Reimplement Pict-RS from Docker extract

conf/lemmy.hjson

@@ -88,7 +88,7 @@
   # Whether the site is available over TLS. Needs to be true for federation to work.
   tls_enabled: true
   # Address where pictrs is available (for image hosting)
-  ###pictrs_url: "http://127.0.0.1:"
+  pictrs_url: "http://127.0.0.1:__PORT_PICTRS__/"
   slur_filter: "(\bThis\b)|(\bis\b)|(\bsample\b)"
   # Maximum length of local community and user names
   actor_name_max_length: 20

conf/pict-rs.service

@@ -0,0 +1,45 @@
+[Unit]
+Description=Pict-RS: A simple image hosting service for __APP__
+After=network.target
+
+[Service]
+Type=simple
+User=__APP__
+Group=__APP__
+WorkingDirectory=__INSTALL_DIR__/pict-rs/
+ExecStart=__INSTALL_DIR__/pict-rs/pict-rs run -a 127.0.0.1:__PORT_PICTRS__ filesystem -p __DATA_DIR__/pictrs-data sled -p __DATA_DIR__/sled
+StandardOutput=append:/var/log/__APP__/__APP__-pict-rs.log
+StandardError=inherit
+
+# Sandboxing options to harden security
+# Depending on specificities of your service/app, you may need to tweak these 
+# .. but this should be a good baseline
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
+
+# Denying access to capabilities that should not be relevant for webapps
+# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 
+
+[Install]
+WantedBy=multi-user.target

manifest.toml

@@ -48,6 +48,7 @@ ram.runtime = "50M"
     [resources.ports]
     main.default = 8536
     ui.default = 8537
+    pictrs.default = 8080
 
     [resources.system_user]
 
@@ -58,6 +59,10 @@ ram.runtime = "50M"
 
     [resources.permissions]
     main.url = "/"
+    pict-rs.url = "/pictrs"
+    pict-rs.allowed = "visitors"
+    pict-rs.show_tile = false
+    pict-rs.protected = true
 
     [resources.apt]
     packages = "postgresql espeak"

scripts/_common.sh

@@ -5,6 +5,7 @@
 #=================================================
 
 NODEJS_VERSION=18
+PICTRS_VERSION=0.4.0-rc.3
 
 #=================================================
 # PERSONAL HELPERS

scripts/install

@@ -35,6 +35,7 @@ ynh_script_progression --message="Setting up source files..." --weight=1
 ynh_setup_source --dest_dir="$install_dir/build-lemmy/"
 ynh_setup_source --dest_dir="$install_dir/build-lemmy-ui/"
 ynh_setup_source --dest_dir="$install_dir/lemmy-ui/lemmy-translations/" --source_id="lemmy-translations"
+ynh_setup_source --dest_dir="$install_dir/build-pict-rs/"
 
 chmod -R o-rwx "$install_dir"
 chown -R $app:$app "$install_dir"
@@ -68,6 +69,14 @@ mkdir -p "$install_dir/lemmy/"
 mv -f "$install_dir/build-lemmy/output/app/lemmy" "$install_dir/lemmy/lemmy"
 ynh_secure_remove --file="$install_dir/build-lemmy"
 
+# Install pict-rs
+pushd $install_dir/build-pict-rs
+	./docker-image-extract asonix/pictrs:$PICTRS_VERSION
+popd
+mkdir -p "$install_dir/pict-rs/"
+mv -f "$install_dir/build-pict-rs/output/usr/local/bin/pict-rs" "$install_dir/pict-rs/pict-rs"
+ynh_secure_remove --file="$install_dir/build-pict-rs"
+
 chmod 750 "$install_dir"
 chmod -R o-rwx "$install_dir"
 chown -R $app:$app "$install_dir"
@@ -91,6 +100,7 @@ ynh_script_progression --message="Configuring a systemd service..." --weight=1
 # Create a dedicated systemd config
 ynh_add_systemd_config --service="$app" --template="lemmy.service"
 ynh_add_systemd_config --service="$app-ui" --template="lemmy-ui.service"
+ynh_add_systemd_config --service="$app-pict-rs" --template="pict-rs.service"
 
 #=================================================
 # GENERIC FINALIZATION
@@ -114,6 +124,7 @@ ynh_script_progression --message="Integrating service in YunoHost..." --weight=1
 
 yunohost service add $app --log="/var/log/$app/$app.log"
 yunohost service add $app-ui --log="/var/log/$app/$app-ui.log"
+yunohost service add $app-pict-rs --log="/var/log/$app/$app-pict-rs.log"
 
 #=================================================
 # START SYSTEMD SERVICE

scripts/remove

@@ -26,6 +26,11 @@ then
 	ynh_script_progression --message="Removing $app-ui service integration..."
 	yunohost service remove $app-ui
 fi
+if ynh_exec_warn_less yunohost service status $app-pict-rs >/dev/null
+then
+	ynh_script_progression --message="Removing $app-pict-rs service integration..."
+	yunohost service remove $app-pict-rs
+fi
 
 #=================================================
 # STOP AND REMOVE SERVICE
@@ -35,6 +40,7 @@ ynh_script_progression --message="Stopping and removing the systemd service..."
 # Remove the dedicated systemd config
 ynh_remove_systemd_config
 ynh_remove_systemd_config --service=$app-ui
+ynh_remove_systemd_config --service=$app-pict-rs
 
 #=================================================
 # REMOVE LOGROTATE CONFIGURATION
@@ -59,7 +65,7 @@ ynh_script_progression --message="Removing dependencies..." --weight=1
 
 # Remove metapackage and its dependencies
 ynh_remove_nodejs
-ynh_secure_remove --file="/lib/libc.musl-x86_64.so.1"
+#ynh_secure_remove --file="/lib/libc.musl-x86_64.so.1"
 
 #=================================================
 # SPECIFIC REMOVE