YunoHost-Apps/funkwhale_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/funkwhale_ynh.git synced 2024-09-03 18:36:24 +02:00
Code Issues Activity Actions 1
funkwhale_ynh/conf/funkwhale-server.service

45 lines
1.7 KiB
SYSTEMD
Raw Normal View History

First installation script, it doesn't work yet
2018-04-17 00:02:25 +02:00
[Unit]
Upgrade to 1.1.1 (#138) * Update README.md * Test bump to 1.0 * Bump to Yunohost 4 (for Debian upgrade) * Test removal of nonexistent scripts * Correct Typo * Update README.md * Fix linter warnings * Fix linter * Fix linter warnings * Cleaning up * Update README.md * Update to 1.0.1 (#119) * Update to 1.0.1 * Set new permissions * Add French Readme * Readme update * Update README.md * Update README.md * Update README_fr.md * Update README.md Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> * Update README_fr.md Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> * Update README.md Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> * Update README_fr.md Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> * Finding an available port * Uprade to 1.1 and fixes Twisted by retrograding it (#129) * Fix linter warning : no need to use $is_public * Clarify custom paths needed to import collections of music files in Readme. (#134) * Update readme to indicate custom import path Yunohost installations of Funkwhale use a different path for file imports than those indicated in the Funkwhale documentation.. (/var/www/Funkwhale/import). We should therefore indicate to the admin user what that path is, and steps necessary to use it. Addresses #132. * Fix bash highlighting. * Update README.md Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> * Apply Example_ynh (#131) * Testing (#130) * Uprade to 1.1 and fixes Twisted by retrograding it (#129) * Apply example_ynh Fix #15 * Fix services * Fix several merging * Stick to official install process * fix path_transversal * Using option '--log_type systemd' with 'yunohost service add' is not relevant anymore * Try to fix package_check * Fix package_check test * Update check_process * Trying to fix package_check * Update env.prod * remove sleep * Better service name * missing datadir * line 111: upgrade_type: unbound variable * Implement --is_big * Fix stopping service from previous version * Fix upgrade * Fix upgrade * Apply example_ynh * Apply example_ynh * Fix rights * Update api.src * Update env.prod * Update front.src * Update manifest.json * Update README.md * Update README_fr.md * Fix chmod * Fix rights Co-authored-by: Thomas <51749973+Thovi98@users.noreply.github.com> Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> * Update conf/nginx.conf Co-authored-by: Thomas <51749973+Thovi98@users.noreply.github.com> * Update conf/nginx.conf Co-authored-by: Thomas <51749973+Thovi98@users.noreply.github.com> * fix * Fix rights for datadir from previous version * Update upgrade * Fix recursive chmod * Fix import link * Update README_fr.md Co-authored-by: Thomas <51749973+Thovi98@users.noreply.github.com> Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org> Co-authored-by: Ciarán Ainsworth <cda@rootkey.co.uk> Co-authored-by: Ciarán Ainsworth <ciaranainsworth@posteo.net> Co-authored-by: ericgaspar <junk.eg@free.fr> Co-authored-by: Thomas <51749973+Thovi98@users.noreply.github.com> Co-authored-by: Amos Blanton <lightnin@users.noreply.github.com>
2021-04-24 13:05:22 +02:00
Description=__APP__ application server
First installation script, it doesn't work yet
2018-04-17 00:02:25 +02:00
After=redis.service postgresql.service
PartOf=__APP__.target
[Service]
User=__APP__
Add more security to systemd files
2018-10-21 11:15:08 +02:00
Group=__APP__
Upgrade to 1.1.1 (#138) * Update README.md * Test bump to 1.0 * Bump to Yunohost 4 (for Debian upgrade) * Test removal of nonexistent scripts * Correct Typo * Update README.md * Fix linter warnings * Fix linter * Fix linter warnings * Cleaning up * Update README.md * Update to 1.0.1 (#119) * Update to 1.0.1 * Set new permissions * Add French Readme * Readme update * Update README.md * Update README.md * Update README_fr.md * Update README.md Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> * Update README_fr.md Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> * Update README.md Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> * Update README_fr.md Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> * Finding an available port * Uprade to 1.1 and fixes Twisted by retrograding it (#129) * Fix linter warning : no need to use $is_public * Clarify custom paths needed to import collections of music files in Readme. (#134) * Update readme to indicate custom import path Yunohost installations of Funkwhale use a different path for file imports than those indicated in the Funkwhale documentation.. (/var/www/Funkwhale/import). We should therefore indicate to the admin user what that path is, and steps necessary to use it. Addresses #132. * Fix bash highlighting. * Update README.md Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> * Apply Example_ynh (#131) * Testing (#130) * Uprade to 1.1 and fixes Twisted by retrograding it (#129) * Apply example_ynh Fix #15 * Fix services * Fix several merging * Stick to official install process * fix path_transversal * Using option '--log_type systemd' with 'yunohost service add' is not relevant anymore * Try to fix package_check * Fix package_check test * Update check_process * Trying to fix package_check * Update env.prod * remove sleep * Better service name * missing datadir * line 111: upgrade_type: unbound variable * Implement --is_big * Fix stopping service from previous version * Fix upgrade * Fix upgrade * Apply example_ynh * Apply example_ynh * Fix rights * Update api.src * Update env.prod * Update front.src * Update manifest.json * Update README.md * Update README_fr.md * Fix chmod * Fix rights Co-authored-by: Thomas <51749973+Thovi98@users.noreply.github.com> Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> * Update conf/nginx.conf Co-authored-by: Thomas <51749973+Thovi98@users.noreply.github.com> * Update conf/nginx.conf Co-authored-by: Thomas <51749973+Thovi98@users.noreply.github.com> * fix * Fix rights for datadir from previous version * Update upgrade * Fix recursive chmod * Fix import link * Update README_fr.md Co-authored-by: Thomas <51749973+Thovi98@users.noreply.github.com> Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org> Co-authored-by: Ciarán Ainsworth <cda@rootkey.co.uk> Co-authored-by: Ciarán Ainsworth <ciaranainsworth@posteo.net> Co-authored-by: ericgaspar <junk.eg@free.fr> Co-authored-by: Thomas <51749973+Thovi98@users.noreply.github.com> Co-authored-by: Amos Blanton <lightnin@users.noreply.github.com>
2021-04-24 13:05:22 +02:00
WorkingDirectory=__FINALPATH__/api
EnvironmentFile=__FINALPATH__/config/.env
ExecStart=__FINALPATH__/virtualenv/bin/gunicorn config.asgi:application -w ${FUNKWHALE_WEB_WORKERS} -k uvicorn.workers.UvicornWorker -b ${FUNKWHALE_API_IP}:${FUNKWHALE_API_PORT}
Add more security to systemd files
2018-10-21 11:15:08 +02:00
Hardening systemd
2022-01-07 00:16:10 +01:00
# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
First installation script, it doesn't work yet
2018-04-17 00:02:25 +02:00
[Install]
Upgrade to 2.29
2019-10-31 18:25:28 +01:00
WantedBy=multi-user.target
Reference in a new issue Copy permalink