YunoHost-Apps/mautrix_discord_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/mautrix_discord_ynh.git synced 2024-09-03 19:36:35 +02:00
Code Issues Activity Actions

Test

Browse source
This commit is contained in:
oufmilo 2024-02-09 18:42:00 +01:00
parent 241888b144
commit e1db88eb9b
3 changed files with 0 additions and 45 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
conf/systemd.service
View file

@ -11,43 +11,5 @@ ExecStart=__INSTALL_DIR__/mautrix-discord -c __INSTALL_DIR__/config.yaml
Restart=always
RestartSec=3
# Optional hardening to improve security
ReadWritePaths=__INSTALL_DIR__/ /var/log/__APP__
NoNewPrivileges=yes
MemoryDenyWriteExecute=true
PrivateDevices=yes
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=strict
ProtectControlGroups=true
RestrictNamespaces=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
ProtectProc=invisible
DevicePolicy=closed
RestrictSUIDSGID=true
RestrictRealtime=true
LockPersonality=true
ProtectKernelLogs=true
ProtectKernelTunables=true
ProtectHostname=true
ProtectKernelModules=true
PrivateUsers=true
ProtectClock=true
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
[Install]
WantedBy=multi-user.target

6
scripts/backup
View file

@ -35,12 +35,6 @@ ynh_backup --src_path="/etc/logrotate.d/$app"
ynh_backup --src_path="/etc/systemd/system/$app.service"
#=================================================
# BACKUP CONFIG FILE
#=================================================
ynh_backup --src_path="$install_dir/mautrix-discord"
#=================================================
# BACKUP THE POSTGRESQL DATABASE
#=================================================

1
scripts/restore
View file

@ -57,7 +57,6 @@ systemctl enable $app.service --quiet
yunohost service add $app --description="Matrix Discord pupetting bridge for YunoHost" --log="/var/log/$app/$app.log"
ynh_restore_file --origin_path="/etc/logrotate.d/$app"
ynh_restore_file --origin_path="$install_dir/mautrix-discord"
#=================================================
# GENERIC FINALIZATION