Repository navigation
fix: stop GRD restarts wedging RDP handover - #122
Merged
Merged
Conversation
unattended-upgrades bumped a library GRD links, needrestart restarted the system daemon, and the live Remote Login session was orphaned until reboot. Every converge restarted GRD too. GRD is now excluded from needrestart and only restarted at the end of a converge when no handover daemon is running. Nice=-10 goes on both GRD units on every host. The role counted virtio as hardware encode and removed it on virgl VMs, so GRD ran at nice 0 behind builds and key-ups landed late. Key repeat delay is 800 ms. Hardware encode is now probed the way GRD uses it (VA-API H.264 plus a hardware Vulkan device, or NVENC) and reported, and vaapi-check is retired. TLS gets two opt-ins: a hardened self-signed cert (FQDN, P-384, 10 years) and a supplied cert and key. Every mode checks the pair as GRD's user before grdctl points at it, and the fingerprints land in /etc/gnome-rdp/rdp-tls-fingerprint. An opt-in polkit rule gives remote wayland/x11 sessions the console defaults, never SSH. A converge that aborts no longer leaves the apt-daily timers and unattended-upgrades off until reboot. A 4h transient timer restarts them, and system_cleanup cancels it on a normal finish. Refs #121
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RDP handover on a desktop VM kept wedging until a reboot, and keys repeated under build load. Two causes, both in the rdp-server role.
Also in here:
Checked on the target VM after a reboot: both GRD daemons at NI -10, vaapi-check gone, needrestart line present, key delay 800, and port 3389 serving the hardened cert with a fingerprint matching the file. Under a 32-job release build (rustc at nice 19 in a CPUWeight 30 slice) GRD waited ~0 ms/s while hypervisor steal was low. Spikes to ~390 ms/s only came with 18-27% Proxmox steal, which is host-side and under the repeat delay.
NOT checked: an RDP disconnect and reconnect, typing under load by a person, the polkit rule loaded in polkit, the new pre_task actually running, and molecule. Those stay on #121, along with hyperi-infra's desktop_user rdp_tls.yml still pointing GRD at its own cert and restarting it.
Refs #121