ansible/roles/openqa/worker/files/openqa-swtpm@.service

[Unit]
Description=openQA swtpm service

[Service]
User=_openqa-worker
ExecStartPre=-/usr/bin/rm -rf /tmp/mytpm%I
ExecStartPre=/usr/bin/mkdir -p /tmp/mytpm%I
ExecStart=/usr/bin/swtpm socket --tpm2 --tpmstate dir=/tmp/mytpm%I --ctrl type=unixio,path=/tmp/mytpm%I/swtpm-sock --log level=20
ExecReload=/bin/true
Restart=on-success

[Install]
WantedBy=multi-user.target
openqa/worker: set up swtpm service on tap worker hosts swtpm is a TPM emulator we want to use for testing Clevis on IoT (and potentially other things in future). We're implementing this by having os-autoinst just add the qemu args but expect swtpm itself to be running already - that's counted as the sysadmin's responsibility. My approach to this is to have openQA tap worker hosts also be tpm worker hosts, meaning they run one instance of swtpm per worker instance (as a systemd service) and are added to a 'tpm' worker class which tests can use to ensure they run on a suitably-equipped worker. This sets up all of that. We need a custom SELinux policy module to allow systemd to run swtpm - this is blocked by default. Signed-off-by: Adam Williamson <awilliam@redhat.com> 2020-06-24 16:47:51 -07:00			`[Unit]`
			`Description=openQA swtpm service`

			`[Service]`
			`User=_openqa-worker`
			`ExecStartPre=-/usr/bin/rm -rf /tmp/mytpm%I`
			`ExecStartPre=/usr/bin/mkdir -p /tmp/mytpm%I`
			`ExecStart=/usr/bin/swtpm socket --tpm2 --tpmstate dir=/tmp/mytpm%I --ctrl type=unixio,path=/tmp/mytpm%I/swtpm-sock --log level=20`
			`ExecReload=/bin/true`
openqa/worker: have swtpm service restart on success This is because swtpm is designed not to be persistent, it's sort of tied to a single "system" (VM in this case). We can't expect an instance will stick around after it's been "used", it doesn't do that, it exits successfully. So we need to restart it when that happens. Signed-off-by: Adam Williamson <awilliam@redhat.com> 2020-09-08 10:56:12 -07:00			`Restart=on-success`
openqa/worker: set up swtpm service on tap worker hosts swtpm is a TPM emulator we want to use for testing Clevis on IoT (and potentially other things in future). We're implementing this by having os-autoinst just add the qemu args but expect swtpm itself to be running already - that's counted as the sysadmin's responsibility. My approach to this is to have openQA tap worker hosts also be tpm worker hosts, meaning they run one instance of swtpm per worker instance (as a systemd service) and are added to a 'tpm' worker class which tests can use to ensure they run on a suitably-equipped worker. This sets up all of that. We need a custom SELinux policy module to allow systemd to run swtpm - this is blocked by default. Signed-off-by: Adam Williamson <awilliam@redhat.com> 2020-06-24 16:47:51 -07:00
			`[Install]`
			`WantedBy=multi-user.target`