paperless-ngx_ynh/conf/systemd-consumer.service

[Unit]
Description=Paperless consumer
Requires=redis.service

[Service]
Type=simple
User=__APP__
Group=__APP__
Environment=PATH=__LOCAL_PATH__
WorkingDirectory=__INSTALL_DIR__/src/
ExecStart=__INSTALL_DIR__/venv/bin/python3 manage.py document_consumer
StandardOutput=append:/var/log/__APP__/__APP__-consumer.log
StandardError=inherit

# Sandboxing options to harden security
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap

# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 

[Install]
WantedBy=multi-user.target
Update to 1.9.2 2022-12-30 12:24:18 +01:00			`[Unit]`
Update to 1.11.0 2022-12-30 19:30:56 +01:00			`Description=Paperless consumer`
Update to 1.9.2 2022-12-30 12:24:18 +01:00			`Requires=redis.service`

			`[Service]`
			`Type=simple`
			`User=__APP__`
			`Group=__APP__`
Include built gs in Environment 2024-02-12 19:38:29 +01:00			`Environment=PATH=__LOCAL_PATH__`
Convert to packaging v2 (#23) * convert to v2 * v2 * Use /opt/yunohost/__APP__ * v2 * v2 * Auto-update README * fix * v2 * v2 * v2 * v2 * Auto-update README * v2 * typo * set redis_db in restore script * fix api permissions * linter please * Fix api access --------- Co-authored-by: yunohost-bot <yunohost@yunohost.org> Co-authored-by: Fabian Wilkens <46000361+FabianWilkens@users.noreply.github.com> 2023-05-28 20:21:14 +02:00			`WorkingDirectory=__INSTALL_DIR__/src/`
			`ExecStart=__INSTALL_DIR__/venv/bin/python3 manage.py document_consumer`
Update to 1.11.0 2022-12-30 19:30:56 +01:00			`StandardOutput=append:/var/log/__APP__/__APP__-consumer.log`
Update to 1.9.2 2022-12-30 12:24:18 +01:00			`StandardError=inherit`

			`# Sandboxing options to harden security`
			`# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html`
			`NoNewPrivileges=yes`
			`PrivateTmp=yes`
			`PrivateDevices=yes`
			`RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6`
			`RestrictNamespaces=yes`
			`RestrictRealtime=yes`
			`DevicePolicy=closed`
			`ProtectSystem=full`
			`ProtectControlGroups=yes`
			`ProtectKernelModules=yes`
			`ProtectKernelTunables=yes`
			`LockPersonality=yes`
			`SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap`

			`# Denying access to capabilities that should not be relevant for webapps`
			`# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html`
			`CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD`
			`CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE`
			`CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT`
			`CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK`
			`CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM`
			`CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG`
			`CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE`
			`CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW`
			`CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG`

			`[Install]`
			`WantedBy=multi-user.target`