influxdata / influxdata/influxdb

influxd-systemd-start.sh does not work if https-enabled is true

Open
#22,012 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

__Steps to reproduce:__
List the minimal actions needed to reproduce the behavior.

1. set https-enabled = true
2. set appropriate certificate files

__Expected behavior:__
Systemd should successfully start influxdb.

__Actual behavior:__
Systemd is hanging in loop while waiting for 200.

__Environment info:__

* System info: Debian GNU/Linux 10 (buster)
* InfluxDB version: v1.8.7

__Config:__
[http]
enabled = true
bind-address = ":8086"
auth-enabled = false
log-enabled = true
suppress-write-log = false
write-tracing = false
flux-enabled = false
flux-log-enabled = false
pprof-enabled = true
pprof-auth-enabled = false
debug-pprof-enabled = false
ping-auth-enabled = false
prom-read-auth-enabled = false
https-enabled = true
https-certificate = "/etc/path/to/cert.crt"
https-private-key = "/etc/path/to/key.key"
max-row-limit = 0
max-connection-limit = 0
shared-secret = ""
realm = "InfluxDB"
unix-socket-enabled = false
unix-socket-permissions = "0777"
bind-socket = "/var/run/influxdb.sock"
max-body-size = 25000000
access-log-path = ""
max-concurrent-write-limit = 0
max-enqueued-write-limit = 0
enqueued-write-timeout = 30000000000

The new wrapper script `/usr/lib/influxdb/scripts/influxd-systemd-start.sh` does not take in to account configurations with `https-enabled`.

You could add something like:
```
if $(influxd config 2>/dev/null | grep https-enabled | cut -d ' ' -f5 | tr -d '"')
then PROT="https"
else PROT="http"
fi
```

and change the curl options to:
` curl -k -s -o /dev/null $PROT://$HOST:$PORT/health -w %{http_code}`
> -k, --insecure
> (TLS) By default, every SSL connection curl makes is verified to be secure. This option allows curl to proceed and operate even for server connections otherwise considered insecure.
> The server connection is verified by making sure the server's certificate contains the right name and verifies successfully using the cert store.
> See this online resource for further details:
> https://curl.haxx.se/docs/sslcerts.html

Contributor guide

Open the contributing guide

Research direction

Start with /usr/lib/influxdb/scripts/influxd-systemd-start.sh and the [http] configuration shown in the issue, then reproduce on Debian with https-enabled set to true and the certificate paths configured. Done means systemd starts InfluxDB successfully and the health check no longer hangs while waiting for HTTP 200.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, shell
Domain
databases, devops, infrastructure
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.