From f7a2c2c1dc1a40c1ec090d0a934d5dc385206a3a Mon Sep 17 00:00:00 2001 From: tituspijean Date: Tue, 8 Aug 2023 20:55:58 +0200 Subject: [PATCH] Deploy ImageMagick's AppImage --- conf/pict-rs.service | 44 ++++++++++++++++++++++---------------------- scripts/_common.sh | 30 ++++++++++++++++++++++++++++++ scripts/install | 6 ++---- scripts/upgrade | 7 ++----- 4 files changed, 56 insertions(+), 31 deletions(-) diff --git a/conf/pict-rs.service b/conf/pict-rs.service index 3ab017b..90785ba 100644 --- a/conf/pict-rs.service +++ b/conf/pict-rs.service @@ -16,31 +16,31 @@ StandardError=inherit # Depending on specificities of your service/app, you may need to tweak these # .. but this should be a good baseline # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html -#NoNewPrivileges=yes -#PrivateTmp=yes -#PrivateDevices=yes -#RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -#RestrictNamespaces=yes -#RestrictRealtime=yes -#DevicePolicy=closed -#ProtectSystem=full -#ProtectControlGroups=yes -#ProtectKernelModules=yes -#ProtectKernelTunables=yes -#LockPersonality=yes -#SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap # Denying access to capabilities that should not be relevant for webapps # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html -#CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD -#CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE -#CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT -#CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK -#CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM -#CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG -#CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE -#CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW -#CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG [Install] WantedBy=multi-user.target diff --git a/scripts/_common.sh b/scripts/_common.sh index 1cced56..9dc29f7 100644 --- a/scripts/_common.sh +++ b/scripts/_common.sh @@ -16,6 +16,36 @@ NODEJS_VERSION=20 # EXPERIMENTAL HELPERS #================================================= +# Downloads an AppImage from an url, unpacks and extracts it in a destination directory, and creates a symlink to its executable +download_and_install_appimage() { + + # Declare an array to define the options of this helper. + local legacy_args=nud + local -A args_array=([n]=name= [u]=url= [d]=directory= [s]=symlink=) + local url + local directory + local name + # Manage arguments with getopts + ynh_handle_getopts_args "$@" + + # Cleanup + ynh_secure_remove --file="$install_dir/pict-rs/$name" + ynh_secure_remove --file="$install_dir/pict-rs/$name.appimage" + ynh_secure_remove --file="$install_dir/pict-rs/$name.appimageextract" + + # Download and make executable + curl -f "$url" -o "$directory/$name.appimage" -s + [ ! -f "$directory/$name.appimage" ] && ynh_print_err --message="AppImage could not be downloaded" + chmod +x "$directory/$name.appimage" + + # Extract and create link + pushd "$directory" + "$directory/$name.appimage" --appimage-extract + mv "$directory/squashfs-root" "$directory/$name.appimageextract" + ln -s "$directory/$name.appimageextract/AppRun" "$directory/$name" + popd +} + #================================================= # FUTURE OFFICIAL HELPERS #================================================= diff --git a/scripts/install b/scripts/install index a0506f4..6262d04 100755 --- a/scripts/install +++ b/scripts/install @@ -91,10 +91,8 @@ chown -R $app:$app "$install_dir" # (Dirty) Install ImageMagick # Requires 'libfuse2' and 'libimage-exiftool-perl' apt dependencies -curl -f https://imagemagick.org/archive/binaries/magick -o "$install_dir/pict-rs/magick" -s -[ ! -f "$install_dir/pict-rs/magick" ] && ynh_print_err --message="ImageMagick could not be downloaded" -chmod 750 "$install_dir/pict-rs/magick" -chown $app:$app "$install_dir/pict-rs/magick" +ynh_script_progression --message="Downloading and installing ImageMagick..." --weight=1 +download_and_install_appimage --name="magick" --url="https://imagemagick.org/archive/binaries/magick" --directory="$install_dir/pict-rs" --symlink="$install_dir/pict-rs/magick" #================================================= # ADD A CONFIGURATION diff --git a/scripts/upgrade b/scripts/upgrade index 18fb23b..48c0c12 100644 --- a/scripts/upgrade +++ b/scripts/upgrade @@ -130,11 +130,8 @@ then # (Dirty) Install ImageMagick # Requires 'libfuse2' and 'libimage-exiftool-perl' apt dependencies - curl -f https://imagemagick.org/archive/binaries/magick -o "$install_dir/pict-rs/magick" -s - [ ! -f "$install_dir/pict-rs/magick" ] && ynh_print_err --message="ImageMagick could not be downloaded" - chmod 750 "$install_dir/pict-rs/magick" - chown $app:$app "$install_dir/pict-rs/magick" - + ynh_script_progression --message="Downloading and installing ImageMagick..." --weight=1 + download_and_install_appimage --name="magick" --url="https://imagemagick.org/archive/binaries/magick" --directory="$install_dir/pict-rs" --symlink="$install_dir/pict-rs/magick" fi chmod 750 "$install_dir"