YunoHost-Apps/movim_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/movim_ynh.git synced 2024-09-03 19:46:19 +02:00
Code Issues Activity Actions

Merge pull request #60 from YunoHost-Apps/testing

Browse source 
Testing - cleanup
This commit is contained in:
Salamandar 2024-03-24 12:54:35 +01:00 • committed by GitHub
commit 93c2ab55c2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 43 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
conf/systemd.service
View file

@ -1,6 +1,6 @@
[Unit]
Description=Movim: responsive web-based XMPP client
After=nginx.service network.target local-fs.target postgresql.service
After=nginx.service network.target local-fs.target
[Service]
Type=simple
@ -16,5 +16,35 @@ PIDFile=/run/movim.pid
Restart=on-failure
RestartSec=10
# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
[Install]
WantedBy=multi-user.target

4
manifest.toml
View file

@ -23,8 +23,10 @@ cpe = "cpe:2.3:a:movim:movim"
yunohost = ">= 11.2"
architectures = "all"
multi_instance = false
ldap = false
sso = false
sso = true
disk = "50M"
ram.build = "100M"
ram.runtime = "50M"

4
scripts/install
View file

@ -56,9 +56,9 @@ chown "$app:$app" "$install_dir/config/db.inc.php"
ynh_script_progression --message="Building Movim..."
# Install composer
ynh_exec_warn_less ynh_install_composer --phpversion="$phpversion" --workdir="$install_dir"
ynh_install_composer
ynh_exec_warn_less ynh_composer_exec --phpversion="$phpversion" --workdir="$install_dir" --commands="movim:migrate"
ynh_exec_warn_less ynh_composer_exec --commands="movim:migrate"
ynh_exec_as "$app" "php$phpversion" "$install_dir/daemon.php" config --username="$admin" --password="$password" --quiet
#=================================================

13
scripts/upgrade
View file

@ -54,7 +54,7 @@ chown -R "$app:www-data" "$install_dir"
#=================================================
# UPDATE A CONFIG FILE
#=================================================
ynh_script_progression --message="Updating $ap's configuration file..."
ynh_script_progression --message="Updating $app's configuration file..."
ynh_add_config --template="db.example.inc.php" --destination="$install_dir/config/db.inc.php"
@ -66,10 +66,11 @@ chown "$app:$app" "$install_dir/config/db.inc.php"
#=================================================
ynh_script_progression --message="Building Movim..."
ynh_exec_warn_less ynh_install_composer --phpversion="$phpversion" --workdir="$install_dir"
ynh_exec_warn_less ynh_composer_exec --phpversion="$phpversion" --workdir="$install_dir" --commands="config --global discard-changes true --quiet"
ynh_exec_warn_less ynh_composer_exec --phpversion="$phpversion" --workdir="$install_dir" --commands="update --no-interaction --quiet"
ynh_exec_warn_less ynh_composer_exec --phpversion="$phpversion" --workdir="$install_dir" --commands="movim:migrate --quiet"
ynh_exec_warn_less ynh_install_composer
ynh_exec_warn_less ynh_composer_exec --commands="config --global discard-changes true --quiet"
ynh_exec_warn_less ynh_composer_exec --commands="update --no-interaction --quiet"
ynh_exec_warn_less ynh_composer_exec --commands="movim:migrate --quiet"
#=================================================
# REAPPLY SYSTEM CONFIGURATIONS
@ -77,7 +78,7 @@ ynh_exec_warn_less ynh_composer_exec --phpversion="$phpversion" --workdir="$inst
ynh_script_progression --message="Upgrading system configurations related to $app..." --weight=1
# Create a dedicated PHP-FPM config
ynh_add_fpm_config --phpversion="$phpversion" --usage="$fpm_usage" --footprint="$fpm_footprint"
ynh_add_fpm_config --usage="$fpm_usage" --footprint="$fpm_footprint"
# Create a dedicated NGINX config
ynh_add_nginx_config