mirror of
https://github.com/YunoHost-Apps/flohmarkt_ynh.git
synced 2024-09-03 18:36:30 +02:00
b6d9fac30f
Quiet a ride, but on my test system it installs and removes. Upgrade will not work, yet. Renaming is missing. Multiple installs should work.
47 lines
1.8 KiB
Desktop File
47 lines
1.8 KiB
Desktop File
[Unit]
|
|
Description=flohmarkt server
|
|
After=network.target couchdb.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=__APP__
|
|
Group=__APP__
|
|
WorkingDirectory=__FLOHMARKT_APP_DIR__
|
|
Environment="VENV_DIR=__FLOHMARKT_VENV_DIR__"
|
|
ExecStart=/bin/bash -c "__FLOHMARKT_VENV_DIR__/bin/uvicorn --host 127.0.0.1 --port __PORT__ flohmarkt.web:start 2>&1 | /usr/bin/ts '%%Y-%%m-%%d %%H:%%M:%%S'"
|
|
# nicer logfile naming https://codeberg.org/flohmarkt/flohmarkt_ynh/issues/38
|
|
StandardOutput=append:__FLOHMARKT_LOGFILE__
|
|
StandardError=inherit
|
|
|
|
# Sandboxing options to harden security
|
|
# Depending on specificities of your service/app, you may need to tweak these
|
|
# .. but this should be a good baseline
|
|
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
DevicePolicy=closed
|
|
ProtectSystem=full
|
|
ProtectControlGroups=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
LockPersonality=yes
|
|
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
|
|
|
|
# Denying access to capabilities that should not be relevant for webapps
|
|
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
|
|
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
|
|
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
|
|
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
|
|
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
|
|
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
|
|
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
|
|
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
|
|
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
|
|
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|