feat: Use Unix sockets for internal services (#1354)

Dockerfile

@@ -7,6 +7,7 @@ ARG TARGETARCH
 ARG TARGETPLATFORM
 
 ARG VERSION_ARG="0.0"
+ARG VERSION_WSD="0.4.2"
 ARG VERSION_CSTRUCT="4.7"
 ARG VERSION_PASST="2026_07_28"
 
@@ -39,7 +40,6 @@ RUN <<EOF
     e2fsprogs \
     diffutils \
     qemu-utils \
-    websocketd \
     iputils-ping \
     inotify-tools \
     ca-certificates \
@@ -54,6 +54,10 @@ RUN <<EOF
   wget "https://github.com/qemus/passt/releases/download/v${VERSION_PASST}/passt_${VERSION_PASST}_${TARGETARCH}.deb" -O /tmp/passt.deb -q --timeout=10
   dpkg -i /tmp/passt.deb
 
+  # Install Websocketd package
+  wget "https://github.com/qemus/websocketd/releases/download/v${VERSION_WSD}/websocketd-${VERSION_WSD}_${TARGETARCH}.deb" -O /tmp/wsd.deb -q --timeout=10
+  dpkg -i /tmp/wsd.deb
+
   apt-get clean
 
   # Install Python dependencies

src/network.sh

@@ -566,10 +566,6 @@ getReservedPorts() {
     list+="53/tcp,53/udp,"
   fi
 
-  # WEB_PORT and WSD_PORT are intentionally not reserved. In non-DHCP modes,
-  # closeWeb() releases both before NAT or user-mode forwarding is configured,
-  # allowing WEB_PORT (normally 5000) to be handed over to DSM.
-
   normalizePorts "$list" "$mode"
   return $?
 }

src/server.sh

@@ -2,20 +2,19 @@
 set -Eeuo pipefail
 
 : "${WEB_PORT:="5000"}"    # Webserver port
-: "${WSD_PORT:="8004"}"    # Websockets port
 
 # Sanitize port variables
 WEB_PORT=$(strip "$WEB_PORT")
-WSD_PORT=$(strip "$WSD_PORT")
 
 WEB_PID="/run/nginx.pid"
 WSD_LOG="/var/log/websocketd.log"
 WSD_PID="$QEMU_DIR/websocketd.pid"
+WSD_SOCKET="$QEMU_DIR/status-ws.sock"
 
 prepareWebFiles() {
 
   cp -r /var/www/* "$QEMU_DIR" || return 1
-  rm -f -- "$WSD_PID" "$WEB_PID" "$WSD_LOG" || return 1
+  rm -f -- "$WSD_PID" "$WSD_SOCKET" "$WEB_PID" "$WSD_LOG" || return 1
 
   return 0
 }
@@ -24,9 +23,8 @@ configureWebPorts() {
 
   if ! sed -i \
     -e "s|listen 5000 default_server;|listen $WEB_PORT default_server;|g" \
-    -e "s|proxy_pass http://127.0.0.1:8004/;|proxy_pass http://127.0.0.1:$WSD_PORT/;|g" \
     /etc/nginx/sites-enabled/web.conf; then
-    error "Failed to configure webserver ports!"
+    error "Failed to configure webserver port!"
     return 1
   fi
 
@@ -56,7 +54,10 @@ configureNginx() {
   mkdir -p /etc/nginx/sites-enabled || return 1
   rm -f /etc/nginx/sites-enabled/default || return 1
 
+  # TODO: Use setfacl to grant www-data access to the Unix sockets
+  # and restore unprivileged nginx workers.
   if ! sed -i \
+    -e 's/^user .*/user root;/' \
     -e 's/^worker_processes.*/worker_processes 1;/' \
     /etc/nginx/nginx.conf; then
     error "Failed to configure nginx!"
@@ -115,7 +116,7 @@ stopWebsocketServer() {
     fi
   fi
 
-  rm -f -- "$WSD_PID"
+  rm -f -- "$WSD_PID" "$WSD_SOCKET"
   return 0
 }
 
@@ -123,8 +124,7 @@ startWebsocketServer() {
 
   # Start websocket server
   websocketd \
-    --address 127.0.0.1 \
-    --port="$WSD_PORT" \
+    --unixsocket="$WSD_SOCKET" \
     /run/socket.sh \
     >"$WSD_LOG" 2>&1 &
 

web/conf/nginx.conf

@@ -39,6 +39,6 @@ server {
       proxy_read_timeout 3600s;
       proxy_send_timeout 3600s;
 
-      proxy_pass http://127.0.0.1:8004/;
-    }    
+      proxy_pass http://unix:/run/shm/status-ws.sock:/;
+    }
 }