nftables working

apps/fz_http/lib/fz_http/release.ex

@@ -28,6 +28,8 @@ defmodule FzHttp.Release do
 
   # App should be loaded at this point; call with `rpc` not `eval`
   def create_admin_user do
+    load_app()
+
     if Repo.exists?(from u in User, where: u.email == ^email()) do
       change_password(email(), default_password())
     else

config/releases.exs

@@ -66,7 +66,7 @@ config :fz_http, FzHttp.Vault,
 config :fz_http, FzHttpWeb.Endpoint,
   http: [ip: {0, 0, 0, 0}, port: port],
   server: true,
-  url: [host: url_host, scheme: "https"],
+  url: [host: url_host, scheme: "http"],
   secret_key_base: secret_key_base,
   live_view: [
     signing_salt: live_view_signing_salt
@@ -82,4 +82,5 @@ config :fz_vpn,
   wireguard_private_key: private_key
 
 config :fz_http,
-  admin_email: admin_email
+  admin_email: admin_email,
+  default_admin_password: default_admin_password

omnibus/cookbooks/firezone/recipes/phoenix.rb

@@ -1,4 +1,5 @@
-#
+# frozen_string_literal: true
+
 # Cookbook:: firezone
 # Recipe:: phoenix
 #
@@ -50,6 +51,7 @@ end
 if node['firezone']['phoenix']['enable']
   component_runit_service 'phoenix' do
     package 'firezone'
+    control ['t']
     action :enable
     subscribes :restart, 'file[environment-variables]'
   end

omnibus/cookbooks/firezone/templates/phoenix.nginx.conf.erb

@@ -100,6 +100,14 @@ server {
   }
 <% end -%>
 
+  location ~ ^/live {
+    proxy_pass http://phoenix;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+  }
+
   location / {
     proxy_set_header HOST $host;
     proxy_set_header X-Real-IP $remote_addr;

omnibus/cookbooks/firezone/templates/sv-phoenix-run.erb

@@ -12,7 +12,7 @@ export HOME=$DIR
 cd $DIR
 
 exec <%= node['runit']['chpst_bin'] %> \
-  -P \
-  -U <%= node['firezone']['user'] %> \
-  -u <%= node['firezone']['user'] %> \
-  bin/firezone start
+      -P \
+      -U <%= node['firezone']['user'] %>:<%= node['firezone']['group'] %> \
+      -u <%= node['firezone']['user'] %>:<%= node['firezone']['group'] %> \
+      bin/firezone start

omnibus/cookbooks/firezone/templates/sv-phoenix-t.erb

@@ -0,0 +1,4 @@
+#!/bin/sh
+echo "received TERM from runit, sending to process group (-PID)"
+pid=$(<%= node['firezone']['app_directory'] %>/bin/firezone pid)
+kill -- -$pid

omnibus/cookbooks/firezone/templates/sv-postgresql-run.erb

@@ -1,6 +1,6 @@
 #!/bin/sh
 exec 2>&1
-exec chpst \
+exec <%= node['runit']['chpst_bin'] %> \
        -P \
        -U <%= node['firezone']['postgresql']['username'] %> \
        -u <%= node['firezone']['postgresql']['username'] %> \