lufi_ynh/conf/systemd.service

[Unit]
Description=Lufi: image hosting and sharing service
Documentation=https://framagit.org/luc/lufi/wikis/home
Requires=network.target
After=network.target

[Service]
Type=forking
User=__APP__
Group=__APP__
WorkingDirectory=__INSTALL_DIR__/
PIDFile=__INSTALL_DIR__/script/hypnotoad.pid
ExecStart=/usr/bin/carton exec hypnotoad script/lufi
ExecStop=/usr/bin/carton exec hypnotoad -s script/lufi
ExecReload=/usr/bin/carton exec hypnotoad script/lufi

# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap

# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG

[Install]
WantedBy=multi-user.target
Create lufi.service 2017-02-07 22:33:48 +01:00			`[Unit]`
Testing (#80) * Small fixs * Auto-update README * Version 2 (#79) * v2 * Auto-update README * v2 * Auto-update README * fix * Update install * Update systemd.service * fix * fix * fix * fix * Update manifest.toml * cleaning * Update config_panel.toml --------- Co-authored-by: yunohost-bot <yunohost@yunohost.org> * Delete check_process --------- Co-authored-by: yunohost-bot <yunohost@yunohost.org> 2023-04-21 19:11:39 +02:00			`Description=Lufi: image hosting and sharing service`
Point lufi wiki as documentation source 2017-04-03 10:24:50 +02:00			`Documentation=https://framagit.org/luc/lufi/wikis/home`
Create lufi.service 2017-02-07 22:33:48 +01:00			`Requires=network.target`
			`After=network.target`

			`[Service]`
systemd service type should be "forking" ? 2020-04-25 16:50:32 +02:00			`Type=forking`
Update lufi.service 2018-09-02 10:31:11 +02:00			`User=__APP__`
			`Group=__APP__`
Testing (#80) * Small fixs * Auto-update README * Version 2 (#79) * v2 * Auto-update README * v2 * Auto-update README * fix * Update install * Update systemd.service * fix * fix * fix * fix * Update manifest.toml * cleaning * Update config_panel.toml --------- Co-authored-by: yunohost-bot <yunohost@yunohost.org> * Delete check_process --------- Co-authored-by: yunohost-bot <yunohost@yunohost.org> 2023-04-21 19:11:39 +02:00			`WorkingDirectory=__INSTALL_DIR__/`
			`PIDFile=__INSTALL_DIR__/script/hypnotoad.pid`
Testing (#48) * Upgrade to v.0.05.9 * [fix] Chromium net::ERR_HTTP2_PROTOCOL_ERROR 200 Co-authored-by: ljf (zamentur) <zamentur@users.noreply.github.com> Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org> 2020-12-19 11:11:56 +01:00			`ExecStart=/usr/bin/carton exec hypnotoad script/lufi`
			`ExecStop=/usr/bin/carton exec hypnotoad -s script/lufi`
			`ExecReload=/usr/bin/carton exec hypnotoad script/lufi`
Create lufi.service 2017-02-07 22:33:48 +01:00
Testing (#80) * Small fixs * Auto-update README * Version 2 (#79) * v2 * Auto-update README * v2 * Auto-update README * fix * Update install * Update systemd.service * fix * fix * fix * fix * Update manifest.toml * cleaning * Update config_panel.toml --------- Co-authored-by: yunohost-bot <yunohost@yunohost.org> * Delete check_process --------- Co-authored-by: yunohost-bot <yunohost@yunohost.org> 2023-04-21 19:11:39 +02:00			`# Sandboxing options to harden security`
			`# Depending on specificities of your service/app, you may need to tweak these`
			`# .. but this should be a good baseline`
			`# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html`
			`NoNewPrivileges=yes`
			`PrivateTmp=yes`
			`PrivateDevices=yes`
			`RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK`
			`RestrictNamespaces=yes`
			`RestrictRealtime=yes`
			`DevicePolicy=closed`
			`ProtectSystem=full`
			`ProtectControlGroups=yes`
			`ProtectKernelModules=yes`
			`ProtectKernelTunables=yes`
			`LockPersonality=yes`
			`SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap`

			`# Denying access to capabilities that should not be relevant for webapps`
			`# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html`
			`CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD`
			`CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE`
			`CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT`
			`CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK`
			`CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM`
			`CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG`
			`CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE`
			`CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW`
			`CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG`

Create lufi.service 2017-02-07 22:33:48 +01:00			`[Install]`
Point lufi wiki as documentation source 2017-04-03 10:24:50 +02:00			`WantedBy=multi-user.target`