YunoHost-Apps/listmonk_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/listmonk_ynh.git synced 2024-09-03 19:36:15 +02:00
Code Issues Activity Actions

Merge pull request #9 from YunoHost-Apps/sysd

Browse source 
Sysd
This commit is contained in:
Navan Chauhan 2022-08-30 12:36:41 -06:00 committed by GitHub
commit c40c537804
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 34 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -18,7 +18,7 @@ If you don't have YunoHost, please consult [the guide](https://yunohost.org/#/in
Listmonk is a standalone, self-hosted, newsletter and mailing list manager. It is fast, feature-rich, and packed into a single binary. It uses a PostgreSQL (⩾ v9.4) database as its data store.
**Shipped version:** 2.2.0~ynh1
**Shipped version:** 2.2.0~ynh2
**Demo:** https://demo.listmonk.app/

2
README_fr.md
View file

@ -18,7 +18,7 @@ Si vous n'avez pas YunoHost, regardez [ici](https://yunohost.org/#/install) pour
Listmonk is a standalone, self-hosted, newsletter and mailing list manager. It is fast, feature-rich, and packed into a single binary. It uses a PostgreSQL (⩾ v9.4) database as its data store.
**Version incluse :** 2.2.0~ynh1
**Version incluse :** 2.2.0~ynh2
**Démo :** https://demo.listmonk.app/

31
conf/systemd.service
View file

@ -1,6 +1,7 @@
[Unit]
Description=Listmonk: newsletter and mailing list manager
Documentation=https://listmonk.app/docs/
After=network.target
[Service]
Type=simple
@ -10,5 +11,35 @@ WorkingDirectory=__FINALPATH__/
ExecStart=__FINALPATH__/listmonk
Restart=always
# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
[Install]
WantedBy=multi-user.target

2
manifest.json
View file

@ -6,7 +6,7 @@
"en": "Newsletter and mailing list manager",
"fr": "Manager de newsletter et mailing list"
},
"version": "2.2.0~ynh1",
"version": "2.2.0~ynh2",
"url": "https://listmonk.app/",
"upstream": {
"license": "AGPL-3.0-only",