[Unit] Description=AI-Powered Photos App for the Decentralized Web After=network.target [Service] Type=simple User=__APP__ Group=__APP__ # Have all filesystem look like invisible for the service TemporaryFileSystem=/:ro # Manually mount what is needed for the service to run # Ref: https://www.sherbers.de/use-temporaryfilesystem-to-hide-files-or-directories-from-systemd-services/ BindReadOnlyPaths=-/lib/ -/lib64/ -/usr/lib/ -/usr/lib64/ -/etc/ld.so.cache -/etc/ld.so.conf -/etc/ld.so.conf.d/ -/etc/bindresvport.blacklist -/usr/share/zoneinfo/ -/usr/share/locale/ -/etc/localtime -/usr/share/common-licenses/ -/etc/ssl/certs/ -/etc/alternatives/ BindReadOnlyPaths=-/dev/log -/run/systemd/journal/socket -/run/systemd/journal/stdout -/run/systemd/notify BindPaths=/var/www/photoprism /var/www/photoprism/live/bin /home/yunohost.app/photoprism -/usr -/etc -/var -/home -/dev -/etc -/media -/mnt -/opt -/proc -/run -/srv -/sys -/tmp EnvironmentFile=__INSTALL_DIR__/.env WorkingDirectory=__INSTALL_DIR__/live/bin ExecStart=__INSTALL_DIR__/live/bin/photoprism --trace start StandardOutput=append:/var/log/__APP__/__APP__.log StandardError=inherit TimeoutSec=900 # Sandboxing options to harden security # Depending on specificities of your service/app, you may need to tweak these # .. but this should be a good baseline # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html NoNewPrivileges=yes PrivateTmp=yes PrivateDevices=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 RestrictNamespaces=yes RestrictRealtime=yes DevicePolicy=closed ProtectSystem=full ProtectControlGroups=yes ProtectKernelModules=yes ProtectKernelTunables=yes LockPersonality=yes SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap # Denying access to capabilities that should not be relevant for webapps # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG [Install] WantedBy=multi-user.target