YunoHost-Apps/bookwyrm_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/bookwyrm_ynh.git synced 2024-09-03 18:16:12 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

fixes systemd

Browse source
This commit is contained in:
Thomas 2023-11-09 18:33:38 +01:00 • committed by GitHub
parent 62b1a6a3c5
commit d946ee4079
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 13 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
conf/bookwyrm-beat.service
View file

@ -16,10 +16,10 @@ ProtectHome=tmpfs
InaccessiblePaths=-/media -/mnt -/srv
PrivateTmp=yes
TemporaryFileSystem=/var /run
PrivateUsers=true
#PrivateUsers=true
PrivateDevices=true
BindReadOnlyPaths=__INSTALL_DIR__
BindPaths=__INSTALL_DIR__/images __INSTALL_DIR__/static /var/run/postgresql
#BindPaths=__INSTALL_DIR__/images __INSTALL_DIR__/static /var/run/postgresql
LockPersonality=yes
MemoryDenyWriteExecute=true
PrivateMounts=true

4
conf/bookwyrm-server.service
View file

@ -32,6 +32,10 @@ ProtectControlGroups=true
RestrictRealtime=true
RestrictNamespaces=net
NoNewPrivileges=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
DevicePolicy=closed
ProtectProc=invisible
SystemCallArchitectures=native
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged

8
conf/bookwyrm-worker.service
View file

@ -19,7 +19,7 @@ TemporaryFileSystem=/var /run
#PrivateUsers=true
PrivateDevices=true
BindReadOnlyPaths=__INSTALL_DIR__
BindPaths=__INSTALL_DIR__/images __INSTALL_DIR__/static /var/run/postgresql
#BindPaths=__INSTALL_DIR__/images __INSTALL_DIR__/static /var/run/postgresql
LockPersonality=yes
MemoryDenyWriteExecute=true
PrivateMounts=true
@ -32,6 +32,12 @@ ProtectControlGroups=true
RestrictRealtime=true
RestrictNamespaces=net
NoNewPrivileges=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
DevicePolicy=closed
ProtectProc=invisible
SystemCallArchitectures=native
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged
# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html