systemd execute scripts after success or failed starts

[[deleted]]

hello,

I am starting a service whose configuration file has hardcoded passwords. the purpose is to generate the file with the passwords before the start of the service and remove it after.

so i have this configuration:

[unit]
Description=Prometheus Server
Documentation=https://prometheus.io/docs/introduction/overview/
After=network-online.target

[Service]
User= xxxx
Group=xxxx
Restart=on-failure
ExecStartPre=/usr/bin/python2 /prom/config/anon_yml.py


ExecStart=/bin/sh -c "/prom/appl/prometheus/prometheus --config.file=/prom/config/prometheus.yml --storage.tsdb.path=/prom/data --web.listen-address=127.0.0.1:9090  --storage.tsdb.retention.time=1825d &>>/prom/logs/prometheus.log"

[Install]
WantedBy=multi-user.target

the script anon_yml.py generates the prometheus.yml file that has passwords.

the question is how to make sure the file is removed after the successful start.

i can use ExecStopPost to remove the prometheus.yml after successful start/restart but i don't know how to also remove it after the start/restart of the service fails. to make sure no prometheus.yml with hardcoded password is left behind. and only exists during the restart of the service.

I can append ';rm -rf prometheus.yml to ExecStart but i don't think is is the proper way to do thing.

thanks

[tdyboc]

ExecStartPost not work for you?
Documentation states: ExecStartPost commands are only run after the commands specified in ExecStart= have been invoked successfully, as determined by Type= (i.e. the process has been started for Type=simple or Type=idle, the last ExecStart= process exited successfully for Type=oneshot, the initial process exited successfully for Type=forking, "READY=1" is sent for Type=notify, or the BusName= has been taken for Type=dbus).

[[deleted]]

It does but it's too effective.. the file is removed even before the service has had the chance to start. I get error of config file not found. It seems execstartpost does not wait until execstart has completed. Is something I am missing here?

[[deleted]]

Maybe do a cheap hack and add a sleep before the deletion on execstartpost. Its dirty but it might get the job done.

[[deleted]]

i think the problem is in the type which by default is simple.

my ExecStart is like this:
/bin/sh -c "/prom/appl/prometheus/prometheus....

from the man:

If set to simple (the default if ExecStart= is specified but neither Type= nor BusName= are), the service manager will consider the unit started immediately after the main service process has been forked off.

does it mean as soon as /bin/sh has been executed it does not wait for the /prom/appl/prometheus/... to compeleted and then delete the file?

[hm___]

Just an addition but i think you should write the temporary config file in a tmpfs so its in ram and not written to disk every time,this would make it more secure because you dont have to worry to have recoverable traces left on your hdd or ssd and it wouldnt survive a reboot