelana neklayenti

Amaphethini amabili ahlanganisa iningi lama-CLI abathengisi: umyalo ohlela iseshini bese uphuma, kanye nomyalo ohlela umsizi nge-fork ngaphambi kokubuya. Ngamunye udinga isimo seyunithi esihlukile.

[Service]
Type=oneshot
RemainAfterExit=true
ExecStart=/usr/bin/protonvpn-cli connect -f
ExecStop=/usr/bin/protonvpn-cli disconnect

I-oneshot kanye ne-RemainAfterExit=true kugcina iyunithi isebenza ngemva kokubuya komyalo, okuhambisana nephethini yokuhlela bese uphuma, futhi umyalo wokumisa unikeza isevisi ukuvalwa okuhlanzekile. Iklayenti elenza i-fork ligcina isimo esifanayo kodwa lidinga i-Type=forking ukuze i-systemd ilandele ingane. Setha i-Restart=on-failure, i-RestartSec=30 kanye ne-StartLimitBurst enomkhawulo, ukuze ukuphazamiseka komhlinzeki kungaphenduki kube umjikelezo wokuqalisa kabusha ogcwalisa iphutha.

Ungalokothi uvumele iklayenti eligadiwe ukuthi libe idemon

Abagadi abangaphandle kwe-systemd bashayisa odongeni olufanayo. Iskripthi sokusebenza se-runit esiqala iklayenti elenziwe idemon sibuya ngokushesha kumgadi, yena ofunda lokho kubuya njengokuwohloka bese eqala elinye ikhophi. Wonke umgadi ulindela ukuba ngumnikazi wenqubo yangaphambili, njengoba i-sshd -D ihlala phambili. Susa ifulegi ledemon emiyalweni egadiwe futhi ushiye umsebenzi wangemuva kumgadi. Izikripthi zokugoqa ezibuya ngaphambi kokuba umhubhe ube khona zibangela ukudideka okufanayo.

Inqubo ehlukana nayo uqobo ayibonakali kukho konke obekufanele ikugade.

Iseshini iyaphela futhi ihamba nomhubhe

Iseshini yedesktop ingumnikazi weklayenti eliyiqalayo. Qeda ukungena bese ibhasi leseshini linyamalala, lihambe nomhubhe, okuchaza ukuthi kungani ukuxhumana kweklayenti lezithombe kuvame ukuphuka lapho kuthi cwaka iwindi lokugcina. Amaseva kufanele asebenzise iyunithi yohlelo noma iphrofayela ye-NetworkManager ephuma yona. Iyunithi yomsebenzisi inengqondo kuphela lapho umhubhe kufanele uphele nokungena, ngakho yixhumanisa nethagethi yeseshini yezithombe futhi usho lokho encazelweni yayo.

Umsebenzisi wesevisi ungenye ingxenye yale nkinga efanayo. Ukhiye ophethwe yi-root onesimo esingu-0600 awufundeki kuyunithi esebenza ngaphansi kwe-akhawunti enye, noma ngabe i-sudo yenzani ku-shell yakho.

systemctl cat openvpn-server@work
sudo chown -R openvpn:network /etc/openvpn/server
sudo find /etc/openvpn -type f -perm /077 -ls

Hlela okuncike kukho ngemva kokuba ikheli likhona

Lapho idemon ibopha ikheli lomhubhe elingakadalwa, iphuma nge-Cannot assign requested address. Ukulungiswa ukuhlela okucacile, hhayi umjikelezo wokuzama kabusha.

[Unit]
After=network.target [email protected]
Requires=sys-devices-virtual-net-wg0.device

I-After= ihlela imisebenzi, kuyilapho i-Requires= kuyunithi yedivayisi ixhumanisa okuncike nokuba khona kwe-interface, okuqinile kunokulinda ithagethi yenethiwekhi kuphela. Layisha kabusha umphathi ngemva kokuhlela futhi uqale kabusha isevisi encikile, bese ufunda ijenele layo esikhundleni sokucabanga ukuthi ukuhlela kusebenzile. Thumela okukhishwa yiklayenti ejenele nge-StandardOutput=journal noma inketho yelogi, ngoba iklayenti eligadiwe elibhala efayeleni okungekho muntu okuvulayo libonakala lifana ncamashi nalelo elingakaze liqale.

Ngemva kwalokho qalisa kabusha kanye futhi uqinisekise ukuthi iyunithi iyasebenza ngemva kokuvela kwedivayisi yomhubhe. Ukulungiswa okuqinisekiswe nge-systemctl start kuphela akuzange kuhlole ukuhlela kokuqalisa obekufanele kukulungise.