YunoHost-Apps/duniter_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/duniter_ynh.git synced 2024-09-03 18:26:35 +02:00
Code Issues Activity Actions

Revamp systemd service, log to journalctl, direct start

Browse source
This commit is contained in:
Salamandar 2024-02-23 16:32:45 +01:00
parent 09feafc825
commit 3ca1deb87d
5 changed files with 43 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

43
conf/systemd.service
View file

@ -3,17 +3,52 @@ Description=Duniter node
After=network.target
[Service]
Type=exec
User=duniter
Group=duniter
Environment="DUNITER_WEB=web"
Environment="DUNITER_HOME=__DATA_DIR__"
Environment="DUNITER_DATA=duniter_default"
Environment="DUNITER_OPTS="
Group=duniter
User=duniter
Type=forking
ExecStart=/usr/bin/duniter direct_${DUNITER_WEB}start --home ${DUNITER_HOME} --mdb ${DUNITER_DATA} $DUNITER_OPTS --webmport __PORT_WEB_ADMIN__
ExecReload=/usr/bin/duniter direct_${DUNITER_WEB}restart --home ${DUNITER_HOME} --mdb ${DUNITER_DATA} $DUNITER_OPTS --webmport __PORT_WEB_ADMIN__
ExecStop=/usr/bin/duniter stop --home ${DUNITER_HOME} --mdb ${DUNITER_DATA}
Restart=on-failure
StandardOutput=journal
StandardError=inherit
# Sandboxing options to harden security
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
ProtectClock=yes
ProtectHostname=yes
ProtectProc=invisible
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallArchitectures=native
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged
# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
[Install]
WantedBy=multi-user.target

2
scripts/change_url
View file

@ -33,7 +33,7 @@ ynh_change_url_nginx_config
ynh_script_progression --message="Starting a systemd service…"
# Start a systemd service
ynh_systemd_action --service_name="$app" --action="start" --log_path=systemd
ynh_systemd_action --service_name="$app" --action="start" --log_path=systemd --line_match="Web administration accessible"
#=================================================
# END OF SCRIPT

2
scripts/install
View file

@ -53,7 +53,7 @@ yunohost service add "$app"
ynh_script_progression --message="Starting a systemd service…"
# Start a systemd service
ynh_systemd_action --service_name="$app" --action="start" --log_path=systemd
ynh_systemd_action --service_name="$app" --action="start" --log_path=systemd --line_match="Web administration accessible"
#=================================================
# END OF SCRIPT

2
scripts/restore
View file

@ -55,7 +55,7 @@ yunohost service add "$app"
#=================================================
ynh_script_progression --message="Reloading NGINX web server and $app's service..." --weight=1
ynh_systemd_action --service_name="$app" --action="start" --log_path="systemd"
ynh_systemd_action --service_name="$app" --action="start" --log_path="systemd" --line_match="Web administration accessible"
ynh_systemd_action --service_name=nginx --action=reload

2
scripts/upgrade
View file

@ -64,7 +64,7 @@ yunohost service add "$app"
#=================================================
ynh_script_progression --message="Starting a systemd service…"
ynh_systemd_action --service_name="$app" --action="start" --log_path=systemd
ynh_systemd_action --service_name="$app" --action="start" --log_path=systemd --line_match="Web administration accessible"
#=================================================
# END OF SCRIPT