Companion install script should create a real system user

[Ghostbird]

I'm about to install companion on a Debian server, and I'm kind of surprised by this line in the install script:

# add a system user
adduser --disabled-password companion --gecos "

The --gecos option is old, deprecated, and no longer documented. The man page only has a small mention in the documentation of the --comment flag. It says --comment used to be --gecos which will be removed after Debian Bookworm (the current version). Most importantly it certainly does not – and as far as I know never did – create a system user. The option used should be --system, which does create a system user.

Note: I created this as a discussion, because it is not an issue per se. There's probably still at least a year before --gecos stops working on fresh Debian installs, and apparently companion works fine with a normal user account, even though it seems kind of dirty from a system administration perspective.

[Ghostbird]

There's some weird stuff going on in that install script.

• Tries to add the system user to sudoers. Excuse me? The exact reason why I want a highly specific system user is so that it cannot do anything except perform its function!
• Tries to install settings in /home/companion/.config, which doesn't exist for system users, instead of a sensible location like /etc/companion.
• It clobbers the systems's MOTD!. That's like asking an electrician to install a new fuse, and when he's done, he also painted your front-door hot pink! It probably won't break anything, but is incredibly weird and rude!

This is why I wanted to build companion myself, but it seems to be actively made impossible. Linked documentation doesn't exist, or is behind a login-wall. What instructions can be found don't work at all as described.

I think we'll have to go without companion on our server.

[Ghostbird]

Note: In reply to the earlies comment:

Thanks. I found those instructions, but they don't include how to build. I found the yarn build lindist option elsewhere, but that one erred on the missing module-legacy/manifests. I tried this a few days ago a few times, but coincidentally I was building CasparCG server, and I had to find a workaround for a missing Doxygen config in CEF. That gave me the idea to try a similar approach here, and just stub an empty file, which makes the build work.

[Ghostbird]

It needs a touch module-legacy/manifests to build without errors

That sounds like it missed a step, and will be missing all large chunk of the modules. I suspect the webui too.

I think the yarn update or ./tools/yarn.sh needs to be run to build those modules and the webui

Ah thanks a lot. It seems that I either completely overlooked that step, or it somehow isn't in the documentation.

[Ghostbird]

I think the crucial error I made was that I didn't realise that companion uses git submodules, and I was missing those. Thanks a lot for the help, and my apologies for my grumpiness.

[Julusian]

tbh, the most relevant and updated steps of 'documentation' might be the dockerfile

companion/Dockerfile

Lines 14 to 21 in 71f0258

	# Install dependencies
	RUN CI=1 ./tools/yarn.sh
	# Generate version number file
	RUN yarn build:writefile
	# build the application
	RUN ELECTRON=0 yarn dist

I probably just forgot to write new docs when redoing the build flow a couple of years back, and noone has asked enough questions about it since then 🤷

[Ghostbird]

Thanks. Good to know.

[Ghostbird]

I've got companion running on our server:

• Uses real system user
• Config in /etc/companion
• No sudo rights to shutdown the server

I haven't added the udev rule yet, since I'll be connecting satellites, and the server itself won't have a stream deck attached. The main reason why I wanted companion on the server was that I want to:

• Be able to remotely manage the configuration at any time (I'm using SSH dynamic forward SOCKS proxy)
• Control networked systems using the tablet web UI without having to boot the front-of-house PC.

@Julusian Thanks a lot for the help!

Systemd Service file:

[Unit]
Description=Bitfocus Companion
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=companion
Environment=COMPANION_IN_SYSTEMD=1
ExecStart=/opt/companion/companion_headless.sh --config-dir /etc/companion/ --admin-port 8001
Restart=on-failure
KillSignal=SIGINT
TimeoutStopSec=60

[Install]
WantedBy=multi-user.target

Note: This requires that you one-time run:

sudo mkdir -p /etc/companion
sudo chown companion /etc/companion

Installation is done in the companion folder using a script that runs:

#!/bin/bash
set -e

INSTALL_PREFIX="${INSTALL_PREFIX:-/opt}"
git pull

nvm install 18
nvm use 18

corepack enable

# Note: </dev/null closes stdin to prevent corepack prompts
yarn install </dev/null
yarn update </dev/null
yarn lindist </dev/null

# Install
sudo mkdir -p "${INSTALL_PREFIX}/companion"
sudo cp -r electron-output/linux-unpacked/* "${INSTALL_PREFIX}/companion/"

sudo service companion restart
echo "Bitfocus companion installed!"