tree d58a34ea9420d63965234ab282672a8641e66e36
parent 6962a0f7b52f0711d503cf386a8fd7a7616ec355
author Jan Kundrát <jan.kundrat@cesnet.cz> 1528995365 +0200
committer Jan Kundrát <jan.kundrat@cesnet.cz> 1528995462 +0200

Start watchdog pinging only once everything is up

Previously, systemd started pinging the HW watchdog too early. It was
possible to arrive at a system which is more or less FUBAR, yet the WS
was happily being periodically reset by systemd's event loop.

This change ensures that the watchdog resetting only begins once the
rest of the system is stable -- in other words, once "everything else"
is OK.

One cannot simply add another systemd target for this which would
Require=multi-user.target. Failures can occur at any level of the stack,
and essentially all units specify WantedBy, not RequiredBy, so their
respective failures do not propagate.

I was also trying to simply check the result of `systemctl
is-system-running`. That doesn't work because "starting" takes
precedence over `degraded", and we're still "starting" when checking
from within a unit, obviously.

This hack therefore looks at the list of failed units. If it isn't
empty, then we have a problem, and we won't activate neither the
watchdog, nor the RAUC good-marking thingy.

The "running" timeout is now set to 30 seconds. This means that systemd
will ping the HW once every 15s, and that a failure to do so for half a
minute results in an immediate reboot. There's no shutdown timer because
we don't really care about what happens once we started to shutdown. Our
only desire is to reboot, eventually, and this one looks like it can do
it :).

Change-Id: Ib94992814705b4a6d4d712db9e443d6a784cec7f
Fixes: https://tree.taiga.io/project/jktjkt-czechlight/issue/130