YunoHost-Apps/mautrix_discord_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/mautrix_discord_ynh.git synced 2024-09-03 19:36:35 +02:00
Code Issues Activity Actions

Fix

Browse source
This commit is contained in:
oufmilo 2024-02-09 20:32:55 +01:00
parent 575ee412d7
commit a97a1dc2b9
2 changed files with 37 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
conf/systemd.service
View file

@ -11,5 +11,39 @@ ExecStart=__INSTALL_DIR__/mautrix-discord -c __INSTALL_DIR__/config.yaml
Restart=always
RestartSec=3
# Optional hardening to improve security
ReadWritePaths=__INSTALL_DIR__/ /var/log/__APP__
NoNewPrivileges=yes
MemoryDenyWriteExecute=true
PrivateDevices=yes
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=strict
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
LockPersonality=true
ProtectKernelLogs=true
ProtectKernelTunables=true
ProtectHostname=true
ProtectKernelModules=true
PrivateUsers=true
ProtectClock=true
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
[Install]
WantedBy=multi-user.target

6
scripts/restore
View file

@ -54,15 +54,15 @@ ynh_script_progression --message="Restoring system configurations related to $ap
ynh_restore_file --origin_path="/etc/systemd/system/$app.service"
systemctl enable $app.service --quiet
yunohost service add $app --description="Matrix Discord pupetting bridge for YunoHost" --log="/var/log/$app/$app.log"
ynh_restore_file --origin_path="/etc/logrotate.d/$app"
# Use logrotate to manage application logfile(s)
ynh_use_logrotate --logfile "/var/log/$app/$app.log" --nonappend --specific_user $app/$app
mkdir --parents "/var/log/$app"
chmod -R 600 "/var/log/$app"
chmod 700 "/var/log/$app"
chown -R $app:$app /var/log/$app
yunohost service add $app --description="Matrix Discord pupetting bridge for YunoHost" --log="/var/log/$app/$app.log"
#=================================================
# GENERIC FINALIZATION
#=================================================