Hi all,
I just configured a tomcat instance started/stopped by systemd. This instance is managed as a resource by pacemaker: when tomcat is moved to a machine, its systemd unit is started. There are several machines in the cluster, but only one at a time run tomcat.
The unit is something like this:
[Unit]
Description=...
After=syslog.target network.target
[Service]
Type=forking
User=...
Group=...
WorkingDirectory=...
NoNewPrivileges=true
AmbientCapabilities=CAP_NET_BIND_SERVICE
Environment="JAVA_OPTS=-Djava.security.egd=file:///dev/urandom"
ExecStart=/bin/sh -c .../apache-tomcat-9.0.109/bin/startup.sh
ExecStop=/bin/sh -c .../apache-tomcat-9.0.109/bin/shutdown.sh
Environment="CATALINA_PID=.../apache-tomcat-9.0.109/logs/tomcat.pid"
ExecStartPre=+/usr/bin/firewall-cmd --zone=public --add-service=tomcat
ExecStopPost=+/usr/bin/firewall-cmd --zone=public --remove-service=tomcat
SocketBindDeny=any
SocketBindAllow=ipv4:tcp:443
OOMScoreAdjust=-1000
ProtectSystem=true
ReadWritePaths=...
[Install]
WantedBy=multi-user.target
as you see, I am enabling rules via ExecStartPre. Of course this is something not permanent, so if anyone issue "firewalld-cmd --reload" command will disable this rule.
What is the best method to keep this rule working while tomcat is on this node?
Thank you,
Giuseppe