mirror of
https://github.com/DeBrosOfficial/orama.git
synced 2026-08-06 19:29:29 +00:00
f4790c9ac3
The upgrade runs Phase6bSetupFirewall ('ufw --force reset' + base rules) as
root, wiping the TURN relay ports on every upgrade. orama-node runs as a
non-root user and CANNOT modify ufw, so the restore-path EnsureTURNFirewall I
first added was a no-op (a doomed 'ufw' call). Move the reconcile to where it
actually works: Phase 6b now detects a TURN node and re-opens 3478/5349 + the
relay UDP range (49152-65535) as part of the same root-level firewall setup, so
an upgrade can never leave the relay firewalled.
TURN detection keys on the persisted <ns>/turn.env file, NOT systemctl: the
upgrade stops the TURN unit before Phase 6b runs, and a stopped systemd template
instance can be GC'd out of 'systemctl list-units' — a false negative on the
exact upgrade path this targets. The env file survives stop + reset (same signal
serviceExists() uses to gate (re)start).
- Phase6bSetupFirewall: ps.hostRunsTURN() -> TURNEnabled + relay range
- remove the non-root EnsureTURNFirewall (restore path + method)
- tests: hostRunsTURN env-file detection + non-TURN node opens no relay ports