2

I am trying to disable a haproxy frontend from a systemd service in Debian 9 (haproxy 1.7.5-2). The default config sets up admin access via a unix socket at /run/haproxy/admin.sock so I use socat (1.7.3.1):

/bin/sh -c 'echo disable frontend http | /usr/bin/socat stdio unix-connect:/run/haproxy/admin.sock'

This works perfectly when I run it manually as root. It also works if I omit spawning a new sh instance too:

echo disable frontend http | /usr/bin/socat stdio unix-connect:/run/haproxy/admin.sock

When I attempt to run the same command as a systemd service, I consistently get a Connection refused error and I can't figure out why. Here is a simplified service file that reproduces the error:

[Unit]
Description=Test unit
After=network-online.target

[Service]
Type=oneshot
RemainAfterExit=false
ExecStartPre=/usr/bin/test -x /usr/bin/socat
ExecStart=/bin/sh -c 'echo disable frontend http | /usr/bin/socat stdio unix-connect:/run/haproxy/admin.sock'

The relevant error from systemctl status test.service:

sh[1305]: 2020/05/09 12:26:23 socat[1308] E connect(5, AF=1 "/run/haproxy/admin.sock", 25): Connection refused

I verified the path exists and I can run the command exactly as written in the ExecStart stanza manually as root immediately following the systemd failure. I thought I messed up the syntax for systemd, but that doesn't appear to be the problem. The same error occurs if I use bash or zsh instead of /bin/sh too. This has been driving me crazy for a couple of days. What am I missing?

some-guy
  • 31
  • 3
  • Perhaps the unit is starting just too soon after the network is online so the socket exists but no one is listening? Try adding an `ExecStartPre=/usr/bin/sleep 10` just to see. – meuh May 11 '20 at 13:13
  • @meuh the sleep addition did eliminate the problem so thank you. The unit is run on a timer despite my reference to `network-online.target`. I can run `systemctl start test.service` as many times as I desire guaranteeing a failure each time. It still isn't clear to me how systemd's interaction affects the timing here although it is clearly a factor. – some-guy May 12 '20 at 03:42

1 Answers1

1

Based on meuh's comment, I added a retry option to socat:

ExecStart=/bin/sh -c 'echo disable frontend http | /usr/bin/socat stdio unix-connect:/run/haproxy/admin.sock,retry=2'

Still not what's different about launching through systemd, but it's working for now.

some-guy
  • 31
  • 3