correct

conf/nginx.conf

@@ -1,11 +1,11 @@
 #sub_path_only rewrite ^__PATH__$ __PATH__/ permanent;
 
 location __PATH__/web/ {
-    alias __INSTALL_DIR__/__APP__/static/lucterios.framework/web/;
+    alias __INSTALL_DIR__/inst-__APP__/static/lucterios.framework/web/;
 }
 
 location __PATH__/static/ {
-    alias __INSTALL_DIR__/__APP__/static/;
+    alias __INSTALL_DIR__/inst-__APP__/static/;
 }
 
 location __PATH__/ {

conf/systemd.service

@@ -9,45 +9,11 @@ Group=__APP__
 
 Environment="DJANGO_SETTINGS_MODULE=inst-__APP__.settings"
 WorkingDirectory=__INSTALL_DIR__/
-ExecStart=__INSTALL_DIR__/virt/bin/gunicorn lucterios.framework.wsgi --bind 0.0.0.0:__PORT__ -w 1 --timeout 600 --access-logfile __INSTALL_DIR__/access.log --error-logfile __INSTALL_DIR__/error.log
+ExecStart=__INSTALL_DIR__/venv/bin/gunicorn lucterios.framework.wsgi --bind 0.0.0.0:__PORT__ -w 1 --timeout 600 --access-logfile __INSTALL_DIR__/access.log --error-logfile __INSTALL_DIR__/error.log
 StandardOutput=append:/var/log/__APP__/__APP__.log
 StandardError=inherit
 Restart=on-failure
 RestartSec=10
 
-# Sandboxing options to harden security
-# Depending on specificities of your service/app, you may need to tweak these
-# .. but this should be a good baseline
-# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
-NoNewPrivileges=yes
-PrivateTmp=yes
-PrivateDevices=yes
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-RestrictNamespaces=yes
-RestrictRealtime=yes
-DevicePolicy=closed
-ProtectClock=yes
-ProtectHostname=yes
-ProtectProc=invisible
-ProtectSystem=full
-ProtectControlGroups=yes
-ProtectKernelModules=yes
-ProtectKernelTunables=yes
-LockPersonality=yes
-SystemCallArchitectures=native
-SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged
-
-# Denying access to capabilities that should not be relevant for webapps
-# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
-CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
-CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
-CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
-CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
-CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
-CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
-CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
-CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
-CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
-
 [Install]
 WantedBy=multi-user.target

manifest.toml

@@ -60,6 +60,12 @@ ram.runtime = "50M"
     type = "select"
     choices = ["fr","en"]
 
+    [install.archive]
+    ask.en = "Archive to upload"
+    ask.fr = "Archive à télécharger"
+    type = "string"
+    optional = true
+
 [resources]
     # See the packaging documentation for the full set
     # of explanation regarding the behavior and properties for each of those

scripts/_common.sh

@@ -26,14 +26,16 @@ function refresh_collect()
 {
     pushd $install_dir
     venv/bin/python3 manage_inst-${app}.py collectstatic --noinput -l
-    rm -rf ${app}/static/static
+    rm -rf inst-${app}/static/static
-    rm -rf ${app}/static/plugins
+    rm -rf inst-${app}/static/plugins
-    rm -rf ${app}/static/tmp
+    rm -rf inst-${app}/static/tmp
-    rm -rf ${app}/static/archives
+    rm -rf inst-${app}/static/archives
-    rm -rf ${app}/static/usr
+    rm -rf inst-${app}/static/usr
-    rm -rf ${app}/static/__pycache__
+    rm -rf inst-${app}/static/__pycache__
-    rm -rf ${app}/static/settings.py
+    rm -rf inst-${app}/static/settings.py
-    rm -rf ${app}/static/django_error.log
+    rm -rf inst-${app}/static/django_error.log
-    rm -rf ${app}/static/__init__.py
+    rm -rf inst-${app}/static/__init__.py
+    chown -R ${app}:www-data .
+    chmod 750 .
     popd
 }

scripts/backup

@@ -12,9 +12,6 @@ ynh_backup --src_path="$install_dir"
 
 ynh_backup --src_path="/etc/nginx/conf.d/$domain.d/$app.conf"
 
-ynh_backup --src_path="/etc/fail2ban/jail.d/$app.conf"
-ynh_backup --src_path="/etc/fail2ban/filter.d/$app.conf"
-
 ynh_backup --src_path="/etc/logrotate.d/$app"
 
 ynh_backup --src_path="/etc/systemd/system/$app.service"

scripts/install

@@ -14,14 +14,11 @@ venv/bin/pip3 install -U lucterios lucterios-standard lucterios-contacts lucteri
 venv/bin/pip3 install -U diacamma-asso diacamma-syndic diacamma-financial
 venv/bin/pip3 install -U gunicorn psycopg2-binary psycopg2
 venv/bin/lucterios_admin.py installed
-venv/bin/lucterios_admin.py add -n inst-${app} -p "${APPLITYPE}" -m "${MODULES}" -d "${DATABASE}" -e '{"LANGUAGES":"'${language}'","USE_X_FORWARDED_HOST":true, "FORCE_SCRIPT_NAME":"/'${app}'"}'
+venv/bin/lucterios_admin.py add -n inst-${app} -p "${APPLITYPE}" -m "${MODULES}" -d "${DATABASE}" -e '{"LANGUAGE_CODE":"'${language}'","USE_X_FORWARDED_HOST":true, "FORCE_SCRIPT_NAME":"/'${app}'"}'
 popd
 
 refresh_collect
 
-chmod 400 "$install_dir/"
-chown ${app}:${app} "$install_dir/"
-
 #=================================================
 # SYSTEM CONFIGURATION
 #=================================================

scripts/restore

@@ -18,9 +18,6 @@ popd
 
 refresh_collect
 
-chmod 400 "$install_dir/"
-chown ${app}:${app} "$install_dir/"
-
 #=================================================
 # RESTORE THE MYSQL DATABASE
 #=================================================
@@ -45,10 +42,6 @@ yunohost service add $app --log="/var/log/$app/$app.log"
 
 ynh_restore_file --origin_path="/etc/logrotate.d/$app"
 
-ynh_restore_file --origin_path="/etc/fail2ban/jail.d/$app.conf"
-ynh_restore_file --origin_path="/etc/fail2ban/filter.d/$app.conf"
-ynh_systemd_action --action=restart --service_name=fail2ban
-
 # Other various files...
 
 #=================================================

scripts/upgrade

@@ -5,31 +5,6 @@ source /usr/share/yunohost/helpers
 
 upgrade_type=$(ynh_check_app_version_changed)
 
-#=================================================
-# STANDARD UPGRADE STEPS
-#=================================================
-# ENSURE DOWNWARD COMPATIBILITY
-#=================================================
-#ynh_script_progression --message="Ensuring downward compatibility..."
-
-#
-# N.B. : the followings setting migrations snippets are provided as *EXAMPLES*
-# of what you may want to do in some cases (e.g. a setting was not defined on
-# some legacy installs and you therefore want to initialize stuff during upgrade)
-#
-
-# If db_name doesn't exist, create it
-#if [ -z "${db_name:-}" ]; then
-#	db_name=$(ynh_sanitize_dbid --db_name=$app)
-#	ynh_app_setting_set --app=$app --key=db_name --value=$db_name
-#fi
-
-# If install_dir doesn't exist, create it
-#if [ -z "${install_dir:-}" ]; then
-#	install_dir=/var/www/$app
-#	ynh_app_setting_set --app=$app --key=install_dir --value=$install_dir
-#fi
-
 #=================================================
 # STOP SYSTEMD SERVICE
 #=================================================
@@ -50,9 +25,6 @@ popd
 
 refresh_collect
 
-chmod 400 "$install_dir/"
-chown ${app}:${app} "$install_dir/"
-
 #=================================================
 # REAPPLY SYSTEM CONFIGURATIONS
 #=================================================
@@ -66,9 +38,6 @@ yunohost service add $app --log="/var/log/$app/$app.log"
 
 ynh_use_logrotate --non-append
 
-# Create a dedicated Fail2Ban config
-ynh_add_fail2ban_config --logpath="/var/log/nginx/${domain}-error.log" --failregex=""
-
 #=================================================
 # START SYSTEMD SERVICE
 #=================================================