pytition_ynh/conf/systemd.service

[Unit]
Description=Pytition uWSGI app
Requires=network.target mysql.service
After=network.target mysql.service

[Service]
Type=notify
User=__APP__
Group=__APP__
WorkingDirectory=__FINALPATH__/
RuntimeDirectory=__APP__
ExecStart=uwsgi --yaml __FINALPATH__/uwsgi.yaml --die-on-term

StandardOutput=append:/var/log/__APP__/__APP__.log
StandardError=inherit

# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap

# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG

[Install]
WantedBy=multi-user.target
Add a systemd default file 2017-09-05 17:47:31 +02:00			`[Unit]`
initial script work 2022-04-05 16:15:54 +02:00			`Description=Pytition uWSGI app`
			`Requires=network.target mysql.service`
			`After=network.target mysql.service`
Add a systemd default file 2017-09-05 17:47:31 +02:00
			`[Service]`
initial script work 2022-04-05 16:15:54 +02:00			`Type=notify`
Add a systemd default file 2017-09-05 17:47:31 +02:00			`User=__APP__`
Apply example_ynh 2022-07-29 23:30:24 +02:00			`Group=__APP__`
			`WorkingDirectory=__FINALPATH__/`
initial script work 2022-04-05 16:15:54 +02:00			`RuntimeDirectory=__APP__`
Move the uwsgi config file to the final_path instead of /etc 2022-04-11 17:43:28 +02:00			`ExecStart=uwsgi --yaml __FINALPATH__/uwsgi.yaml --die-on-term`
initial script work 2022-04-05 16:15:54 +02:00
Fix systemd stdout/stderr 2020-12-10 13:46:39 +01:00			`StandardOutput=append:/var/log/__APP__/__APP__.log`
			`StandardError=inherit`
Add a systemd default file 2017-09-05 17:47:31 +02:00
Update systemd.service 2020-11-11 16:02:30 +01:00			`# Sandboxing options to harden security`
initial script work 2022-04-05 16:15:54 +02:00			`# Depending on specificities of your service/app, you may need to tweak these`
Update systemd.service 2020-11-11 16:02:30 +01:00			`# .. but this should be a good baseline`
			`# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html`
			`NoNewPrivileges=yes`
			`PrivateTmp=yes`
			`PrivateDevices=yes`
Add RestrictAddressFamilies and SystemCallFilter 2020-11-11 19:54:27 +01:00			`RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6`
Add RestrictNamespaces=yes 2020-11-11 19:15:01 +01:00			`RestrictNamespaces=yes`
			`RestrictRealtime=yes`
Update systemd.service 2020-11-11 16:02:30 +01:00			`DevicePolicy=closed`
			`ProtectSystem=full`
			`ProtectControlGroups=yes`
			`ProtectKernelModules=yes`
			`ProtectKernelTunables=yes`
			`LockPersonality=yes`
Not sure why but @priviledged is causing issue on some legit services.. 2020-11-11 20:00:58 +01:00			`SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap`
Add RestrictNamespaces=yes 2020-11-11 19:15:01 +01:00
Remove two options that may in fact cause issues ... and add a bunch of CapabilityBoundingSet instructions that should be somewhat sane defaults ? 2020-11-11 18:50:52 +01:00			`# Denying access to capabilities that should not be relevant for webapps`
			`# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html`
			`CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD`
			`CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE`
			`CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT`
			`CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK`
			`CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM`
			`CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG`
			`CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE`
			`CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW`
initial script work 2022-04-05 16:15:54 +02:00			`CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG`
Remove two options that may in fact cause issues ... and add a bunch of CapabilityBoundingSet instructions that should be somewhat sane defaults ? 2020-11-11 18:50:52 +01:00
Add a systemd default file 2017-09-05 17:47:31 +02:00			`[Install]`
			`WantedBy=multi-user.target`