Merge c3c456af0c into d54493b8c7

conf/systemd.service

@@ -13,5 +13,39 @@ ExecStart=__YNH_NPM__ start
 TimeoutSec=60
 Restart=always
 
+# Sandboxing options to harden security
+# Depending on specificities of your service/app, you may need to tweak these
+# .. but this should be a good baseline
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallArchitectures=native
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation
+
+# Denying access to capabilities that should not be relevant for webapps
+# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
+
 [Install]
 WantedBy=multi-user.target

manifest.toml

@@ -63,10 +63,5 @@ ram.runtime = "50M"
         "postgresql"
     ]
 
-    [resources.apt.extras.yarn]
-    repo = "deb https://dl.yarnpkg.com/debian/ stable main"
-    key = "https://dl.yarnpkg.com/debian/pubkey.gpg"
-    packages = ["yarn"]
-
     [resources.database]
     type = "postgresql"

scripts/_common.sh

@@ -4,7 +4,7 @@
 # COMMON VARIABLES
 #=================================================
 
-NODEJS_VERSION="16.15.0"
+NODEJS_VERSION="20"
 
 #=================================================
 # PERSONAL HELPERS
@@ -13,9 +13,22 @@ NODEJS_VERSION="16.15.0"
 misskey_build() {
     pushd "$install_dir"
         ynh_use_nodejs
-        ynh_exec_warn_less ynh_exec_as "$app" env "$ynh_node_load_PATH" NODE_ENV=production yarn add ts-node webpack
+        corepack enable
-        ynh_exec_warn_less ynh_exec_as "$app" env "$ynh_node_load_PATH" NODE_ENV=production yarn build
+        ynh_exec_warn_less ynh_exec_as "$app" env "$ynh_node_load_PATH" pnpm install --frozen-lockfile
-        ynh_exec_warn_less ynh_exec_as "$app" env "$ynh_node_load_PATH" NODE_ENV=production yarn run init
+        ynh_exec_warn_less ynh_exec_as "$app" env "$ynh_node_load_PATH" NODE_ENV=production pnpm build
+        ynh_exec_warn_less ynh_exec_as "$app" env "$ynh_node_load_PATH" pnpm run init
+    popd
+
+    ynh_secure_remove --file="$install_dir/.cache"
+}
+
+misskey_upgrade() {
+    pushd "$install_dir"
+        ynh_use_nodejs
+        ynh_exec_warn_less ynh_exec_as "$app" env "$ynh_node_load_PATH" pnpm clean-all
+        ynh_exec_warn_less ynh_exec_as "$app" env "$ynh_node_load_PATH" pnpm install --frozen-lockfile
+        ynh_exec_warn_less ynh_exec_as "$app" env "$ynh_node_load_PATH" NODE_ENV=production pnpm build
+        ynh_exec_warn_less ynh_exec_as "$app" env "$ynh_node_load_PATH" pnpm migrate
     popd
 
     ynh_secure_remove --file="$install_dir/.cache"

scripts/upgrade

@@ -46,7 +46,7 @@ chown -R "$app:www-data" "$install_dir"
 #=================================================
 ynh_script_progression --message="Building app..."
 
-misskey_build
+misskey_upgrade
 
 #=================================================
 # REAPPLY SYSTEM CONFIGURATIONS