mirror of
https://github.com/YunoHost-Apps/diacamma_ynh.git
synced 2024-09-03 18:26:10 +02:00
correct
This commit is contained in:
Laurent Gay
parent
39fb0f35dd
commit
fbb8c534c1
8 changed files with 21 additions and 91 deletions
|
|
@ -1,11 +1,11 @@
|
|||
#sub_path_only rewrite ^__PATH__$ __PATH__/ permanent;
|
||||
|
||||
location __PATH__/web/ {
|
||||
alias __INSTALL_DIR__/__APP__/static/lucterios.framework/web/;
|
||||
alias __INSTALL_DIR__/inst-__APP__/static/lucterios.framework/web/;
|
||||
}
|
||||
|
||||
location __PATH__/static/ {
|
||||
alias __INSTALL_DIR__/__APP__/static/;
|
||||
alias __INSTALL_DIR__/inst-__APP__/static/;
|
||||
}
|
||||
|
||||
location __PATH__/ {
|
||||
|
|
|
|||
|
|
@ -9,45 +9,11 @@ Group=__APP__
|
|||
|
||||
Environment="DJANGO_SETTINGS_MODULE=inst-__APP__.settings"
|
||||
WorkingDirectory=__INSTALL_DIR__/
|
||||
ExecStart=__INSTALL_DIR__/virt/bin/gunicorn lucterios.framework.wsgi --bind 0.0.0.0:__PORT__ -w 1 --timeout 600 --access-logfile __INSTALL_DIR__/access.log --error-logfile __INSTALL_DIR__/error.log
|
||||
ExecStart=__INSTALL_DIR__/venv/bin/gunicorn lucterios.framework.wsgi --bind 0.0.0.0:__PORT__ -w 1 --timeout 600 --access-logfile __INSTALL_DIR__/access.log --error-logfile __INSTALL_DIR__/error.log
|
||||
StandardOutput=append:/var/log/__APP__/__APP__.log
|
||||
StandardError=inherit
|
||||
Restart=on-failure
|
||||
RestartSec=10
|
||||
|
||||
# Sandboxing options to harden security
|
||||
# Depending on specificities of your service/app, you may need to tweak these
|
||||
# .. but this should be a good baseline
|
||||
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
|
||||
NoNewPrivileges=yes
|
||||
PrivateTmp=yes
|
||||
PrivateDevices=yes
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
||||
RestrictNamespaces=yes
|
||||
RestrictRealtime=yes
|
||||
DevicePolicy=closed
|
||||
ProtectClock=yes
|
||||
ProtectHostname=yes
|
||||
ProtectProc=invisible
|
||||
ProtectSystem=full
|
||||
ProtectControlGroups=yes
|
||||
ProtectKernelModules=yes
|
||||
ProtectKernelTunables=yes
|
||||
LockPersonality=yes
|
||||
SystemCallArchitectures=native
|
||||
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged
|
||||
|
||||
# Denying access to capabilities that should not be relevant for webapps
|
||||
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
|
||||
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
|
||||
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
|
||||
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
|
||||
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
|
||||
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
|
||||
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
|
||||
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
|
||||
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
|
||||
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
@ -60,6 +60,12 @@ ram.runtime = "50M"
|
|||
type = "select"
|
||||
choices = ["fr","en"]
|
||||
|
||||
[install.archive]
|
||||
ask.en = "Archive to upload"
|
||||
ask.fr = "Archive à télécharger"
|
||||
type = "string"
|
||||
optional = true
|
||||
|
||||
[resources]
|
||||
# See the packaging documentation for the full set
|
||||
# of explanation regarding the behavior and properties for each of those
|
||||
|
|
|
|||
|
|
@ -26,14 +26,16 @@ function refresh_collect()
|
|||
{
|
||||
pushd $install_dir
|
||||
venv/bin/python3 manage_inst-${app}.py collectstatic --noinput -l
|
||||
rm -rf ${app}/static/static
|
||||
rm -rf ${app}/static/plugins
|
||||
rm -rf ${app}/static/tmp
|
||||
rm -rf ${app}/static/archives
|
||||
rm -rf ${app}/static/usr
|
||||
rm -rf ${app}/static/__pycache__
|
||||
rm -rf ${app}/static/settings.py
|
||||
rm -rf ${app}/static/django_error.log
|
||||
rm -rf ${app}/static/__init__.py
|
||||
rm -rf inst-${app}/static/static
|
||||
rm -rf inst-${app}/static/plugins
|
||||
rm -rf inst-${app}/static/tmp
|
||||
rm -rf inst-${app}/static/archives
|
||||
rm -rf inst-${app}/static/usr
|
||||
rm -rf inst-${app}/static/__pycache__
|
||||
rm -rf inst-${app}/static/settings.py
|
||||
rm -rf inst-${app}/static/django_error.log
|
||||
rm -rf inst-${app}/static/__init__.py
|
||||
chown -R ${app}:www-data .
|
||||
chmod 750 .
|
||||
popd
|
||||
}
|
||||
|
|
|
|||
|
|
@ -12,9 +12,6 @@ ynh_backup --src_path="$install_dir"
|
|||
|
||||
ynh_backup --src_path="/etc/nginx/conf.d/$domain.d/$app.conf"
|
||||
|
||||
ynh_backup --src_path="/etc/fail2ban/jail.d/$app.conf"
|
||||
ynh_backup --src_path="/etc/fail2ban/filter.d/$app.conf"
|
||||
|
||||
ynh_backup --src_path="/etc/logrotate.d/$app"
|
||||
|
||||
ynh_backup --src_path="/etc/systemd/system/$app.service"
|
||||
|
|
|
|||
|
|
@ -14,14 +14,11 @@ venv/bin/pip3 install -U lucterios lucterios-standard lucterios-contacts lucteri
|
|||
venv/bin/pip3 install -U diacamma-asso diacamma-syndic diacamma-financial
|
||||
venv/bin/pip3 install -U gunicorn psycopg2-binary psycopg2
|
||||
venv/bin/lucterios_admin.py installed
|
||||
venv/bin/lucterios_admin.py add -n inst-${app} -p "${APPLITYPE}" -m "${MODULES}" -d "${DATABASE}" -e '{"LANGUAGES":"'${language}'","USE_X_FORWARDED_HOST":true, "FORCE_SCRIPT_NAME":"/'${app}'"}'
|
||||
venv/bin/lucterios_admin.py add -n inst-${app} -p "${APPLITYPE}" -m "${MODULES}" -d "${DATABASE}" -e '{"LANGUAGE_CODE":"'${language}'","USE_X_FORWARDED_HOST":true, "FORCE_SCRIPT_NAME":"/'${app}'"}'
|
||||
popd
|
||||
|
||||
refresh_collect
|
||||
|
||||
chmod 400 "$install_dir/"
|
||||
chown ${app}:${app} "$install_dir/"
|
||||
|
||||
#=================================================
|
||||
# SYSTEM CONFIGURATION
|
||||
#=================================================
|
||||
|
|
|
|||
|
|
@ -18,9 +18,6 @@ popd
|
|||
|
||||
refresh_collect
|
||||
|
||||
chmod 400 "$install_dir/"
|
||||
chown ${app}:${app} "$install_dir/"
|
||||
|
||||
#=================================================
|
||||
# RESTORE THE MYSQL DATABASE
|
||||
#=================================================
|
||||
|
|
@ -45,10 +42,6 @@ yunohost service add $app --log="/var/log/$app/$app.log"
|
|||
|
||||
ynh_restore_file --origin_path="/etc/logrotate.d/$app"
|
||||
|
||||
ynh_restore_file --origin_path="/etc/fail2ban/jail.d/$app.conf"
|
||||
ynh_restore_file --origin_path="/etc/fail2ban/filter.d/$app.conf"
|
||||
ynh_systemd_action --action=restart --service_name=fail2ban
|
||||
|
||||
# Other various files...
|
||||
|
||||
#=================================================
|
||||
|
|
|
|||
|
|
@ -5,31 +5,6 @@ source /usr/share/yunohost/helpers
|
|||
|
||||
upgrade_type=$(ynh_check_app_version_changed)
|
||||
|
||||
#=================================================
|
||||
# STANDARD UPGRADE STEPS
|
||||
#=================================================
|
||||
# ENSURE DOWNWARD COMPATIBILITY
|
||||
#=================================================
|
||||
#ynh_script_progression --message="Ensuring downward compatibility..."
|
||||
|
||||
#
|
||||
# N.B. : the followings setting migrations snippets are provided as *EXAMPLES*
|
||||
# of what you may want to do in some cases (e.g. a setting was not defined on
|
||||
# some legacy installs and you therefore want to initialize stuff during upgrade)
|
||||
#
|
||||
|
||||
# If db_name doesn't exist, create it
|
||||
#if [ -z "${db_name:-}" ]; then
|
||||
# db_name=$(ynh_sanitize_dbid --db_name=$app)
|
||||
# ynh_app_setting_set --app=$app --key=db_name --value=$db_name
|
||||
#fi
|
||||
|
||||
# If install_dir doesn't exist, create it
|
||||
#if [ -z "${install_dir:-}" ]; then
|
||||
# install_dir=/var/www/$app
|
||||
# ynh_app_setting_set --app=$app --key=install_dir --value=$install_dir
|
||||
#fi
|
||||
|
||||
#=================================================
|
||||
# STOP SYSTEMD SERVICE
|
||||
#=================================================
|
||||
|
|
@ -50,9 +25,6 @@ popd
|
|||
|
||||
refresh_collect
|
||||
|
||||
chmod 400 "$install_dir/"
|
||||
chown ${app}:${app} "$install_dir/"
|
||||
|
||||
#=================================================
|
||||
# REAPPLY SYSTEM CONFIGURATIONS
|
||||
#=================================================
|
||||
|
|
@ -66,9 +38,6 @@ yunohost service add $app --log="/var/log/$app/$app.log"
|
|||
|
||||
ynh_use_logrotate --non-append
|
||||
|
||||
# Create a dedicated Fail2Ban config
|
||||
ynh_add_fail2ban_config --logpath="/var/log/nginx/${domain}-error.log" --failregex=""
|
||||
|
||||
#=================================================
|
||||
# START SYSTEMD SERVICE
|
||||
#=================================================
|
||||
|
|
|
|||
Loading…
Reference in a new issue