YunoHost-Apps/listmonk_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/listmonk_ynh.git synced 2024-09-03 19:36:15 +02:00
Code Issues Activity Actions

Merge branch 'testing' into actualfix

Browse source
This commit is contained in:
Navan Chauhan 2023-01-19 19:03:54 -07:00 committed by GitHub
commit fd326cd28a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 45 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
conf/amd64.src
View file

@ -1,4 +1,4 @@
SOURCE_URL=https://github.com/knadh/listmonk/releases/download/v2.2.0/listmonk_2.3.0_linux_amd64.tar.gz
SOURCE_URL=https://github.com/knadh/listmonk/releases/download/v2.3.0/listmonk_2.3.0_linux_amd64.tar.gz
SOURCE_SUM=4ad9ff7a04e13c9f8609c705e4850046ae8a3c9a03b0c4ac04e3c1d1c8fe8b7a
SOURCE_SUM_PRG=sha256sum
SOURCE_FORMAT=tar.gz

4
conf/config.toml
View file

@ -9,8 +9,8 @@ address = "127.0.0.1:__PORT__"
# be replaced with a better multi-user, role-based authentication system.
# IMPORTANT: Leave both values empty to disable authentication on admin
# only where an external authentication is already setup.
admin_username = "__ADMIN__"
admin_password = "__PASSWORD__"
admin_username = ""
admin_password = ""
# Database.
[db]

30
conf/systemd.service
View file

@ -14,5 +14,35 @@ ExecStartPre=__FINALPATH__/listmonk --config __FINALPATH__/config.toml --upgrade
ExecStart=__FINALPATH__/listmonk
Restart=always
# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
[Install]
WantedBy=multi-user.target

13
scripts/upgrade
View file

@ -89,6 +89,18 @@ then
ynh_permission_create --permission="api" --url="/public" --additional_urls="/api/public" --allowed="visitors" --show_tile="false" --protected="true"
fi
if ynh_compare_current_package_version --comparison le --version 2.3.0~ynh1
then
mkdir -p "$final_path/uploads"
ynh_permission_delete --permission="admin"
ynh_permission_delete --permission="api"
ynh_permission_create --permission="admin" --url="/admin" --additional_urls="/admin /api" --allowed=$admin --auth_header=false
ynh_permission_create --permission="api" --url="/public" --additional_urls="/api/public" --allowed="visitors" --show_tile="false" --protected="true"
fi
#=================================================
# CREATE DEDICATED USER
#=================================================
@ -104,7 +116,6 @@ ynh_system_user_create --username=$app --home_dir="$final_path"
if [ "$upgrade_type" == "UPGRADE_APP" ]
then
ynh_script_progression --message="Upgrading source files..." --weight=5
# Download, check integrity, uncompress and patch the source from app.src
if [ $YNH_ARCH == "armhf" ] || [ $YNH_ARCH == "arm64" ]
then