flohmarkt_ynh/conf/systemd.service

[Unit]
Description=flohmarkt server
After=network.target couchdb.service

[Service]
Type=simple
User=__APP__
Group=__APP__
WorkingDirectory=__FLOHMARKT_INSTALL__
Environment="VENV_DIR=__FLOHMARKT_VENV_DIR__"
ExecStart=/bin/bash -c "__FLOHMARKT_VENV_DIR__/bin/uvicorn --host 127.0.0.1 --port 8000 --reload flohmarkt.web:start  2>&1 | /usr/bin/ts '%%Y-%%m-%%d %%H:%%M:%%S'"
# nicer logfile naming https://codeberg.org/flohmarkt/flohmarkt_ynh/issues/38
StandardOutput=append:/var/log/__ID__/__APP__.log
StandardError=inherit

# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap

# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG

[Install]
WantedBy=multi-user.target
systemd.service 2024-04-11 19:53:18 +02:00			`[Unit]`
			`Description=flohmarkt server`
			`After=network.target couchdb.service`

			`[Service]`
			`Type=simple`
			`User=__APP__`
			`Group=__APP__`
reworked install paths new paths are now defined in _common.sh like this ``` flohmarkt_install="/opt/${id}/${domain}${url_path}/src" flohmarkt_venv_dir="/opt/${id}/${domain}${url_path}/venv" ``` giving a nice layout following the domain and path the flohmarkt uses as its URL. Activated path resource in manifest.toml to let the admin choose a path different from '/'. 2024-04-30 14:12:49 +02:00			`WorkingDirectory=__FLOHMARKT_INSTALL__`
			`Environment="VENV_DIR=__FLOHMARKT_VENV_DIR__"`
			`ExecStart=/bin/bash -c "__FLOHMARKT_VENV_DIR__/bin/uvicorn --host 127.0.0.1 --port 8000 --reload flohmarkt.web:start 2>&1 \| /usr/bin/ts '%%Y-%%m-%%d %%H:%%M:%%S'"`
			`# nicer logfile naming https://codeberg.org/flohmarkt/flohmarkt_ynh/issues/38`
			`StandardOutput=append:/var/log/__ID__/__APP__.log`
systemd.service 2024-04-11 19:53:18 +02:00			`StandardError=inherit`

			`# Sandboxing options to harden security`
			`# Depending on specificities of your service/app, you may need to tweak these`
			`# .. but this should be a good baseline`
			`# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html`
			`NoNewPrivileges=yes`
			`PrivateTmp=yes`
			`PrivateDevices=yes`
			`RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6`
			`RestrictNamespaces=yes`
			`RestrictRealtime=yes`
			`DevicePolicy=closed`
			`ProtectSystem=full`
			`ProtectControlGroups=yes`
			`ProtectKernelModules=yes`
			`ProtectKernelTunables=yes`
			`LockPersonality=yes`
			`SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap`

			`# Denying access to capabilities that should not be relevant for webapps`
			`# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html`
			`CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD`
			`CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE`
			`CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT`
			`CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK`
			`CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM`
			`CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG`
			`CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE`
			`CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW`
			`CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG`

			`[Install]`
			`WantedBy=multi-user.target`