diaspora_ynh/conf/diaspora_sidekiq.service

[Unit]
Description=Diaspora social network (sidekiq - instance __APP__)
PartOf=__APP__.target

[Service]
Type=simple
User=__APP__
WorkingDirectory=__FINALPATH__/live
Environment="__LD_PRELOAD__"
Environment="RAILS_ENV=production"
Environment="__YNH_RUBY_LOAD_PATH__"
ExecStart=__FINAL_PATH__/live/bin/bundle exec sidekiq
Restart=always

# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these 
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=no
PrivateTmp=yes
#PrivateDevices=yes
#RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
#RestrictNamespaces=yes
#RestrictRealtime=yes
DevicePolicy=closed
ProtectSystem=full
ProtectControlGroups=yes
#ProtectKernelModules=yes
#ProtectKernelTunables=yes
#LockPersonality=yes
#SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap

# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 

[Install]
WantedBy=__APP__.target
Make the app install and remove 2019-12-02 21:04:01 +01:00			`[Unit]`
Refacto install script - secure remove (only remove things if we did add the thing ) - switch to ynh_replace_string for some stuff (instead of templates, discouraged) - extract some part pour restore script 2020-05-17 15:53:04 +02:00			`Description=Diaspora social network (sidekiq - instance __APP__)`
			`PartOf=__APP__.target`
Make the app install and remove 2019-12-02 21:04:01 +01:00
			`[Service]`
Apply last example_ynh 2022-05-29 12:45:09 +02:00			`Type=simple`
Refacto install script - secure remove (only remove things if we did add the thing ) - switch to ynh_replace_string for some stuff (instead of templates, discouraged) - extract some part pour restore script 2020-05-17 15:53:04 +02:00			`User=__APP__`
Apply last example_ynh 2022-05-29 12:45:09 +02:00			`WorkingDirectory=__FINALPATH__/live`
			`Environment="__LD_PRELOAD__"`
			`Environment="RAILS_ENV=production"`
			`Environment="__YNH_RUBY_LOAD_PATH__"`
			`ExecStart=__FINAL_PATH__/live/bin/bundle exec sidekiq`
Make the app install and remove 2019-12-02 21:04:01 +01:00			`Restart=always`

Harden systed security 2022-02-21 17:05:41 +01:00			`# Sandboxing options to harden security`
			`# Depending on specificities of your service/app, you may need to tweak these`
			`# .. but this should be a good baseline`
			`# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html`
Apply last example_ynh 2022-05-29 12:45:09 +02:00			`NoNewPrivileges=no`
Harden systed security 2022-02-21 17:05:41 +01:00			`PrivateTmp=yes`
Apply last example_ynh 2022-05-29 12:45:09 +02:00			`#PrivateDevices=yes`
			`#RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK`
			`#RestrictNamespaces=yes`
			`#RestrictRealtime=yes`
Harden systed security 2022-02-21 17:05:41 +01:00			`DevicePolicy=closed`
			`ProtectSystem=full`
			`ProtectControlGroups=yes`
Apply last example_ynh 2022-05-29 12:45:09 +02:00			`#ProtectKernelModules=yes`
			`#ProtectKernelTunables=yes`
			`#LockPersonality=yes`
			`#SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap`
Harden systed security 2022-02-21 17:05:41 +01:00
			`# Denying access to capabilities that should not be relevant for webapps`
			`# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html`
			`CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD`
			`CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE`
			`CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT`
			`CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK`
			`CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM`
			`CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG`
			`CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE`
			`CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW`
			`CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG`

Make the app install and remove 2019-12-02 21:04:01 +01:00			`[Install]`
Refacto install script - secure remove (only remove things if we did add the thing ) - switch to ynh_replace_string for some stuff (instead of templates, discouraged) - extract some part pour restore script 2020-05-17 15:53:04 +02:00			`WantedBy=__APP__.target`