mirror of
https://github.com/YunoHost-Apps/flohmarkt_ynh.git
synced 2024-09-03 18:36:30 +02:00
b5e0f424f9
new paths are now defined in _common.sh like this
```
flohmarkt_install="/opt/${id}/${domain}${url_path}/src"
flohmarkt_venv_dir="/opt/${id}/${domain}${url_path}/venv"
```
giving a nice layout following the domain and path the flohmarkt uses as its URL.
Activated path resource in manifest.toml to let the admin choose a path different from '/'.
47 lines
1.8 KiB
Desktop File
47 lines
1.8 KiB
Desktop File
[Unit]
|
|
Description=flohmarkt server
|
|
After=network.target couchdb.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=__APP__
|
|
Group=__APP__
|
|
WorkingDirectory=__FLOHMARKT_INSTALL__
|
|
Environment="VENV_DIR=__FLOHMARKT_VENV_DIR__"
|
|
ExecStart=/bin/bash -c "__FLOHMARKT_VENV_DIR__/bin/uvicorn --host 127.0.0.1 --port 8000 --reload flohmarkt.web:start 2>&1 | /usr/bin/ts '%%Y-%%m-%%d %%H:%%M:%%S'"
|
|
# nicer logfile naming https://codeberg.org/flohmarkt/flohmarkt_ynh/issues/38
|
|
StandardOutput=append:/var/log/__ID__/__APP__.log
|
|
StandardError=inherit
|
|
|
|
# Sandboxing options to harden security
|
|
# Depending on specificities of your service/app, you may need to tweak these
|
|
# .. but this should be a good baseline
|
|
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
DevicePolicy=closed
|
|
ProtectSystem=full
|
|
ProtectControlGroups=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
LockPersonality=yes
|
|
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
|
|
|
|
# Denying access to capabilities that should not be relevant for webapps
|
|
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
|
|
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
|
|
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
|
|
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
|
|
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
|
|
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
|
|
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
|
|
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
|
|
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
|
|
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|