diaspora_ynh/conf/diaspora_web.service

[Unit]
Description=Diaspora social network (unicorn - instance __APP__)
PartOf=__APP__.target

[Service]
Type=simple
User=__APP__
WorkingDirectory=__FINALPATH__/live
Environment="__LD_PRELOAD__"
Environment="RAILS_ENV=production"
Environment="__YNH_RUBY_LOAD_PATH__"
PIDFile=/run/__APP__/diaspora.pid
ExecStart=__FINAL_PATH__/live/bin/bundle exec unicorn -c config/unicorn.rb -E production
ExecReload=/bin/kill -USR2 $MAINPID
Restart=always

# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these 
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap

# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 

[Install]
WantedBy=__APP__.target
Make the app install and remove 2019-12-02 21:04:01 +01:00			`[Unit]`
Refacto install script - secure remove (only remove things if we did add the thing ) - switch to ynh_replace_string for some stuff (instead of templates, discouraged) - extract some part pour restore script 2020-05-17 15:53:04 +02:00			`Description=Diaspora social network (unicorn - instance __APP__)`
			`PartOf=__APP__.target`
Make the app install and remove 2019-12-02 21:04:01 +01:00
			`[Service]`
Apply last example_ynh 2022-05-29 12:45:09 +02:00			`Type=simple`
Refacto install script - secure remove (only remove things if we did add the thing ) - switch to ynh_replace_string for some stuff (instead of templates, discouraged) - extract some part pour restore script 2020-05-17 15:53:04 +02:00			`User=__APP__`
Apply last example_ynh 2022-05-29 12:45:09 +02:00			`WorkingDirectory=__FINALPATH__/live`
			`Environment="__LD_PRELOAD__"`
			`Environment="RAILS_ENV=production"`
			`Environment="__YNH_RUBY_LOAD_PATH__"`
Refacto install script - secure remove (only remove things if we did add the thing ) - switch to ynh_replace_string for some stuff (instead of templates, discouraged) - extract some part pour restore script 2020-05-17 15:53:04 +02:00			`PIDFile=/run/__APP__/diaspora.pid`
Apply last example_ynh 2022-05-29 12:45:09 +02:00			`ExecStart=__FINAL_PATH__/live/bin/bundle exec unicorn -c config/unicorn.rb -E production`
Make the app install and remove 2019-12-02 21:04:01 +01:00			`ExecReload=/bin/kill -USR2 $MAINPID`
			`Restart=always`

Harden systed security 2022-02-21 17:05:41 +01:00			`# Sandboxing options to harden security`
			`# Depending on specificities of your service/app, you may need to tweak these`
			`# .. but this should be a good baseline`
			`# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html`
			`NoNewPrivileges=yes`
			`PrivateTmp=yes`
			`PrivateDevices=yes`
Apply last example_ynh 2022-05-29 12:45:09 +02:00			`RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK`
Harden systed security 2022-02-21 17:05:41 +01:00			`RestrictNamespaces=yes`
			`RestrictRealtime=yes`
			`DevicePolicy=closed`
			`ProtectSystem=full`
			`ProtectControlGroups=yes`
			`ProtectKernelModules=yes`
			`ProtectKernelTunables=yes`
			`LockPersonality=yes`
			`SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap`

			`# Denying access to capabilities that should not be relevant for webapps`
			`# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html`
			`CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD`
			`CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE`
			`CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT`
			`CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK`
			`CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM`
			`CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG`
			`CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE`
			`CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW`
			`CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG`

Make the app install and remove 2019-12-02 21:04:01 +01:00			`[Install]`
Refacto install script - secure remove (only remove things if we did add the thing ) - switch to ynh_replace_string for some stuff (instead of templates, discouraged) - extract some part pour restore script 2020-05-17 15:53:04 +02:00			`WantedBy=__APP__.target`