From 3f891268f12ac7b38ec0d53dfc954e709896bca6 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 23 Jun 2026 16:13:53 -0600 Subject: [PATCH 01/20] change quadlet installation to use system managed paths Signed-off-by: Sean Tronsen --- openchami.spec | 14 +++++++------- scripts/bootstrap_openchami.sh | 10 +++++----- scripts/openchami-certificate-update | 10 +++++----- 3 files changed, 17 insertions(+), 17 deletions(-) diff --git a/openchami.spec b/openchami.spec index 0f2fb87..d257ea6 100644 --- a/openchami.spec +++ b/openchami.spec @@ -30,16 +30,16 @@ The quadlets, systemd units, and config files for the Open Composable, Heterogen # 1) Install config, unit, and script files mkdir -p %{buildroot}/etc/openchami/configs \ %{buildroot}/etc/openchami/pg-init \ - %{buildroot}/etc/containers/systemd \ + %{buildroot}/usr/share/containers/systemd \ %{buildroot}/etc/systemd/system \ %{buildroot}/usr/bin \ %{buildroot}/etc/profile.d \ %{buildroot}/usr/libexec/openchami cp -r systemd/configs/* %{buildroot}/etc/openchami/configs/ -cp -r systemd/containers/* %{buildroot}/etc/containers/systemd/ -cp -r systemd/volumes/* %{buildroot}/etc/containers/systemd/ -cp -r systemd/networks/* %{buildroot}/etc/containers/systemd/ +cp -r systemd/containers/* %{buildroot}/usr/share/containers/systemd/ +cp -r systemd/volumes/* %{buildroot}/usr/share/containers/systemd/ +cp -r systemd/networks/* %{buildroot}/usr/share/containers/systemd/ cp -r systemd/targets/* %{buildroot}/etc/systemd/system/ cp -r systemd/system/* %{buildroot}/etc/systemd/system/ cp scripts/bootstrap_openchami.sh %{buildroot}/usr/libexec/openchami/ @@ -60,7 +60,7 @@ chmod 644 %{buildroot}/etc/openchami/configs/* %files %license LICENSE %config(noreplace) /etc/openchami/configs/* -/etc/containers/systemd/* +/usr/share/containers/systemd/* /etc/systemd/system/openchami.target /etc/systemd/system/openchami-cert-renewal.service /etc/systemd/system/openchami-cert-renewal.timer @@ -72,8 +72,8 @@ chmod 644 %{buildroot}/etc/openchami/configs/* /usr/bin/openchami-certificate-update %pre -if [ -f /etc/containers/systemd/coresmd.container ]; then - echo 'WARNING: /etc/containers/systemd/coresmd.container as been replaced by /etc/containers/systemd/coresmd-coredhcp.container.' +if [ -f /usr/share/containers/systemd/coresmd.container ]; then + echo 'WARNING: /usr/share/containers/systemd/coresmd.container as been replaced by /usr/share/containers/systemd/coresmd-coredhcp.container.' echo ' Migrate to coresmd-coredhcp to avoid any issues.' fi diff --git a/scripts/bootstrap_openchami.sh b/scripts/bootstrap_openchami.sh index 4a854f6..25da6d0 100644 --- a/scripts/bootstrap_openchami.sh +++ b/scripts/bootstrap_openchami.sh @@ -42,11 +42,11 @@ generate_environment_file() { acme_correction() { local system_fqdn=$(hostname) primary_ip=$(hostname -I | awk '{print $1}') - sed -i "s|-d .* \\\\|-d ${system_fqdn} \\\\|" /etc/containers/systemd/acme-deploy.container - sed -i "s/^ContainerName=.*/ContainerName=${system_fqdn}/" /etc/containers/systemd/acme-register.container - sed -i "s/^HostName=.*/HostName=${system_fqdn}/" /etc/containers/systemd/acme-register.container - sed -i "s|-d .* \\\\|-d ${system_fqdn} \\\\|" /etc/containers/systemd/acme-register.container - sed -i "s|--add-host='demo\.openchami\.cluster:[0-9\.]*'|--add-host='${system_fqdn}:${primary_ip}'|" /etc/containers/systemd/opaal.container + sed -i "s|-d .* \\\\|-d ${system_fqdn} \\\\|" /usr/share/containers/systemd/acme-deploy.container + sed -i "s/^ContainerName=.*/ContainerName=${system_fqdn}/" /usr/share/containers/systemd/acme-register.container + sed -i "s/^HostName=.*/HostName=${system_fqdn}/" /usr/share/containers/systemd/acme-register.container + sed -i "s|-d .* \\\\|-d ${system_fqdn} \\\\|" /usr/share/containers/systemd/acme-register.container + sed -i "s|--add-host='demo\.openchami\.cluster:[0-9\.]*'|--add-host='${system_fqdn}:${primary_ip}'|" /usr/share/containers/systemd/opaal.container } # Check and create secrets with random passwords if needed diff --git a/scripts/openchami-certificate-update b/scripts/openchami-certificate-update index 06d3caa..d9e3dba 100755 --- a/scripts/openchami-certificate-update +++ b/scripts/openchami-certificate-update @@ -15,11 +15,11 @@ update_dns() { sed -i "s|^URLS_LOGIN=.*|URLS_LOGIN=https://${system_fqdn}/login|" /etc/openchami/configs/openchami.env sed -i "s|^URLS_CONSENT=.*|URLS_CONSENT=https://${system_fqdn}/consent|" /etc/openchami/configs/openchami.env sed -i "s|^URLS_LOGOUT=.*|URLS_LOGOUT=https://${system_fqdn}/logout|" /etc/openchami/configs/openchami.env - sed -i "s|-d .* \\\\|-d ${system_fqdn} \\\\|" /etc/containers/systemd/acme-deploy.container - sed -i "s/^ContainerName=.*/ContainerName=${system_fqdn}/" /etc/containers/systemd/acme-register.container - sed -i "s/^HostName=.*/HostName=${system_fqdn}/" /etc/containers/systemd/acme-register.container - sed -i "s|-d .* \\\\|-d ${system_fqdn} \\\\|" /etc/containers/systemd/acme-register.container - sed -i "s|--add-host='.*|--add-host='${system_fqdn}:${primary_ip}'|" /etc/containers/systemd/opaal.container + sed -i "s|-d .* \\\\|-d ${system_fqdn} \\\\|" /usr/share/containers/systemd/acme-deploy.container + sed -i "s/^ContainerName=.*/ContainerName=${system_fqdn}/" /usr/share/containers/systemd/acme-register.container + sed -i "s/^HostName=.*/HostName=${system_fqdn}/" /usr/share/containers/systemd/acme-register.container + sed -i "s|-d .* \\\\|-d ${system_fqdn} \\\\|" /usr/share/containers/systemd/acme-register.container + sed -i "s|--add-host='.*|--add-host='${system_fqdn}:${primary_ip}'|" /usr/share/containers/systemd/opaal.container # Reload systemD after .container changes systemctl daemon-reload From d85e31a05b35488600ff47f35bfbd4795d48fa84 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 23 Jun 2026 16:22:48 -0600 Subject: [PATCH 02/20] change unit file installation to use system managed paths Signed-off-by: Sean Tronsen --- openchami.spec | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/openchami.spec b/openchami.spec index d257ea6..54e7e19 100644 --- a/openchami.spec +++ b/openchami.spec @@ -31,7 +31,7 @@ The quadlets, systemd units, and config files for the Open Composable, Heterogen mkdir -p %{buildroot}/etc/openchami/configs \ %{buildroot}/etc/openchami/pg-init \ %{buildroot}/usr/share/containers/systemd \ - %{buildroot}/etc/systemd/system \ + %{buildroot}/usr/lib/systemd/system \ %{buildroot}/usr/bin \ %{buildroot}/etc/profile.d \ %{buildroot}/usr/libexec/openchami @@ -40,8 +40,8 @@ cp -r systemd/configs/* %{buildroot}/etc/openchami/configs/ cp -r systemd/containers/* %{buildroot}/usr/share/containers/systemd/ cp -r systemd/volumes/* %{buildroot}/usr/share/containers/systemd/ cp -r systemd/networks/* %{buildroot}/usr/share/containers/systemd/ -cp -r systemd/targets/* %{buildroot}/etc/systemd/system/ -cp -r systemd/system/* %{buildroot}/etc/systemd/system/ +cp -r systemd/targets/* %{buildroot}/usr/lib/systemd/system/ +cp -r systemd/system/* %{buildroot}/usr/lib/systemd/system/ cp scripts/bootstrap_openchami.sh %{buildroot}/usr/libexec/openchami/ cp scripts/openchami-certificate-update %{buildroot}/usr/bin/ cp scripts/openchami_profile.sh %{buildroot}/etc/profile.d/openchami.sh @@ -61,10 +61,10 @@ chmod 644 %{buildroot}/etc/openchami/configs/* %license LICENSE %config(noreplace) /etc/openchami/configs/* /usr/share/containers/systemd/* -/etc/systemd/system/openchami.target -/etc/systemd/system/openchami-cert-renewal.service -/etc/systemd/system/openchami-cert-renewal.timer -/etc/systemd/system/openchami-cert-trust.service +/usr/lib/systemd/system/openchami.target +/usr/lib/systemd/system/openchami-cert-renewal.service +/usr/lib/systemd/system/openchami-cert-renewal.timer +/usr/lib/systemd/system/openchami-cert-trust.service /usr/libexec/openchami/bootstrap_openchami.sh /usr/libexec/openchami/ohpc-nodes.sh /etc/profile.d/openchami.sh From b6c57466b15c95bfc27181409665626b6bf90ae4 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 30 Jun 2026 12:35:29 -0600 Subject: [PATCH 03/20] remove unnecessary addition to opaal container /etc/hosts file Signed-off-by: Sean Tronsen --- systemd/containers/opaal.container | 2 -- 1 file changed, 2 deletions(-) diff --git a/systemd/containers/opaal.container b/systemd/containers/opaal.container index 700b72c..862a6aa 100644 --- a/systemd/containers/opaal.container +++ b/systemd/containers/opaal.container @@ -22,8 +22,6 @@ Exec=/opaal/opaal login --config /opaal/config/opaal.yaml Network=openchami-internal.network Network=openchami-jwt-internal.network -# Extra hosts -PodmanArgs=--add-host='demo.openchami.cluster:172.16.0.254' # Proxy settings PodmanArgs=--http-proxy=false From f385778c3f58149166f30e30db5b9cc21b045028 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 30 Jun 2026 13:32:18 -0600 Subject: [PATCH 04/20] swap env var placeholders for built-in systemd specifiers Signed-off-by: Sean Tronsen --- systemd/configs/openchami.env | 26 +++++++++++----------- systemd/containers/acme-deploy.container | 6 ++++- systemd/containers/acme-register.container | 10 ++++++--- 3 files changed, 25 insertions(+), 17 deletions(-) diff --git a/systemd/configs/openchami.env b/systemd/configs/openchami.env index efbe4ea..bb6479c 100644 --- a/systemd/configs/openchami.env +++ b/systemd/configs/openchami.env @@ -1,15 +1,15 @@ -# Environemnt Variables -SYSTEM_NAME=demo -SYSTEM_DOMAIN=openchami.cluster - -SYSTEM_URL=demo.openchami.cluster - -# Environemnt Variables -URLS_SELF_ISSUER=https://${SYSTEM_URL}/ -URLS_SELF_PUBLIC=https://${SYSTEM_URL}/ -URLS_LOGIN=https://${SYSTEM_URL}/login -URLS_CONSENT=https://${SYSTEM_URL}/consent -URLS_LOGOUT=https://${SYSTEM_URL}/logout +# Environment Variables +# %H is a Systemd specifier which expands to the system hostname +# If %H is a proper FQDN, %l expands to the short hostname (host label) +# +# Note: If site-specific modifications were applied via +# `openchami-certificate-update`, the value overrides can be found in +# /etc/containers/systemd/containers.d/99-openchami-site-override.conf +URLS_SELF_ISSUER=https://%H/ +URLS_SELF_PUBLIC=https://%H/ +URLS_LOGIN=https://%H/login +URLS_CONSENT=https://%H/consent +URLS_LOGOUT=https://%H/logout # Environemnt Variables POSTGRES_USER=ochami @@ -25,7 +25,7 @@ BSS_DBUSER=bss-user BSS_JWKS_URL=http://opaal:3333/keys BSS_OAUTH2_ADMIN_BASE_URL=http://opaal:3333 BSS_OAUTH2_PUBLIC_BASE_URL=http://opaal:3333 -BSS_IPXE_SERVER=${SYSTEM_URL} +BSS_IPXE_SERVER=%H BSS_CHAIN_PROTO=https # Environemnt Variables diff --git a/systemd/containers/acme-deploy.container b/systemd/containers/acme-deploy.container index ee2bc06..e7dd1ae 100644 --- a/systemd/containers/acme-deploy.container +++ b/systemd/containers/acme-deploy.container @@ -23,11 +23,15 @@ Environment=DEPLOY_HAPROXY_PEM_PATH=/etc/haproxy/certs # Environment Variables EnvironmentFile=/etc/openchami/configs/openchami.env +# **optional:** OpenCHAMI site-specific overrides are managed in +# /etc/containers/systemd/acme-register.service.d/99-site-override.conf +Environment=SYSTEM_FQDN=%H + # Command Exec=--deploy \ --ca-bundle /root_ca/root_ca.crt \ --server https://step-ca:9000/acme/acme/directory \ - -d ${SYSTEM_URL} \ + -d ${SYSTEM_FQDN} \ --home /acme.sh \ --standalone \ --deploy-hook haproxy \ diff --git a/systemd/containers/acme-register.container b/systemd/containers/acme-register.container index 82203dd..d4a8fa9 100644 --- a/systemd/containers/acme-register.container +++ b/systemd/containers/acme-register.container @@ -5,8 +5,8 @@ After=acme-certs-volume.service openchami-cert-trust.service acme-certs-volume.s PartOf=openchami.target [Container] -ContainerName=demo.openchami.cluster -HostName=demo.openchami.cluster +ContainerName=%H +HostName=%H Image=docker.io/neilpang/acme.sh:3.1.1 # Volumes @@ -19,11 +19,15 @@ Network=openchami-cert-internal.network # Environment Variables EnvironmentFile=/etc/openchami/configs/openchami.env +# **optional:** OpenCHAMI site-specific overrides are managed in +# /etc/containers/systemd/acme-register.service.d/99-site-override.conf +Environment=SYSTEM_FQDN=%H + Exec=--issue \ --ca-bundle /root_ca/root_ca.crt \ --server https://step-ca:9000/acme/acme/directory \ --home /acme.sh \ - -d ${SYSTEM_URL} \ + -d ${SYSTEM_FQDN} \ --standalone \ --force From 7ddaee3fb8130f7cdf8a0ba2b65f84a6154801d3 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 30 Jun 2026 13:33:16 -0600 Subject: [PATCH 05/20] remove unnecessary dns configuration from bootstrap Signed-off-by: Sean Tronsen --- scripts/bootstrap_openchami.sh | 32 -------------------------------- 1 file changed, 32 deletions(-) diff --git a/scripts/bootstrap_openchami.sh b/scripts/bootstrap_openchami.sh index 25da6d0..ea1a663 100644 --- a/scripts/bootstrap_openchami.sh +++ b/scripts/bootstrap_openchami.sh @@ -23,32 +23,6 @@ create_secret_if_not_exists() { fi } -# Function to define system_name and system_domain in the environment file -generate_environment_file() { - local short_name=$(hostname -s) - local dns_name=$(hostname -d) - local system_fqdn=$(hostname) - - sed -i "s/^SYSTEM_NAME=.*/SYSTEM_NAME=${short_name}/" /etc/openchami/configs/openchami.env - sed -i "s/^SYSTEM_DOMAIN=.*/SYSTEM_DOMAIN=${dns_name}/" /etc/openchami/configs/openchami.env - sed -i "s/^SYSTEM_URL=.*/SYSTEM_URL=${system_fqdn}/" /etc/openchami/configs/openchami.env - sed -i "s|^URLS_SELF_ISSUER=.*|URLS_SELF_ISSUER=https://${system_fqdn}|" /etc/openchami/configs/openchami.env - sed -i "s|^URLS_SELF_PUBLIC=.*|URLS_SELF_PUBLIC=https://${system_fqdn}|" /etc/openchami/configs/openchami.env - sed -i "s|^URLS_LOGIN=.*|URLS_LOGIN=https://${system_fqdn}/login|" /etc/openchami/configs/openchami.env - sed -i "s|^URLS_CONSENT=.*|URLS_CONSENT=https://${system_fqdn}/consent|" /etc/openchami/configs/openchami.env - sed -i "s|^URLS_LOGOUT=.*|URLS_LOGOUT=https://${system_fqdn}/logout|" /etc/openchami/configs/openchami.env -} - -acme_correction() { - local system_fqdn=$(hostname) - primary_ip=$(hostname -I | awk '{print $1}') - sed -i "s|-d .* \\\\|-d ${system_fqdn} \\\\|" /usr/share/containers/systemd/acme-deploy.container - sed -i "s/^ContainerName=.*/ContainerName=${system_fqdn}/" /usr/share/containers/systemd/acme-register.container - sed -i "s/^HostName=.*/HostName=${system_fqdn}/" /usr/share/containers/systemd/acme-register.container - sed -i "s|-d .* \\\\|-d ${system_fqdn} \\\\|" /usr/share/containers/systemd/acme-register.container - sed -i "s|--add-host='demo\.openchami\.cluster:[0-9\.]*'|--add-host='${system_fqdn}:${primary_ip}'|" /usr/share/containers/systemd/opaal.container -} - # Check and create secrets with random passwords if needed # Postgres Password @@ -78,9 +52,3 @@ create_secret_if_not_exists "hydra_dsn" "$HYDRA_DSN" # POSTGRES_MULTIPLE_DATABASES POSTGRES_MULTIPLE_DATABASES="hmsds:smd-user:$(podman secret inspect smd_postgres_password --showsecret | jq -r '.[0].SecretData'),bssdb:bss-user:$(podman secret inspect bss_postgres_password --showsecret | jq -r '.[0].SecretData'),hydradb:hydra-user:$(podman secret inspect hydra_postgres_password --showsecret | jq -r '.[0].SecretData')" create_secret_if_not_exists "postgres_multiple_databases" "$POSTGRES_MULTIPLE_DATABASES" - -# openchami.env Configuration -generate_environment_file - -# Correct the ACME files -acme_correction \ No newline at end of file From fa4075122aa8ce4f1e19382be346d2e8512a4aa2 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 30 Jun 2026 13:33:55 -0600 Subject: [PATCH 06/20] refactor openchami-certificate-update to use systemd unit override files Signed-off-by: Sean Tronsen --- scripts/openchami-certificate-update | 48 +++++++++++++++++----------- 1 file changed, 30 insertions(+), 18 deletions(-) diff --git a/scripts/openchami-certificate-update b/scripts/openchami-certificate-update index d9e3dba..be553c4 100755 --- a/scripts/openchami-certificate-update +++ b/scripts/openchami-certificate-update @@ -2,24 +2,36 @@ update_dns() { local system_fqdn=$1 - local short_name="${system_fqdn%%.*}" - local dns_name="${system_fqdn#*.}" - local primary_ip=$(hostname -I | awk '{print $1}') - - # Update names in environment and acme containers - sed -i "s/^SYSTEM_NAME=.*/SYSTEM_NAME=${short_name}/" /etc/openchami/configs/openchami.env - sed -i "s/^SYSTEM_DOMAIN=.*/SYSTEM_DOMAIN=${dns_name}/" /etc/openchami/configs/openchami.env - sed -i "s/^SYSTEM_URL=.*/SYSTEM_URL=${system_fqdn}/" /etc/openchami/configs/openchami.env - sed -i "s|^URLS_SELF_ISSUER=.*|URLS_SELF_ISSUER=https://${system_fqdn}|" /etc/openchami/configs/openchami.env - sed -i "s|^URLS_SELF_PUBLIC=.*|URLS_SELF_PUBLIC=https://${system_fqdn}|" /etc/openchami/configs/openchami.env - sed -i "s|^URLS_LOGIN=.*|URLS_LOGIN=https://${system_fqdn}/login|" /etc/openchami/configs/openchami.env - sed -i "s|^URLS_CONSENT=.*|URLS_CONSENT=https://${system_fqdn}/consent|" /etc/openchami/configs/openchami.env - sed -i "s|^URLS_LOGOUT=.*|URLS_LOGOUT=https://${system_fqdn}/logout|" /etc/openchami/configs/openchami.env - sed -i "s|-d .* \\\\|-d ${system_fqdn} \\\\|" /usr/share/containers/systemd/acme-deploy.container - sed -i "s/^ContainerName=.*/ContainerName=${system_fqdn}/" /usr/share/containers/systemd/acme-register.container - sed -i "s/^HostName=.*/HostName=${system_fqdn}/" /usr/share/containers/systemd/acme-register.container - sed -i "s|-d .* \\\\|-d ${system_fqdn} \\\\|" /usr/share/containers/systemd/acme-register.container - sed -i "s|--add-host='.*|--add-host='${system_fqdn}:${primary_ip}'|" /usr/share/containers/systemd/opaal.container + mkdir -v -p /etc/containers/systemd/containers.d + + echo "Updating local site-specific OpenCHAMI URL overrides..." + cat < Date: Tue, 30 Jun 2026 15:08:25 -0600 Subject: [PATCH 07/20] wip:fix Signed-off-by: Sean Tronsen --- scripts/openchami-certificate-update | 39 +++++++-------- systemd/configs/openchami.env | 47 +++++++++++-------- systemd/containers/acme-deploy.container | 7 +-- systemd/containers/acme-register.container | 7 +-- .../containers/containers.d/10-openchami.conf | 12 +++++ 5 files changed, 68 insertions(+), 44 deletions(-) create mode 100644 systemd/containers/containers.d/10-openchami.conf diff --git a/scripts/openchami-certificate-update b/scripts/openchami-certificate-update index be553c4..961dd3f 100755 --- a/scripts/openchami-certificate-update +++ b/scripts/openchami-certificate-update @@ -6,31 +6,32 @@ update_dns() { echo "Updating local site-specific OpenCHAMI URL overrides..." cat < Date: Tue, 14 Jul 2026 11:12:16 -0600 Subject: [PATCH 08/20] revise comments in openchami.env to be more descriptive Signed-off-by: Sean Tronsen --- systemd/configs/openchami.env | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/systemd/configs/openchami.env b/systemd/configs/openchami.env index 92f7609..3ee686a 100644 --- a/systemd/configs/openchami.env +++ b/systemd/configs/openchami.env @@ -1,7 +1,12 @@ -# Environment Variables +# openchami.env +# +# The environment variable definitions specified within this file can be +# modified to customize the behavior of OpenCHAMI services. + +# POSTGRESQL POSTGRES_USER=ochami -# Environment Variables +# BSS - Boot Script Service BSS_USESQL=true BSS_INSECURE=true BSS_DEBUG=true @@ -15,7 +20,7 @@ BSS_OAUTH2_PUBLIC_BASE_URL=http://opaal:3333 # BSS_IPXE_SERVER=%H BSS_CHAIN_PROTO=https -# Environment Variables +# SMD - State Management Database SMD_DBHOST=postgres SMD_DBPORT=5432 SMD_DBNAME=hmsds @@ -23,7 +28,7 @@ SMD_DBUSER=smd-user SMD_DBOPTS=sslmode=disable SMD_JWKS_URL=http://opaal:3333/keys -# Environment Variables +# ACME - SMALLSTEP - Automated Certificate Management Environment STEPPATH=/home/step DOCKER_STEPCA_INIT_NAME=OpenCHAMI DOCKER_STEPCA_INIT_DNS_NAMES=step-ca,step-ca.openchami.cluster @@ -32,19 +37,21 @@ DOCKER_STEPCA_INIT_PASSWORD="supersecretpassword" DOCKER_STEPCA_INIT_PROVISIONER_NAME="Admin" DOCKER_STEPCA_INIT_PROVISIONER_PASSWORD="provisionerpassword" -# Environment Variables +# OPAAL - OIDC Provider Automated Authorization Login OPAAL_URL=http://opaal:3333 HSM_URL=http://smd:27779 ANSIBLE_HOST_KEY_CHECKING=False -# Environment Variables for cloud-init +# CLOUD-INIT-SERVER LISTEN=:27777 SMD_URL=http://smd:27779 OPAAL_URL=http://opaal:3333 JWKS_URL=http://opaal:3333/keys IMPERSONATION=true -# Note: The following variables are assigned dynamically using a systemd unit +# GLOBAL VARS +# +# NOTE: The following variables are assigned dynamically using a systemd unit # override configuration file: /usr/share/containers/systemd/containers.d/10-openchami.conf # # '%H' expands to the system hostname and serves as a sane dynamic default. To @@ -56,7 +63,7 @@ IMPERSONATION=true # URLS_LOGOUT=https://%H/logout # BSS_IPXE_SERVER=%H -# Note: If site-specific modifications were applied via +# NOTE: If site-specific modifications were applied via # `openchami-certificate-update`, the value overrides can be found in # /etc/containers/systemd/containers.d/99-openchami-site-override.conf # URLS_SELF_ISSUER=https://%H/ From d9218709ebb0ab9979836f1b3e538433fe72b303 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 14 Jul 2026 11:19:57 -0600 Subject: [PATCH 09/20] address capitalization nitpick in acme deploy quadlet Signed-off-by: Sean Tronsen --- systemd/containers/acme-deploy.container | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/systemd/containers/acme-deploy.container b/systemd/containers/acme-deploy.container index bc69157..1417346 100644 --- a/systemd/containers/acme-deploy.container +++ b/systemd/containers/acme-deploy.container @@ -23,7 +23,7 @@ Environment=DEPLOY_HAPROXY_PEM_PATH=/etc/haproxy/certs # Environment Variables EnvironmentFile=/etc/openchami/configs/openchami.env -# **optional:** OpenCHAMI site-specific overrides are managed in +# **OPTIONAL:** OpenCHAMI site-specific overrides are managed in # /etc/containers/systemd/acme-register.service.d/99-site-override.conf Environment=SYSTEM_FQDN=%H From 2d3a2707bf93e387e74965992a59b6a381cd049e Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 14 Jul 2026 11:26:40 -0600 Subject: [PATCH 10/20] address capitalization nitpick in acme register quadlet Signed-off-by: Sean Tronsen --- systemd/containers/acme-register.container | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/systemd/containers/acme-register.container b/systemd/containers/acme-register.container index 05f9dce..087ad73 100644 --- a/systemd/containers/acme-register.container +++ b/systemd/containers/acme-register.container @@ -19,7 +19,7 @@ Network=openchami-cert-internal.network # Environment Variables EnvironmentFile=/etc/openchami/configs/openchami.env -# **optional:** OpenCHAMI site-specific overrides are managed in +# **OPTIONAL:** OpenCHAMI site-specific overrides are managed in # /etc/containers/systemd/acme-register.service.d/99-site-override.conf Environment=SYSTEM_FQDN=%H From 049de869137df55d8309fdd3259e1b21f9e6be56 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 14 Jul 2026 11:39:44 -0600 Subject: [PATCH 11/20] spotfix RPM install warning check for legacy coresmd.container Signed-off-by: Sean Tronsen --- openchami.spec | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/openchami.spec b/openchami.spec index 54e7e19..9964b3b 100644 --- a/openchami.spec +++ b/openchami.spec @@ -72,8 +72,16 @@ chmod 644 %{buildroot}/etc/openchami/configs/* /usr/bin/openchami-certificate-update %pre -if [ -f /usr/share/containers/systemd/coresmd.container ]; then - echo 'WARNING: /usr/share/containers/systemd/coresmd.container as been replaced by /usr/share/containers/systemd/coresmd-coredhcp.container.' +# NOTES: +# 1. `coresmd` refers to the legacy implementation before the CoreDNS split. +# 2. Releases now install Quadlets under the standard system-managed path, +# `/usr/share/containers/systemd`, instead of the admin-managed +# `/etc/containers/systemd`. This aligns with standard systemd override +# semantics and keeps local modifications separate from packaged files. +# 3. This warning and these comments will remain until support for the legacy, +# non-fabrica services is dropped. +if [ -f /etc/containers/systemd/coresmd.container ]; then + echo 'WARNING: /etc/containers/systemd/coresmd.container as been replaced by /usr/share/containers/systemd/coresmd-coredhcp.container.' echo ' Migrate to coresmd-coredhcp to avoid any issues.' fi From f17bf87a1b8821ce71a853b33bf5e9f5435f6954 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 14 Jul 2026 11:42:46 -0600 Subject: [PATCH 12/20] reduce openchami-certificate-update logging noise by swapping out tee Signed-off-by: Sean Tronsen --- scripts/openchami-certificate-update | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/openchami-certificate-update b/scripts/openchami-certificate-update index 961dd3f..86a321a 100755 --- a/scripts/openchami-certificate-update +++ b/scripts/openchami-certificate-update @@ -5,7 +5,7 @@ update_dns() { mkdir -v -p /etc/containers/systemd/containers.d echo "Updating local site-specific OpenCHAMI URL overrides..." - cat < /etc/containers/systemd/containers.d/99-openchami-site-override.conf # MANAGED BY '${0}' [Container] Environment=URLS_SELF_ISSUER=https://${system_fqdn} @@ -18,7 +18,7 @@ EOF echo "Updating local site-specific OpenCHAMI ACME FQDN..." mkdir -v -p /etc/containers/systemd/acme-deploy.container.d - cat < /etc/containers/systemd/acme-deploy.container.d/99-site-override.conf # MANAGED BY '$0' [Container] Environment=SYSTEM_FQDN=${system_fqdn} @@ -26,7 +26,7 @@ EOF mkdir -v -p /etc/containers/systemd/acme-register.container.d - cat < /etc/containers/systemd/acme-register.container.d/99-site-override.conf # MANAGED BY '${0}' [Container] ContainerName=${system_fqdn} From f091e906b09c5d438ab6017673ffdbe4171dc0bf Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 14 Jul 2026 12:30:06 -0600 Subject: [PATCH 13/20] capitalization nitpick fixes Signed-off-by: Sean Tronsen --- systemd/configs/openchami.env | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/systemd/configs/openchami.env b/systemd/configs/openchami.env index 3ee686a..51fa31f 100644 --- a/systemd/configs/openchami.env +++ b/systemd/configs/openchami.env @@ -28,7 +28,7 @@ SMD_DBUSER=smd-user SMD_DBOPTS=sslmode=disable SMD_JWKS_URL=http://opaal:3333/keys -# ACME - SMALLSTEP - Automated Certificate Management Environment +# ACME - Smallstep - Automated Certificate Management Environment STEPPATH=/home/step DOCKER_STEPCA_INIT_NAME=OpenCHAMI DOCKER_STEPCA_INIT_DNS_NAMES=step-ca,step-ca.openchami.cluster @@ -42,14 +42,14 @@ OPAAL_URL=http://opaal:3333 HSM_URL=http://smd:27779 ANSIBLE_HOST_KEY_CHECKING=False -# CLOUD-INIT-SERVER +# cloud-init-server LISTEN=:27777 SMD_URL=http://smd:27779 OPAAL_URL=http://opaal:3333 JWKS_URL=http://opaal:3333/keys IMPERSONATION=true -# GLOBAL VARS +# global vars # # NOTE: The following variables are assigned dynamically using a systemd unit # override configuration file: /usr/share/containers/systemd/containers.d/10-openchami.conf From 5cd2e0008b586e2d6bd73c447da823ca749ea894 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 14 Jul 2026 12:32:01 -0600 Subject: [PATCH 14/20] fix asterisks nitpick in acme quadlets Signed-off-by: Sean Tronsen --- systemd/containers/acme-deploy.container | 2 +- systemd/containers/acme-register.container | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/systemd/containers/acme-deploy.container b/systemd/containers/acme-deploy.container index 1417346..0a1a576 100644 --- a/systemd/containers/acme-deploy.container +++ b/systemd/containers/acme-deploy.container @@ -23,7 +23,7 @@ Environment=DEPLOY_HAPROXY_PEM_PATH=/etc/haproxy/certs # Environment Variables EnvironmentFile=/etc/openchami/configs/openchami.env -# **OPTIONAL:** OpenCHAMI site-specific overrides are managed in +# OPTIONAL: OpenCHAMI site-specific overrides are managed in # /etc/containers/systemd/acme-register.service.d/99-site-override.conf Environment=SYSTEM_FQDN=%H diff --git a/systemd/containers/acme-register.container b/systemd/containers/acme-register.container index 087ad73..1f849bf 100644 --- a/systemd/containers/acme-register.container +++ b/systemd/containers/acme-register.container @@ -19,7 +19,7 @@ Network=openchami-cert-internal.network # Environment Variables EnvironmentFile=/etc/openchami/configs/openchami.env -# **OPTIONAL:** OpenCHAMI site-specific overrides are managed in +# OPTIONAL: OpenCHAMI site-specific overrides are managed in # /etc/containers/systemd/acme-register.service.d/99-site-override.conf Environment=SYSTEM_FQDN=%H From 4e6acf48ed8746f5520e295aa4048784d9bb1542 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 14 Jul 2026 15:28:44 -0400 Subject: [PATCH 15/20] add unset capability to openchami-certificate-update Signed-off-by: Sean Tronsen --- scripts/openchami-certificate-update | 83 ++++++++++++++++++++-------- 1 file changed, 59 insertions(+), 24 deletions(-) diff --git a/scripts/openchami-certificate-update b/scripts/openchami-certificate-update index 86a321a..c41839b 100755 --- a/scripts/openchami-certificate-update +++ b/scripts/openchami-certificate-update @@ -1,12 +1,31 @@ -#!/bin/bash +#!/usr/bin/bash + +FILE_OVERRIDE_GLOBAL="/etc/containers/systemd/containers.d/99-openchami-site-override.conf" +FILE_OVERRIDE_ACME_DEPLOY="/etc/containers/systemd/acme-deploy.container.d/99-site-override.conf" +FILE_OVERRIDE_ACME_REGISTER="/etc/containers/systemd/acme-register.container.d/99-site-override.conf" + +notify_dns_change() { + echo "Changed FQDN to $1" + echo 'Either restart all of the OpenCHAMI services:' + echo + echo ' sudo systemctl restart openchami.target' + echo + echo 'or run the following to just regenerate/redeploy the certificates:' + echo + echo ' sudo systemctl restart acme-deploy' + echo +} update_dns() { - local system_fqdn=$1 - mkdir -v -p /etc/containers/systemd/containers.d + local system_fqdn="$1" + local workfile + + workfile="$(mktemp)" + trap 'rm -f "$workfile"' RETURN echo "Updating local site-specific OpenCHAMI URL overrides..." - cat < /etc/containers/systemd/containers.d/99-openchami-site-override.conf -# MANAGED BY '${0}' + cat < "${workfile}" +# MANAGED BY '$0' [Container] Environment=URLS_SELF_ISSUER=https://${system_fqdn} Environment=URLS_SELF_PUBLIC=https://${system_fqdn} @@ -15,37 +34,37 @@ Environment=URLS_CONSENT=https://${system_fqdn}/consent Environment=URLS_LOGOUT=https://${system_fqdn}/logout Environment=BSS_IPXE_SERVER=${system_fqdn} EOF + install -D -m 0644 "${workfile}" "${FILE_OVERRIDE_GLOBAL}" echo "Updating local site-specific OpenCHAMI ACME FQDN..." - mkdir -v -p /etc/containers/systemd/acme-deploy.container.d - cat < /etc/containers/systemd/acme-deploy.container.d/99-site-override.conf + cat < "${workfile}" # MANAGED BY '$0' [Container] Environment=SYSTEM_FQDN=${system_fqdn} EOF + install -D -m 0644 "${workfile}" "${FILE_OVERRIDE_ACME_DEPLOY}" - - mkdir -v -p /etc/containers/systemd/acme-register.container.d - cat < /etc/containers/systemd/acme-register.container.d/99-site-override.conf -# MANAGED BY '${0}' + cat < "${workfile}" +# MANAGED BY '$0' [Container] ContainerName=${system_fqdn} HostName=${system_fqdn} Environment=SYSTEM_FQDN=${system_fqdn} EOF + install -D -m 0644 "${workfile}" "${FILE_OVERRIDE_ACME_REGISTER}" +} - # Reload systemD after .container changes - systemctl daemon-reload +unset_dns() { + echo "Removing local site-specific OpenCHAMI overrides..." - echo "Changed FQDN to ${1}" - echo 'Either restart all of the OpenCHAMI services:' - echo - echo ' sudo systemctl restart openchami.target' - echo - echo 'or run the following to just regenerate/redeploy the certificates:' - echo - echo ' sudo systemctl restart acme-deploy' - echo + local file + for file in \ + "$FILE_OVERRIDE_GLOBAL" \ + "$FILE_OVERRIDE_ACME_DEPLOY" \ + "$FILE_OVERRIDE_ACME_REGISTER" + do + [ -e "$file" ] && rm -v "$file" + done } help_page() { @@ -55,21 +74,37 @@ help_page() { echo echo "EXAMPLES:" echo " $0 update demo.openchami.cluster" - } + case "$1" in update) if [[ -z "$2" ]]; then help_page else if [[ $EUID -ne 0 ]]; then - echo "This script must be run as root" + echo "This script must be run as root" exit 1 else update_dns "$2" + + # Reload SystemD after .container override changes + systemctl daemon-reload + notify_dns_change "$2" fi fi ;; + unset) + if [[ $EUID -ne 0 ]]; then + echo "This script must be run as root" + exit 1 + else + unset_dns + + # Reload SystemD after .container override changes + systemctl daemon-reload + notify_dns_change "system hostname ($(hostnamectl hostname))" + fi + ;; *) help_page exit 1 From f05be2ebc3464ffc3f7b4c2e0090433770c1da72 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 14 Jul 2026 15:46:34 -0400 Subject: [PATCH 16/20] address shell syntax nitpick in acme quadlets Signed-off-by: Sean Tronsen --- systemd/containers/acme-deploy.container | 2 +- systemd/containers/acme-register.container | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/systemd/containers/acme-deploy.container b/systemd/containers/acme-deploy.container index 0a1a576..fbd3591 100644 --- a/systemd/containers/acme-deploy.container +++ b/systemd/containers/acme-deploy.container @@ -32,7 +32,7 @@ Entrypoint=/bin/sh Exec=-ec '/entry.sh --deploy \ --ca-bundle /root_ca/root_ca.crt \ --server https://step-ca:9000/acme/acme/directory \ - -d "$SYSTEM_FQDN" \ + -d "$${SYSTEM_FQDN}" \ --home /acme.sh \ --standalone \ --deploy-hook haproxy \ diff --git a/systemd/containers/acme-register.container b/systemd/containers/acme-register.container index 1f849bf..d2ef00c 100644 --- a/systemd/containers/acme-register.container +++ b/systemd/containers/acme-register.container @@ -28,7 +28,7 @@ Exec=-ec '/entry.sh --issue \ --ca-bundle /root_ca/root_ca.crt \ --server https://step-ca:9000/acme/acme/directory \ --home /acme.sh \ - -d "$SYSTEM_FQDN" \ + -d "$${SYSTEM_FQDN}" \ --standalone \ --force' From 5efcf06708967bcde6932482e9f517a645ad88e4 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 14 Jul 2026 17:02:48 -0400 Subject: [PATCH 17/20] change ContainerName for acme-register quadlet Signed-off-by: Sean Tronsen --- scripts/openchami-certificate-update | 1 - systemd/containers/acme-register.container | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/scripts/openchami-certificate-update b/scripts/openchami-certificate-update index c41839b..85fc357 100755 --- a/scripts/openchami-certificate-update +++ b/scripts/openchami-certificate-update @@ -47,7 +47,6 @@ EOF cat < "${workfile}" # MANAGED BY '$0' [Container] -ContainerName=${system_fqdn} HostName=${system_fqdn} Environment=SYSTEM_FQDN=${system_fqdn} EOF diff --git a/systemd/containers/acme-register.container b/systemd/containers/acme-register.container index d2ef00c..b25aa75 100644 --- a/systemd/containers/acme-register.container +++ b/systemd/containers/acme-register.container @@ -5,7 +5,7 @@ After=acme-certs-volume.service openchami-cert-trust.service acme-certs-volume.s PartOf=openchami.target [Container] -ContainerName=%H +ContainerName=acme-register HostName=%H Image=docker.io/neilpang/acme.sh:3.1.1 From 92b1fe5f04ef8c68ddf3f1f8e7dcffa8f881c157 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Wed, 15 Jul 2026 12:11:42 -0400 Subject: [PATCH 18/20] address nitpick about nesting shell parameter expansions in acme quadlets Signed-off-by: Sean Tronsen --- scripts/openchami-certificate-update | 4 ++- systemd/containers/acme-deploy.container | 29 +++++++++++++++------- systemd/containers/acme-register.container | 23 ++++++++++++----- 3 files changed, 40 insertions(+), 16 deletions(-) diff --git a/scripts/openchami-certificate-update b/scripts/openchami-certificate-update index 85fc357..fb6c3bb 100755 --- a/scripts/openchami-certificate-update +++ b/scripts/openchami-certificate-update @@ -39,7 +39,7 @@ EOF echo "Updating local site-specific OpenCHAMI ACME FQDN..." cat < "${workfile}" # MANAGED BY '$0' -[Container] +[Service] Environment=SYSTEM_FQDN=${system_fqdn} EOF install -D -m 0644 "${workfile}" "${FILE_OVERRIDE_ACME_DEPLOY}" @@ -48,6 +48,8 @@ EOF # MANAGED BY '$0' [Container] HostName=${system_fqdn} + +[Service] Environment=SYSTEM_FQDN=${system_fqdn} EOF install -D -m 0644 "${workfile}" "${FILE_OVERRIDE_ACME_REGISTER}" diff --git a/systemd/containers/acme-deploy.container b/systemd/containers/acme-deploy.container index fbd3591..e471976 100644 --- a/systemd/containers/acme-deploy.container +++ b/systemd/containers/acme-deploy.container @@ -17,22 +17,29 @@ Volume=haproxy-certs:/etc/haproxy/certs/:z # Networks for the Container to use Network=openchami-cert-internal.network -# haproxy deploy hook requires the directory to be specified in an environment variable -Environment=DEPLOY_HAPROXY_PEM_PATH=/etc/haproxy/certs - # Environment Variables EnvironmentFile=/etc/openchami/configs/openchami.env -# OPTIONAL: OpenCHAMI site-specific overrides are managed in -# /etc/containers/systemd/acme-register.service.d/99-site-override.conf -Environment=SYSTEM_FQDN=%H +# haproxy deploy hook requires the directory to be specified in an environment variable +Environment=DEPLOY_HAPROXY_PEM_PATH=/etc/haproxy/certs + +# NOTE: Do not modify this environment variable. It exists solely as a +# placeholder to trigger systemd environment variable expansion. +# +# The [Container] Environment= directive only generates Podman's `-e` options; +# it does not define a systemd environment variable. As a result, values +# referenced by systemd (which may themselves contain systemd specifiers such +# as %H) are not expanded as intended. +# +# If you need to override this value, override the corresponding Environment= +# entry in the [Service] section instead. +Environment=SYSTEM_FQDN=${SYSTEMD_FQDN} # Command -Entrypoint=/bin/sh -Exec=-ec '/entry.sh --deploy \ +Exec=--deploy \ --ca-bundle /root_ca/root_ca.crt \ --server https://step-ca:9000/acme/acme/directory \ - -d "$${SYSTEM_FQDN}" \ + -d ${SYSTEM_FQDN} \ --home /acme.sh \ --standalone \ --deploy-hook haproxy \ @@ -42,3 +49,7 @@ Exec=-ec '/entry.sh --deploy \ Restart=on-failure Type=oneshot RemainAfterExit=yes + +# OPTIONAL: OpenCHAMI site-specific overrides are managed in +# /etc/containers/systemd/acme-deploy.service.d/99-site-override.conf +Environment=SYSTEM_FQDN=%H diff --git a/systemd/containers/acme-register.container b/systemd/containers/acme-register.container index b25aa75..3d68379 100644 --- a/systemd/containers/acme-register.container +++ b/systemd/containers/acme-register.container @@ -19,16 +19,23 @@ Network=openchami-cert-internal.network # Environment Variables EnvironmentFile=/etc/openchami/configs/openchami.env -# OPTIONAL: OpenCHAMI site-specific overrides are managed in -# /etc/containers/systemd/acme-register.service.d/99-site-override.conf -Environment=SYSTEM_FQDN=%H +# NOTE: Do not modify this environment variable. It exists solely as a +# placeholder to trigger systemd environment variable expansion. +# +# The [Container] Environment= directive only generates Podman's `-e` options; +# it does not define a systemd environment variable. As a result, values +# referenced by systemd (which may themselves contain systemd specifiers such +# as %H) are not expanded as intended. +# +# If you need to override this value, override the corresponding Environment= +# entry in the [Service] section instead. +Environment=SYSTEM_FQDN=${SYSTEMD_FQDN} -Entrypoint=/bin/sh -Exec=-ec '/entry.sh --issue \ +Exec=--issue \ --ca-bundle /root_ca/root_ca.crt \ --server https://step-ca:9000/acme/acme/directory \ --home /acme.sh \ - -d "$${SYSTEM_FQDN}" \ + -d ${SYSTEM_FQDN} \ --standalone \ --force' @@ -36,3 +43,7 @@ Exec=-ec '/entry.sh --issue \ Restart=on-failure Type=oneshot RemainAfterExit=yes + +# OPTIONAL: OpenCHAMI site-specific overrides are managed in +# /etc/containers/systemd/acme-register.service.d/99-site-override.conf +Environment=SYSTEM_FQDN=%H From 011c7d7b39f2d55cb7638edc854d4d93d0122af6 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Wed, 15 Jul 2026 13:06:29 -0400 Subject: [PATCH 19/20] modify override gen function to use unit prefix patterns for dedup Signed-off-by: Sean Tronsen --- scripts/openchami-certificate-update | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/scripts/openchami-certificate-update b/scripts/openchami-certificate-update index fb6c3bb..7471e9f 100755 --- a/scripts/openchami-certificate-update +++ b/scripts/openchami-certificate-update @@ -1,7 +1,7 @@ #!/usr/bin/bash FILE_OVERRIDE_GLOBAL="/etc/containers/systemd/containers.d/99-openchami-site-override.conf" -FILE_OVERRIDE_ACME_DEPLOY="/etc/containers/systemd/acme-deploy.container.d/99-site-override.conf" +FILE_OVERRIDE_ACME_QUADLETS="/etc/containers/systemd/acme-.container.d/99-site-override.conf" FILE_OVERRIDE_ACME_REGISTER="/etc/containers/systemd/acme-register.container.d/99-site-override.conf" notify_dns_change() { @@ -42,15 +42,12 @@ EOF [Service] Environment=SYSTEM_FQDN=${system_fqdn} EOF - install -D -m 0644 "${workfile}" "${FILE_OVERRIDE_ACME_DEPLOY}" + install -D -m 0644 "${workfile}" "${FILE_OVERRIDE_ACME_QUADLETS}" cat < "${workfile}" # MANAGED BY '$0' [Container] HostName=${system_fqdn} - -[Service] -Environment=SYSTEM_FQDN=${system_fqdn} EOF install -D -m 0644 "${workfile}" "${FILE_OVERRIDE_ACME_REGISTER}" } @@ -61,7 +58,7 @@ unset_dns() { local file for file in \ "$FILE_OVERRIDE_GLOBAL" \ - "$FILE_OVERRIDE_ACME_DEPLOY" \ + "$FILE_OVERRIDE_ACME_QUADLETS" \ "$FILE_OVERRIDE_ACME_REGISTER" do [ -e "$file" ] && rm -v "$file" @@ -77,7 +74,7 @@ help_page() { echo " $0 update demo.openchami.cluster" } -case "$1" in +case "$1" in update) if [[ -z "$2" ]]; then help_page From d631dd90ddd1e521a272a5f89c8c79bb0a26b54a Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Mon, 20 Jul 2026 17:45:56 -0600 Subject: [PATCH 20/20] add enumerated list to further explain use of env vars in service+container sections Signed-off-by: Sean Tronsen --- systemd/containers/acme-deploy.container | 6 +++++- systemd/containers/acme-register.container | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/systemd/containers/acme-deploy.container b/systemd/containers/acme-deploy.container index e471976..6c9c243 100644 --- a/systemd/containers/acme-deploy.container +++ b/systemd/containers/acme-deploy.container @@ -29,7 +29,11 @@ Environment=DEPLOY_HAPROXY_PEM_PATH=/etc/haproxy/certs # The [Container] Environment= directive only generates Podman's `-e` options; # it does not define a systemd environment variable. As a result, values # referenced by systemd (which may themselves contain systemd specifiers such -# as %H) are not expanded as intended. +# as %H) are not expanded as intended, and the variable must be defined twice: +# +# 1. Under [Service] so systemd can expand it while parsing the unit. +# 2. Under [Container] so the container receives the final value as an +# environment variable. # # If you need to override this value, override the corresponding Environment= # entry in the [Service] section instead. diff --git a/systemd/containers/acme-register.container b/systemd/containers/acme-register.container index 3d68379..6eaed72 100644 --- a/systemd/containers/acme-register.container +++ b/systemd/containers/acme-register.container @@ -25,7 +25,11 @@ EnvironmentFile=/etc/openchami/configs/openchami.env # The [Container] Environment= directive only generates Podman's `-e` options; # it does not define a systemd environment variable. As a result, values # referenced by systemd (which may themselves contain systemd specifiers such -# as %H) are not expanded as intended. +# as %H) are not expanded as intended, and the variable must be defined twice: +# +# 1. Under [Service] so systemd can expand it while parsing the unit. +# 2. Under [Container] so the container receives the final value as an +# environment variable. # # If you need to override this value, override the corresponding Environment= # entry in the [Service] section instead.