YunoHost-Apps/hedgedoc_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/hedgedoc_ynh.git synced 2024-09-03 19:25:52 +02:00
Code Issues Activity Actions
hedgedoc_ynh/conf/systemd.service

48 lines
1.7 KiB
SYSTEMD
Raw Normal View History

First commit
2020-11-19 21:41:03 +01:00
[Unit]
Description=HedgeDoc: collaborative Markdown notes
Documentation=https://github.com/hedgedoc/hedgedoc
After=network.target postgresql.service
[Service]
Type=simple
User=__APP__
Group=__APP__
Testing (#61) * Small fixes * 1.7.0 (#4) * Upgrde to v.1.7.0 * Set requirements to 3.8.1 * Update README.md * Upgrade to 1.7.1 (#6) * Add limitations * Avoid to buid frontend bundle * Remove PostegrSQL warning * Update README.md Add you should reload service for changes in config to be registered. * Add restart systemd tuto * Change version * Finding an available port * Upgrade to version 1.7.2 (#12) * Patch (#17) * Cleaning up * Update manifest.json * Cleaning up * Secure config file * Remove yarn * Update change_url * Update change_url * Revert "Remove yarn" This reverts commit a8cabf0c0addf8f9c4569b27ae04512db5c93df0. * Update change_url * Update systemd.service * Update systemd.service * Cleaning up * Fix * fix badges * Upgrade to version 1.8.0 (#21) * Upgrade to version 1.8.0 * Upgrade to 1.8.0 * Upgrade to 1.8.0 * Upgrade to version 1.8.1 * [autopatch] Update issue and PR templates (#25) Co-authored-by: Yunohost-Bot <> * Add templates * Upgrade to 1.8.2 * Update check_process * Add templates * Auto-update README * Set new requirements (#28) * Fix * Simplify config * Auto-update README Co-authored-by: Yunohost-Bot <> * Update manifest.json * Auto-update README * 1.9.0 (#31) * 1.9.0 * Update manifest.json * Auto-update README * Systemd hardening (#33) * Update systemd.service * Update app.src * Update manifest.json * 1.9.1 (#34) * Upgrade to 1.9.1 * 1.9.2 (#36) * Remove replace_string * Fix (#39) * Update manifest.json * Auto-update README * Update config.json.example * Update config.json.example * 1.9.3 * Auto-update README * 1.9.4 (#42) * 1.9.4 * Auto-update README Co-authored-by: yunohost-bot <yunohost@yunohost.org> * Auto-update README * Update manifest.json * Update _common.sh * set relative path for --keep opt * Update manifest.json * Auto-update README * 1.9.5 * Auto-update README * 1.9.6 * Auto-update README * Add more security as default (#47) * Add more security as default * Auto-update README * Update config.json.example * Update change_url Co-authored-by: yunohost-bot <yunohost@yunohost.org> * Update manifest.json * Auto-update README * Update install * Fix * Add allow free url to config panel * Add FreeURL authentication * Update config.json.example * Fix * remove yarn cache * Auto-update README * 1.9.7 * Auto-update README * Update change_url * Update systemd.service * Update systemd.service * Update install * FIx * Update manifest.json * Auto-update README * Update manifest.json * Version 2 (#58) * v2 * fix * Auto-update README * Update manifest.toml * fix * Update install * Update upgrade * Update change_url * Update install * fix * Auto-update README * Fix * Auto-update README * Fix * fix * Update manifest.toml * fix * fix * Auto-update README * Update tests.toml --------- Co-authored-by: yunohost-bot <yunohost@yunohost.org> --------- Co-authored-by: Eauchat <34686393+eauchat@users.noreply.github.com> Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org> Co-authored-by: YunoHost Bot <yunohost-bot@users.noreply.github.com> Co-authored-by: Yunohost-Bot <> Co-authored-by: yunohost-bot <yunohost@yunohost.org> Co-authored-by: yalh76 <yalh@yahoo.com>
2023-04-03 13:57:06 +02:00
WorkingDirectory=__INSTALL_DIR__
Testing (#43) * Small fixes * 1.7.0 (#4) * Upgrde to v.1.7.0 * Set requirements to 3.8.1 * Update README.md * Upgrade to 1.7.1 (#6) * Add limitations * Avoid to buid frontend bundle * Remove PostegrSQL warning * Update README.md Add you should reload service for changes in config to be registered. * Add restart systemd tuto * Change version * Finding an available port * Upgrade to version 1.7.2 (#12) * Patch (#17) * Cleaning up * Update manifest.json * Cleaning up * Secure config file * Remove yarn * Update change_url * Update change_url * Revert "Remove yarn" This reverts commit a8cabf0c0addf8f9c4569b27ae04512db5c93df0. * Update change_url * Update systemd.service * Update systemd.service * Cleaning up * Fix * fix badges * Upgrade to version 1.8.0 (#21) * Upgrade to version 1.8.0 * Upgrade to 1.8.0 * Upgrade to 1.8.0 * Upgrade to version 1.8.1 * [autopatch] Update issue and PR templates (#25) Co-authored-by: Yunohost-Bot <> * Add templates * Upgrade to 1.8.2 * Update check_process * Add templates * Auto-update README * Set new requirements (#28) * Fix * Simplify config * Auto-update README Co-authored-by: Yunohost-Bot <> * Update manifest.json * Auto-update README * 1.9.0 (#31) * 1.9.0 * Update manifest.json * Auto-update README * Systemd hardening (#33) * Update systemd.service * Update app.src * Update manifest.json * 1.9.1 (#34) * Upgrade to 1.9.1 * 1.9.2 (#36) * Remove replace_string * Fix (#39) * Update manifest.json * Auto-update README * Update config.json.example * Update config.json.example * 1.9.3 * Auto-update README * 1.9.4 (#42) * 1.9.4 * Auto-update README Co-authored-by: yunohost-bot <yunohost@yunohost.org> Co-authored-by: Eauchat <34686393+eauchat@users.noreply.github.com> Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org> Co-authored-by: YunoHost Bot <yunohost-bot@users.noreply.github.com> Co-authored-by: Yunohost-Bot <> Co-authored-by: yunohost-bot <yunohost@yunohost.org>
2022-07-12 08:03:31 +02:00
Environment="__YNH_NODE_LOAD_PATH__"
First commit
2020-11-19 21:41:03 +01:00
Environment="NODE_ENV=production"
ExecStart=__YNH_NPM__ start --production
Restart=always
Testing (#32) * Upgrade to version 1.9.0
2021-09-14 07:34:24 +02:00
# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
Testing (#22) * Upgrade to version 1.8.0
2021-04-27 13:48:15 +02:00
ProtectSystem=full
Testing (#32) * Upgrade to version 1.9.0
2021-09-14 07:34:24 +02:00
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
Testing (#22) * Upgrade to version 1.8.0
2021-04-27 13:48:15 +02:00
First commit
2020-11-19 21:41:03 +01:00
[Install]
WantedBy=multi-user.target
Reference in a new issue Copy permalink