YunoHost-Apps/mattermost_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/mattermost_ynh.git synced 2024-09-03 19:36:29 +02:00
Code Issues Activity Actions
mattermost_ynh/conf/systemd.service
eric_G 0f5db1d1d9
Testing (#435) 
* scripts: reduce pgloader's prefetched columns 

This helps fixing stack overflow errors on large
databases.

* scripts: increase the migration timeout again

It seems to be too short on some lesser-powered VMs.

* Update manifest.json

* Auto-update README

* [autopatch] Fix Host and X-Forwarded-For header spoofing

* conf: upgrade to Mattermost ESR 8.1.1 (#431)

https://docs.mattermost.com/install/self-managed-changelog.html#release-v8-1-extended-support-release

* Packaging format v2 (#406)

* backup script for PostgreSQL (#376)

Inspired from https://github.com/YunoHost-Apps/moodle_ynh/blob/master/scripts/backup

* Adapt to PostgreSQL (#375)

Question: in https://docs.mattermost.com/install/install-debian.html#install-postgresql-database-server, I see `BindsTo=postgresql.service` while in the original file here I find `Requires=mysql.service`. I don't know which one makes sense, so I keep the orinigal Yunohost version (Requires)

* config.json for PostgreSQL (#374)

Inspired from the original MySQL config.json and from Mattermost documentation https://docs.mattermost.com/install/install-debian.html#install-postgresql-database-server

* Install with PostgreSQL (#373)

I took inspiration from https://github.com/YunoHost-Apps/commento_ynh/blob/master/scripts/install

* install postgresql

* Reordering

* reset config file

* Update _common.sh

* Update config.json

* Fix

* Migration (#382)

* add migration

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Fix

* Fix

* Fix

* Update install

* Update upgrade

* Fix

* Update install

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update install

* Fix

* Fix

* Fix

* Update upgrade

* Cleaning up

* Update upgrade

* Update _common.sh

* Update check_process

* Update _common.sh

* Fix

* Update mysql-to-pg.conf

* Update upgrade

* Update systemd.service

* Cleaning

* Update _common.sh

* Fix

* Update upgrade

* Update _common.sh

* Update upgrade

* Update backup

* Fix

* Fix

* Update upgrade

* Update upgrade

* Update systemd.service

* Update _common.sh

* Revert "Update _common.sh"

This reverts commit d880150af9.

* Cleaning

* Fix

* Update check_process

* Fix

* Update _common.sh

* Fix

* Update _common.sh

* Fix

* Update manifest.json

* Update install

* Update _common.sh

* Update upgrade

* Fix

* Update _common.sh

* Update _common.sh

* Update _common.sh

* Update _common.sh

* Update _common.sh

* Update _common.sh

* Update _common.sh

* Update _common.sh

* Auto-update README

* Update _common.sh

* Upgrade to v7.4.0

* Auto-update README

* Upgrade to v7.5.2

* Auto-update README

* Update config.json

* [fix] mariadb to postgres migration

* Auto-update README

* [fix] Update manifest requirements

* Update manifest.json

* Update config.json

* upgrade config to upstream

* Fix linter

* Update _common.sh

* v2

* Fix

* Auto-update README

* Fix

* Auto-update README

* Update upgrade

* Fix

* Cleaning

* add apt

* Auto-update README

* cleaning

* fix data path var

* fix

* Auto-update README

* Update backup

* add more apt

* Update manifest.toml

* Update tests.toml

* Fix

* Update _common.sh

* Update upgrade

* Update restore

* Update remove

* cleaning

* Update install

* Update upgrade

* Update upgrade

* Update upgrade

* Update upgrade

* Update manifest.toml

* 7.7.1

* Update manifest.json

* Auto-update README

* Update config.json

* Auto-update README

* cleaning

* Auto-update README

* Update ADMIN.md

* Update ADMIN_fr.md

* fix

* Delete check_process

* 7.8.1

* Auto-update README

* Auto-update README

* Update manifest.toml

* Auto-update README

* fix migration from 7.3.0

* Update manifest.toml

* fix migration from 7.3.0

* cleaning

* Update manifest.toml

* src

* Update upgrade

* Update upgrade

* Update tests.toml

* remove src

* 7.9.1

* Auto-update README

* Update config.json

* Update doc/DESCRIPTION.md

Co-authored-by: Pierre de La Morinerie <kemenaran@gmail.com>

* Auto-update README

* Update tests.toml

Co-authored-by: Pierre de La Morinerie <kemenaran@gmail.com>

* Update manifest.toml

Co-authored-by: Pierre de La Morinerie <kemenaran@gmail.com>

* Update manifest.toml

Co-authored-by: Pierre de La Morinerie <kemenaran@gmail.com>

* Update upgrade

* Update install

* Update DESCRIPTION_fr.md

* Auto-update README

* Update _common.sh

* Update manifest.toml

* Update manifest.toml

* Auto-update README

* Update manifest.toml

* Update upgrade

* Update manifest.toml

* Auto-update README

* cleaning

* Auto-update README

* Update nginx.conf

* Update manifest.toml

* Auto-update README

* cleaning

* Update doc/ADMIN.md

Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org>

* Update doc/ADMIN_fr.md

Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org>

* 8.0.0

* Auto-update README

* Update manifest.toml

* Auto-update README

* 8.1.0

* Auto-update README

* Update upgrade

* Update tests.toml

* Update tests.toml

* Update _common.sh

* Update manifest.toml

Co-authored-by: Pierre de La Morinerie <kemenaran@gmail.com>

* Update manifest.toml

Co-authored-by: Pierre de La Morinerie <kemenaran@gmail.com>

* Update manifest.toml

Co-authored-by: Pierre de La Morinerie <kemenaran@gmail.com>

* Update tests.toml

Co-authored-by: Pierre de La Morinerie <kemenaran@gmail.com>

* Update manifest.toml

* DEBUG: see if other migrations pass (#430)

* Update manifest.toml

* Auto-update README

* Revert "DEBUG: see if other migrations pass (#430)"

This reverts commit 8532bd3ba2.

* Update tests.toml

* scripts: fix MySQL migration

The PostgreSQL database has already been created,
no need to create it manually.

* scripts: improve DB migration comment

* Update config.json

* Update tests.toml

* Fix v2 database deletion on error (#434)

* scripts: improve comments

* scripts: manually remove MariaDB database if needed

---------

Co-authored-by: biva <biva@users.noreply.github.com>
Co-authored-by: yunohost-bot <yunohost@yunohost.org>
Co-authored-by: yunohost-bot <yunohost-bot@users.noreply.github.com>
Co-authored-by: ljf <ljf+git@grimaud.me>
Co-authored-by: Kay0u <pierre@kayou.io>
Co-authored-by: Pierre de La Morinerie <kemenaran@gmail.com>
Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org>

* Update manifest.toml

* Auto-update README

* Update manifest.toml

* Auto-update README

---------

Co-authored-by: Pierre de La Morinerie <kemenaran@gmail.com>
Co-authored-by: yunohost-bot <yunohost@yunohost.org>
Co-authored-by: tituspijean <titus+yunohost@pijean.ovh>
Co-authored-by: biva <biva@users.noreply.github.com>
Co-authored-by: yunohost-bot <yunohost-bot@users.noreply.github.com>
Co-authored-by: ljf <ljf+git@grimaud.me>
Co-authored-by: Kay0u <pierre@kayou.io>
Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org>
2023-09-11 21:36:20 +02:00

49 lines
1.6 KiB
Desktop File
Raw Blame History

[Unit]
Description=Mattermost: collaboration platform
After=network.target
Requires=postgresql.service
[Service]
Type=notify
User=__APP__
Group=__APP__
ExecStart=__INSTALL_DIR__/bin/mattermost
TimeoutStartSec=3600
Restart=always
RestartSec=10
WorkingDirectory=__INSTALL_DIR__
RuntimeDirectory=__APP__
LimitNOFILE=49152
# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
[Install]
WantedBy=multi-user.target
Reference in a new issue View git blame Copy permalink