Algorand Install Should Follow FHS 3.0 and Secure Deployment Best Practices

[jecassis]

Algorand Install Should Follow FHS 3.0 and Secure Deployment Best Practices

[zeldovich]

Thanks, this all seems like reasonable stuff we should do!

[jecassis]

In case it is helpful, here is a script with several of the changes outlined above that we're doing on top of the default install.

[zeldovich]

Do you have any reference for systemd unit files being conffiles? (You say that we should be making algorand.service a conffile in the debian package.) A cursory check suggests that other Debian packages on my Ubuntu machine don't follow this plan, and I couldn't find anything in the Debian documentation saying that systemd unit files should be conffiles.

[algobolson]

making the systemd unit file a conffile makes sense to me because if someone wanted to move the data directory (e.g. to fast SSD storage) they'd have to edit the systemd unit file.

[zeldovich]

A common way of doing that would be to make /var/lib/algorand a symlink to the disk where the operator wants to store the data, or mount the fast SSD storage with /var/lib/algorand as a mountpoint.

[jecassis]

In my configurations /var/lib/algorand is the mountpoint. I benchmarked those 2 options using Phoronix Test Suite and symlink came back over 100% slower in run time.

That said, to avoid marking the systemd file as a conffile, you can do what I did in the script which is use an environment file to set ALGOD_OPTS. Of course, then, you'd also want that file as a conffile. Kind of a Catch-22.

[algobolson]

Something I learned about systemd in the last couple weeks is that one doesn't need to edit algorand.service because it's possible to create algorand.service.d/override.conf ("override" can be anything, or multiple things, and they're evaluated in order as successive overlays to the base algorand.service). So, I don't think we need to add the algorand.service file as a 'conf' file in either package manager.

[algobolson]

@jecassis see pull #169 for what should be most of these improvements

[jecassis]

Finally got around to making and installing a specific build with this patch and tested it on our dev server. Looks good to me.