Why does admin need to be disabled or is listening as unix socket?

[qrhfz]

title

[eriksjolund]

I haven't tried yet using a TCP socket for admin.
That would be interesting topic to explore.

[eriksjolund]

Maybe a Unix socket is needed for caddy to reload its configuration?

podman-caddy-socket-activation/README.md

Lines 74 to 89 in c56d5d3

	### Support for reloading the Caddy configuration
	Here is an outline of how to allow reloading the Caddy configuration.
	To support reloading the Caddy configuration, do the following steps
	1. Bind-mount an empty directory into the Caddy container to the path `/caddy_adminsocket` (The path was arbitrarily chosen).
	2. Add the global Caddyfile option [`admin`](https://caddyserver.com/docs/caddyfile/options#admin) to the Caddyfile.
	```
	admin unix//caddy_adminsocket/sock|0200
	```
	3. Add the systemd directive `ExecReload` under the `[Service]` section in the caddy container unit (quadlet).
	```
	ExecReload=podman exec caddy /usr/bin/caddy reload --config /etc/caddy/Caddyfile --force
	```
	(`caddy` is an arbitrarily chosen name. It should match the name of the container that can be set with `ContainerName=` under the `[Container]` section)

An interesting problem is that a container can't connect to socket-activated sockets, unless

AddHost=example.com:host-gateway

is added to the container quadlet.

For details, see example: connect to host's main network interface using pasta and --add-host=example.com:host-gateway

I would guess that using AddHost= is required if you want to use an admin socket that is listening on the host (with socket-activation).

Maybe it's possible to use multiple admin sockets? (I haven't tried) If one of the sockets is a Unix socket then maybe Caddy would be able to reload from that one.

[Clancy508]

For what it's worth, I recently set up a few systems using Example 4 as a template and it turns out that Caddy in this setup can reload gracefully using a unix socket even if it's not exposed using the systemd socket, you can just give it an arbitrary unix socket file inside the container and it'll still work (since the caddy reload command is run inside the container anyway). The line I'm using in my Caddyfile for this is admin unix//run/caddy-admin.sock.

[eriksjolund]

For what it's worth, I recently set up a few systems using Example 4 as a template and it turns out that Caddy in this setup can reload gracefully using a unix socket even if it's not exposed using the systemd socket, you can just give it an arbitrary unix socket file inside the container and it'll still work (since the caddy reload command is run inside the container anyway).

Good to know that reloading works.

The line I'm using in my Caddyfile for this is admin unix//run/caddy-admin.sock.

That is more or less how Example 4 is written right now:

podman-caddy-socket-activation/examples/example4/Caddyfile

Line 8 in c56d5d3

admin unix//caddy_adminsocket/sock|0200

An open question is whether the unix socket should be in a bind-mounted directory or not.

To make the unix socket available to users on the host (or in other containers) there is a bind-mounted directory

podman-caddy-socket-activation/examples/example4/caddy.container

Line 18 in c56d5d3

Volume=%h/caddy_adminsocket:/caddy_adminsocket:Z

Access to the unix the socket can be restricted by adjusting the file permissions of the directory.
If other containers need access to the unix socket then we would need to change the volume option from :Z to :z

[qrhfz]

my usecase is using config file. i use podman exec caddy caddy reload without exposing admin to host. it works.

[Clancy508]

EDIT: misunderstood some of your response on my first read, only thing I would add having re-read it is that it might not be a bad idea to explicitly document the option of using a unix socket that's only available in the container since the current documentation defaults to using a host file

Tangentially, just wanted to say thanks for all the work you've done to document various Podman/Systemd setups, it's been invaluable for getting my setup up and running!

[eriksjolund]

Tangentially, just wanted to say thanks for all the work you've done to document various Podman/Systemd setups, it's been invaluable for getting my setup up and running!

Great to hear that you found the documentation useful!

The admin is no longer disabled and the socket is no longer in any bind-mounted directory. Fixed in
#55

(Having the admin socket in a bind-mounted directory is more of a special need. It's probably not
needed for most users)