discourse_ynh/conf/systemd.service

[Unit]
Description=__APP__ service
Wants=postgresql.service
Wants=redis-server.service
After=redis-server.service
After=postgresql.service

[Service]
User=__APP__
Group=__APP__
WorkingDirectory=__INSTALL_DIR__
Environment=__ADDITIONAL_ENV__
Environment=RAILS_ENV=production
Environment=UNICORN_SIDEKIQS=1
Environment=LD_PRELOAD=__LIBJEMALLOC__
Environment=UNICORN_LISTENER=__INSTALL_DIR__/tmp/sockets/unicorn.sock
Environment="__YNH_RUBY_LOAD_PATH__"
ExecStart=__INSTALL_DIR__/bin/bundle exec unicorn --config config/unicorn.conf.rb -E production
Restart=always
RestartSec=10

# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these 
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap

# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 

[Install]
WantedBy=multi-user.target
Initial commit 2018-04-02 16:36:02 +02:00			`[Unit]`
Use unicorn instead of puma, hence not needing a separate sidekiq service and drastically reducing memory footprint Limit number of workers to 2 on ARM devices See here: https://meta.discourse.org/t/does-discourse-require-2gb-to-work-lag-free/25278/8 2018-05-04 12:51:16 +02:00			`Description=__APP__ service`
Initial commit 2018-04-02 16:36:02 +02:00			`Wants=postgresql.service`
			`Wants=redis-server.service`
			`After=redis-server.service`
			`After=postgresql.service`

			`[Service]`
			`User=__APP__`
			`Group=__APP__`
manifestv2 2024-01-26 22:16:29 +01:00			`WorkingDirectory=__INSTALL_DIR__`
Add ARM compatibility 2018-04-29 11:25:32 +02:00			`Environment=__ADDITIONAL_ENV__`
Initial commit 2018-04-02 16:36:02 +02:00			`Environment=RAILS_ENV=production`
Upgrade to upstream version 2.0.0 2018-06-03 17:24:21 +02:00			`Environment=UNICORN_SIDEKIQS=1`
Use unicorn instead of puma, hence not needing a separate sidekiq service and drastically reducing memory footprint Limit number of workers to 2 on ARM devices See here: https://meta.discourse.org/t/does-discourse-require-2gb-to-work-lag-free/25278/8 2018-05-04 12:51:16 +02:00			`Environment=LD_PRELOAD=__LIBJEMALLOC__`
manifestv2 2024-01-26 22:16:29 +01:00			`Environment=UNICORN_LISTENER=__INSTALL_DIR__/tmp/sockets/unicorn.sock`
Apply last example_ynh 2022-05-29 17:36:13 +02:00			`Environment="__YNH_RUBY_LOAD_PATH__"`
manifestv2 2024-01-26 22:16:29 +01:00			`ExecStart=__INSTALL_DIR__/bin/bundle exec unicorn --config config/unicorn.conf.rb -E production`
Initial commit 2018-04-02 16:36:02 +02:00			`Restart=always`
			`RestartSec=10`

2.7.10 (#97) * 2.7.10 2021-11-22 13:28:08 +01:00			`# Sandboxing options to harden security`
			`# Depending on specificities of your service/app, you may need to tweak these`
			`# .. but this should be a good baseline`
			`# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html`
			`NoNewPrivileges=yes`
			`PrivateTmp=yes`
			`PrivateDevices=yes`
Apply last example_ynh 2022-05-29 17:36:13 +02:00			`RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK`
2.7.10 (#97) * 2.7.10 2021-11-22 13:28:08 +01:00			`RestrictNamespaces=yes`
			`RestrictRealtime=yes`
			`DevicePolicy=closed`
			`ProtectSystem=full`
			`ProtectControlGroups=yes`
			`ProtectKernelModules=yes`
			`ProtectKernelTunables=yes`
			`LockPersonality=yes`
			`SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap`

			`# Denying access to capabilities that should not be relevant for webapps`
			`# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html`
			`CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD`
			`CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE`
			`CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT`
			`CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK`
			`CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM`
			`CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG`
			`CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE`
			`CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW`
			`CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG`

Initial commit 2018-04-02 16:36:02 +02:00			`[Install]`
			`WantedBy=multi-user.target`