From d371a664479c7f0cb7f085a3a647339dc2cea0f7 Mon Sep 17 00:00:00 2001 From: Kyle Carberry Date: Thu, 24 Mar 2022 14:02:09 -0600 Subject: [PATCH] ci: Fix dogfood installation by forcing default configurations (#557) * ci: Fix dogfood installation by forcing default configurations The dpkg prompt to override config files was appearing, but this will auto-approve it. * Add CAP_NET_BIND_SERVICE to allow listening on :443 --- .github/workflows/coder.yaml | 2 +- coder.service | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/coder.yaml b/.github/workflows/coder.yaml index b0accfb276..734c5ce896 100644 --- a/.github/workflows/coder.yaml +++ b/.github/workflows/coder.yaml @@ -336,7 +336,7 @@ jobs: gcloud config set project coder-dogfood gcloud config set compute/zone us-central1-a gcloud compute scp ./dist/coder_*_linux_amd64.deb coder:/tmp/coder.deb - gcloud compute ssh coder -- sudo dpkg -i /tmp/coder.deb + gcloud compute ssh coder -- sudo dpkg -i --force-confdef /tmp/coder.deb gcloud compute ssh coder -- sudo systemctl daemon-reload - name: Start diff --git a/coder.service b/coder.service index f777842385..1f6b212cd5 100644 --- a/coder.service +++ b/coder.service @@ -17,7 +17,7 @@ ProtectHome=read-only PrivateTmp=yes PrivateDevices=yes SecureBits=keep-caps -AmbientCapabilities=CAP_IPC_LOCK +AmbientCapabilities=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK NoNewPrivileges=yes ExecStart=/usr/bin/coder start