Apply last example_ynh

README.md

@@ -8,8 +8,6 @@ It shall NOT be edited by hand.
 [![Integration level](https://dash.yunohost.org/integration/gemserv.svg)](https://dash.yunohost.org/appci/app/gemserv) ![](https://ci-apps.yunohost.org/ci/badges/gemserv.status.svg) ![](https://ci-apps.yunohost.org/ci/badges/gemserv.maintain.svg)  
 [![Install Gemserv with YunoHost](https://install-app.yunohost.org/install-with-yunohost.svg)](https://install-app.yunohost.org/?app=gemserv)
 
-*[Lire ce readme en français.](./README_fr.md)*
-
 > *This package allows you to install Gemserv quickly and simply on a YunoHost server.
 If you don't have YunoHost, please consult [the guide](https://yunohost.org/#/install) to learn how to install it.*
 

README_fr.md

@@ -1,74 +0,0 @@
-# Gemserv pour YunoHost
-
-[![Niveau d'intégration](https://dash.yunohost.org/integration/gemserv.svg)](https://dash.yunohost.org/appci/app/gemserv) ![](https://ci-apps.yunohost.org/ci/badges/gemserv.status.svg) ![](https://ci-apps.yunohost.org/ci/badges/gemserv.maintain.svg)  
-[![Installer Gemserv avec YunoHost](https://install-app.yunohost.org/install-with-yunohost.svg)](https://install-app.yunohost.org/?app=gemserv)
-
-*[Read this readme in english.](./README.md)*
-*[Lire ce readme en français.](./README_fr.md)*
-
-> *Ce package vous permet d'installer Gemserv rapidement et simplement sur un serveur YunoHost.
-Si vous n'avez pas YunoHost, regardez [ici](https://yunohost.org/#/install) pour savoir comment l'installer et en profiter.*
-
-## Vue d'ensemble
-
-
-
-**Version incluse :** 0.6.3~ynh1
-
-
-
-## Avertissements / informations importantes
-
-* Other infos that people should be aware of, such as:
-    * Redirect TCP/1965 port to the server
-    * To add a gemini capsule, create a /etc/gemserv/config.d/example.toml 
-
-```
-[[server]]
-hostname = "youdomain.org"
-dir = "/path/to/serv/"
-key = "/etc/yunohost/certs/youdomain.org/key.pem"
-cert = "/etc/yunohost/certs/youdomain.org/crt.pem"
-# index is optional but defaults to index.gemini. The server will serve files
-# ending in gemini or gmi.
-index = "index.gmi"
-# lang is optional
-lang = "en"
-# cgi is optional bool
-cgi = true
-# cgipath is optional and only checked if cgi is true. It restricts cgi to only
-# this directory.
-cgipath = "/path/to/cgi-bin/"
-# scgi is optional
-scgi = { "/scgi" = "localhost:4000" }
-# cgienv is optional
-cgienv = { "GIT_PROJECT_ROOT" = "/srv/git" }
-# usrdir is optional. it'll look in /home/usr/public_gemini
-usrdir = true
-# proxy is optional
-# path is what comes after the hostname e.g. example.com/path
-proxy = { path = "localhost:1966" }
-# proxy_all is optional
-# It will send all requests to the specified server. It also supports streamming.
-proxy_all = localhost:1967
-# redirect is optional
-redirect = { "/redirect" = "/", "/newdomain" = "gemini://example.net" }
-```
-## Documentations et ressources
-
-* Dépôt de code officiel de l'app : https://git.sr.ht/~int80h/gemserv
-* Documentation YunoHost pour cette app : https://yunohost.org/app_gemserv
-* Signaler un bug : https://github.com/YunoHost-Apps/gemserv_ynh/issues
-
-## Informations pour les développeurs
-
-Merci de faire vos pull request sur la [branche testing](https://github.com/YunoHost-Apps/gemserv_ynh/tree/testing).
-
-Pour essayer la branche testing, procédez comme suit.
-```
-sudo yunohost app install https://github.com/YunoHost-Apps/gemserv_ynh/tree/testing --debug
-ou
-sudo yunohost app upgrade gemserv -u https://github.com/YunoHost-Apps/gemserv_ynh/tree/testing --debug
-```
-
-**Plus d'infos sur le packaging d'applications :** https://yunohost.org/packaging_apps

check_process

@@ -1,8 +1,3 @@
-# See here for more information
-# https://github.com/YunoHost/package_check#syntax-check_process-file
-
-# Move this file from check_process.default to check_process when you have filled it.
-
 ;; Test complet
 	; Manifest
 		port="1965"

conf/systemd.service

@@ -15,5 +15,35 @@ StandardError=inherit
 Restart=always
 RestartSec=5
 
+# Sandboxing options to harden security
+# Depending on specificities of your service/app, you may need to tweak these 
+# .. but this should be a good baseline
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
+
+# Denying access to capabilities that should not be relevant for webapps
+# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 
+
 [Install]
 WantedBy=multi-user.target

doc/DESCRIPTION.md

@@ -0,0 +1 @@
+A gemini server written in rust.

manifest.json

@@ -13,7 +13,7 @@
     },
     "license": "MIT",
     "maintainer": {
-        "name": "yalh76" 
+        "name": "yalh76"
     },
     "requirements": {
         "yunohost": ">= 4.1.3"

scripts/install

@@ -61,7 +61,7 @@ ynh_install_app_dependencies $pkg_dependencies
 ynh_script_progression --message="Configuring system user..."
 
 # Create a system user
-ynh_system_user_create --username=$app --home_dir="$final_path"
+ynh_system_user_create --username=$app --home_dir=$final_path
 
 usermod -a -G ssl-cert $app
 
@@ -89,14 +89,14 @@ ynh_script_progression --message="Making install..."
 
 # Install rustup with the toolchain needed by Gemserv
 pushd "$final_path"
-	sudo -u "$app" RUSTUP_HOME="$final_path"/.rustup CARGO_HOME="$final_path"/.cargo bash -c 'curl -sSf -L https://static.rust-lang.org/rustup.sh | sh -s -- -y --default-toolchain nightly'
+	ynh_exec_as "$app" RUSTUP_HOME="$final_path"/.rustup CARGO_HOME="$final_path"/.cargo bash -c 'curl -sSf -L https://static.rust-lang.org/rustup.sh | sh -s -- -y --default-toolchain nightly'
 popd
 
 export PATH="$PATH:$final_path/.cargo/bin:$final_path/.local/bin:/usr/local/sbin" 
 
 # Compile Gemserv
 pushd "$final_path"/build
-	ynh_exec_warn_less sudo -u "$app" env PATH="$PATH" cargo build --release
+	ynh_exec_warn_less ynh_exec_as "$app" env PATH="$PATH" cargo build --release
 popd
 
 # Install Gemserv

scripts/remove

@@ -41,12 +41,12 @@ ynh_script_progression --message="Stopping and removing the systemd service..."
 ynh_remove_systemd_config
 
 #=================================================
-# REMOVE DEPENDENCIES
+# REMOVE LOGROTATE CONFIGURATION
 #=================================================
-ynh_script_progression --message="Removing dependencies..."
+ynh_script_progression --message="Removing logrotate configuration..."
 
-# Remove metapackage and its dependencies
+# Remove the app-specific logrotate config
-ynh_remove_app_dependencies
+ynh_remove_logrotate
 
 #=================================================
 # REMOVE APP MAIN DIR
@@ -57,12 +57,12 @@ ynh_script_progression --message="Removing app main directory..."
 ynh_secure_remove --file="$final_path"
 
 #=================================================
-# REMOVE LOGROTATE CONFIGURATION
+# REMOVE DEPENDENCIES
 #=================================================
-ynh_script_progression --message="Removing logrotate configuration..."
+ynh_script_progression --message="Removing dependencies..."
 
-# Remove the app-specific logrotate config
+# Remove metapackage and its dependencies
-ynh_remove_logrotate
+ynh_remove_app_dependencies
 
 #=================================================
 # CLOSE A PORT

scripts/restore

@@ -45,7 +45,7 @@ test ! -d $final_path \
 ynh_script_progression --message="Recreating the dedicated system user..."
 
 # Create the dedicated user (if not existing)
-ynh_system_user_create --username=$app --home_dir="$final_path"
+ynh_system_user_create --username=$app --home_dir=$final_path
 
 #=================================================
 # RESTORE THE APP MAIN DIR
@@ -83,6 +83,13 @@ ynh_script_progression --message="Restoring the systemd configuration..."
 ynh_restore_file --origin_path="/etc/systemd/system/$app.service"
 systemctl enable $app.service --quiet
 
+#=================================================
+# RESTORE THE LOGROTATE CONFIGURATION
+#=================================================
+ynh_script_progression --message="Restoring the logrotate configuration..."
+
+ynh_restore_file --origin_path="/etc/logrotate.d/$app"
+
 #=================================================
 # INTEGRATE SERVICE IN YUNOHOST
 #=================================================
@@ -97,13 +104,6 @@ ynh_script_progression --message="Starting a systemd service..."
 
 ynh_systemd_action --service_name=$app --action="start" --line_match="Started" --log_path="systemd"
 
-#=================================================
-# RESTORE THE LOGROTATE CONFIGURATION
-#=================================================
-ynh_script_progression --message="Restoring the logrotate configuration..."
-
-ynh_restore_file --origin_path="/etc/logrotate.d/$app"
-
 #=================================================
 # GENERIC FINALIZATION
 #=================================================

scripts/upgrade

@@ -59,7 +59,7 @@ ynh_script_progression --message="Ensuring downward compatibility..."
 ynh_script_progression --message="Making sure dedicated system user exists..."
 
 # Create a dedicated user (if not existing)
-ynh_system_user_create --username=$app --home_dir="$final_path"
+ynh_system_user_create --username=$app --home_dir=$final_path
 
 usermod -a -G ssl-cert $app
 
@@ -99,14 +99,14 @@ if [ "$upgrade_type" == "UPGRADE_APP" ]
 then
 	# Install rustup with the toolchain needed by Gemserv
 	pushd "$final_path"
-		sudo -u "$app" RUSTUP_HOME="$final_path"/.rustup CARGO_HOME="$final_path"/.cargo bash -c 'curl -sSf -L https://static.rust-lang.org/rustup.sh | sh -s -- -y --default-toolchain nightly'
+		ynh_exec_as "$app" RUSTUP_HOME="$final_path"/.rustup CARGO_HOME="$final_path"/.cargo bash -c 'curl -sSf -L https://static.rust-lang.org/rustup.sh | sh -s -- -y --default-toolchain nightly'
 	popd
 
 	export PATH="$PATH:$final_path/.cargo/bin:$final_path/.local/bin:/usr/local/sbin" 
 
 	# Compile Gemserv
 	pushd "$final_path"/build
-		ynh_exec_warn_less sudo -u "$app" env PATH="$PATH" cargo build --release
+		ynh_exec_warn_less ynh_exec_as "$app" env PATH="$PATH" cargo build --release
 	popd
 
 	# Install Gemserv