mirror of
https://github.com/YunoHost-Apps/scrumblr_ynh.git
synced 2024-09-03 20:16:29 +02:00
update conf files
This commit is contained in:
Tobias Ollive
parent
cedccc2cc3
commit
6c57afcc11
8 changed files with 72 additions and 64 deletions
|
|
@ -100,7 +100,7 @@ tcp-keepalive 300
|
|||
|
||||
# By default Redis does not run as a daemon. Use 'yes' if you need it.
|
||||
# Note that Redis will write a pid file in /var/run/redis.pid when daemonized.
|
||||
daemonize yes
|
||||
daemonize no
|
||||
|
||||
# If you run Redis from upstart or systemd, Redis can interact with your
|
||||
# supervision tree. Options:
|
||||
|
|
@ -122,7 +122,7 @@ supervised no
|
|||
#
|
||||
# Creating a pid file is best effort: if Redis is not able to create it
|
||||
# nothing bad happens, the server will start and run normally.
|
||||
pidfile /var/run/redis/redis-server__REDIS_PORT__.pid
|
||||
pidfile __FINAL_PATH__/redis-server-__REDIS_PORT__.pid
|
||||
|
||||
# Specify the server verbosity level.
|
||||
# This can be one of:
|
||||
|
|
@ -135,7 +135,7 @@ loglevel notice
|
|||
# Specify the log file name. Also the empty string can be used to force
|
||||
# Redis to log on the standard output. Note that if you use standard
|
||||
# output for logging but daemonize, logs will be sent to /dev/null
|
||||
logfile /var/log/redis/redis-server-__REDIS_PORT__.log
|
||||
logfile /var/log/__APP__/redis-__REDIS_PORT__.log
|
||||
|
||||
# Set the number of databases. The default database is DB 0, you can select
|
||||
# a different one on a per-connection basis using SELECT <dbid> where
|
||||
|
|
|
|||
|
|
@ -7,41 +7,32 @@ Type=simple
|
|||
User=__APP__
|
||||
Group=__APP__
|
||||
WorkingDirectory=__FINALPATH__/
|
||||
ExecStart=redis-server redis.conf
|
||||
StandardOutput=syslog
|
||||
StandardError=syslog
|
||||
SyslogIdentifier=redis-__APP__
|
||||
ExecStart=/usr/bin/redis-server __FINALPATH__/redis.conf
|
||||
ExecStop=/bin/kill -s TERM $MAINPID
|
||||
PIDFile=__FINALPATH__/redis-server-__PORT__.pid
|
||||
TimeoutStopSec=0
|
||||
Restart=always
|
||||
|
||||
# Sandboxing options to harden security
|
||||
# Depending on specificities of your service/app, you may need to tweak these
|
||||
# .. but this should be a good baseline
|
||||
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
|
||||
NoNewPrivileges=yes
|
||||
UMask=007
|
||||
PrivateTmp=yes
|
||||
LimitNOFILE=65535
|
||||
PrivateDevices=yes
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||
RestrictNamespaces=yes
|
||||
RestrictRealtime=yes
|
||||
DevicePolicy=closed
|
||||
ProtectSystem=full
|
||||
ProtectControlGroups=yes
|
||||
ProtectKernelModules=yes
|
||||
ProtectKernelTunables=yes
|
||||
LockPersonality=yes
|
||||
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
|
||||
ProtectHome=yes
|
||||
#ReadOnlyDirectories=/
|
||||
ReadWriteDirectories=-/var/lib/__APP__
|
||||
ReadWriteDirectories=-/var/log/__APP__
|
||||
ReadWriteDirectories=-__FINALPATH__
|
||||
|
||||
NoNewPrivileges=true
|
||||
CapabilityBoundingSet=CAP_SETGID CAP_SETUID CAP_SYS_RESOURCE
|
||||
MemoryDenyWriteExecute=true
|
||||
ProtectKernelModules=true
|
||||
ProtectControlGroups=true
|
||||
RestrictRealtime=true
|
||||
RestrictNamespaces=true
|
||||
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
||||
|
||||
|
||||
# Denying access to capabilities that should not be relevant for webapps
|
||||
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
|
||||
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
|
||||
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
|
||||
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
|
||||
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
|
||||
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
|
||||
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
|
||||
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
|
||||
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
|
||||
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
[Unit]
|
||||
Description=Scrumblr: software to take note.
|
||||
After=network.target
|
||||
Requires=redis-__APP__.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
|
|
@ -9,7 +9,7 @@ Group=__APP__
|
|||
WorkingDirectory=__FINALPATH__
|
||||
Environment="PATH=_PATH__"
|
||||
Environment="NODE_ENV=production"
|
||||
ExecStart=__YNH_NODE__ server.js --port=__PORT__ --baseurl=__PATH__ --redis localhot:__REDIS_PORT__
|
||||
ExecStart=__YNH_NODE__ server.js --port=__PORT__ --baseurl=__PATH__ --redis localhost:__REDIS_PORT__
|
||||
Restart=always
|
||||
|
||||
# Sandboxing options to harden security
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@ app=$YNH_APP_INSTANCE_NAME
|
|||
|
||||
final_path=$(ynh_app_setting_get --app=$app --key=final_path)
|
||||
domain=$(ynh_app_setting_get --app=$app --key=domain)
|
||||
db_name=$(ynh_app_setting_get --app=$app --key=db_name)
|
||||
redis_port=$(ynh_app_setting_get --app=$app --key=redis_port)
|
||||
codename=$(ynh_app_setting_get $app codename)
|
||||
|
||||
#=================================================
|
||||
|
|
@ -38,6 +38,13 @@ codename=$(ynh_app_setting_get $app codename)
|
|||
#=================================================
|
||||
ynh_print_info --message="Declaring files to be backed up..."
|
||||
|
||||
|
||||
#=================================================
|
||||
# EXPORT DATABASE
|
||||
#=================================================
|
||||
|
||||
redis-cli --rdb "$final_path/redis-$app.rdb" -p $redis_port
|
||||
|
||||
#=================================================
|
||||
# BACKUP THE APP MAIN DIR
|
||||
#=================================================
|
||||
|
|
@ -63,6 +70,7 @@ ynh_backup --src_path="/etc/logrotate.d/$app"
|
|||
#=================================================
|
||||
|
||||
ynh_backup --src_path="/etc/systemd/system/$app.service"
|
||||
ynh_backup --src_path="/etc/systemd/system/redis-$app.service"
|
||||
|
||||
#=================================================
|
||||
# END OF SCRIPT
|
||||
|
|
|
|||
|
|
@ -59,21 +59,6 @@ ynh_script_progression --message="Finding an available port..." --weight=1
|
|||
port=$(ynh_find_port --port=8080)
|
||||
ynh_app_setting_set --app=$app --key=port --value=$port
|
||||
|
||||
#==================================================
|
||||
# CONFIGURE REDIS SERVICE
|
||||
#==================================================
|
||||
|
||||
ynh_install_app_dependencies redis-server redis-tools
|
||||
|
||||
# Find an available port for redis
|
||||
redis_port=$(ynh_find_port --port=8081)
|
||||
ynh_app_setting_set --app=$app --key=redis_port --value=$redis_port
|
||||
|
||||
ynh_add_config --template="redis.conf" --destination="$final_path/redis.conf"
|
||||
|
||||
redis_service="redis-$app$"
|
||||
ynh_add_systemd_config --service $redis_service --template scrumblr_redis
|
||||
|
||||
#=================================================
|
||||
# INSTALL NODEJS
|
||||
#=================================================
|
||||
|
|
@ -100,10 +85,25 @@ ynh_app_setting_set --app=$app --key=final_path --value=$final_path
|
|||
# Download, check integrity, uncompress and patch the source from app.src
|
||||
ynh_setup_source --dest_dir="$final_path"
|
||||
|
||||
chmod 750 "$final_path"
|
||||
chmod -R o-rwx "$final_path"
|
||||
chown -R $app:www-data "$final_path"
|
||||
#==================================================
|
||||
# CONFIGURE REDIS SERVICE
|
||||
#==================================================
|
||||
|
||||
ynh_install_app_dependencies redis-server redis-tools
|
||||
|
||||
# Find an available port for redis
|
||||
redis_port=$(ynh_find_port --port=8081)
|
||||
ynh_app_setting_set --app=$app --key=redis_port --value=$redis_port
|
||||
|
||||
ynh_add_config --template="redis.conf" --destination="$final_path/redis.conf"
|
||||
|
||||
redis_service="redis-$app"
|
||||
ynh_add_systemd_config --service $redis_service --template scrumblr_redis.service
|
||||
|
||||
|
||||
chmod 770 "$final_path"
|
||||
chmod -R o-rwx "$final_path"
|
||||
chown -R $app:$app "$final_path"
|
||||
#=================================================
|
||||
# NGINX CONFIGURATION
|
||||
#=================================================
|
||||
|
|
@ -122,6 +122,8 @@ ynh_script_progression --message="Configuring log rotation..." --weight=1
|
|||
# Use logrotate to manage application logfile(s)
|
||||
ynh_use_logrotate
|
||||
|
||||
chown -R $app:$app "/var/log/$app/"
|
||||
|
||||
#=================================================
|
||||
# SETUP SYSTEMD
|
||||
#=================================================
|
||||
|
|
|
|||
|
|
@ -41,6 +41,10 @@ ynh_script_progression --message="Stopping and removing the systemd service..."
|
|||
# Remove the dedicated systemd config
|
||||
ynh_remove_systemd_config
|
||||
|
||||
ynh_remove_systemd_config --service="redis-$app"
|
||||
|
||||
|
||||
|
||||
#=================================================
|
||||
# REMOVE LOGROTATE CONFIGURATION
|
||||
#=================================================
|
||||
|
|
|
|||
|
|
@ -63,10 +63,6 @@ ynh_script_progression --message="Restoring the app main directory..." --weight=
|
|||
|
||||
ynh_restore_file --origin_path="$final_path"
|
||||
|
||||
chmod 750 "$final_path"
|
||||
chmod -R o-rwx "$final_path"
|
||||
chown -R $app:www-data "$final_path"
|
||||
|
||||
#=================================================
|
||||
# SPECIFIC RESTORATION
|
||||
#=================================================
|
||||
|
|
@ -92,6 +88,10 @@ ynh_script_progression --message="Restoring the redis configuration..." --weight
|
|||
ynh_restore_file --origin_path="/etc/systemd/system/redis-$app.service"
|
||||
systemctl enable "redis-$app.service" --quiet
|
||||
|
||||
chmod 750 "$final_path"
|
||||
chmod -R o-rwx "$final_path"
|
||||
chown -R $app:redis "$final_path"
|
||||
|
||||
#=================================================
|
||||
# RESTORE THE LOGROTATE CONFIGURATION
|
||||
#=================================================
|
||||
|
|
|
|||
|
|
@ -54,9 +54,9 @@ ynh_script_progression --message="Stopping a systemd service..." --weight=1
|
|||
|
||||
ynh_systemd_action --service_name=$app --action="stop" --log_path="/var/log/$app/$app.log"
|
||||
|
||||
if [ $(ynh_compare_current_package_version --comparison lt --version "0.2.0~ynh2") ]
|
||||
if [ $(ynh_compare_current_package_version --comparison gt --version "0.2.0~ynh1") ]
|
||||
then
|
||||
ynh_systemd_action --service_name=redis-$app --action="stop" --log_path="/var/log/$app/redis-$app.log"ls
|
||||
ynh_systemd_action --service_name=redis-$app --action="stop" --log_path="/var/log/$app/redis-$app.log"
|
||||
fi
|
||||
#=================================================
|
||||
# ENSURE DOWNWARD COMPATIBILITY
|
||||
|
|
@ -97,10 +97,6 @@ then
|
|||
ynh_setup_source --dest_dir="$final_path"
|
||||
fi
|
||||
|
||||
chmod 750 "$final_path"
|
||||
chmod -R o-rwx "$final_path"
|
||||
chown -R $app:www-data "$final_path"
|
||||
|
||||
if [ "$upgrade_type" == "UPGRADE_APP" ]
|
||||
then
|
||||
pushd $final_path
|
||||
|
|
@ -114,6 +110,8 @@ fi
|
|||
#=================================================
|
||||
ynh_script_progression --message="migrating database... $(ynh_package_version --package=scrumblr)" --weight=1
|
||||
|
||||
echo "$(ynh_package_version --package=srumblr)"
|
||||
|
||||
|
||||
|
||||
if [ $(ynh_compare_current_package_version --comparison lt --version "0.2.0~ynh2") ]
|
||||
|
|
@ -139,6 +137,11 @@ ynh_add_config --template="redis.conf" --destination="$final_path/redis.conf"
|
|||
redis_service="redis-$app$"
|
||||
ynh_add_systemd_config --service $redis_service --template scrumblr_redis
|
||||
|
||||
chmod 750 "$final_path"
|
||||
chmod -R o-rwx "$final_path"
|
||||
chown -R $app:redis "$final_path"
|
||||
|
||||
|
||||
#=================================================
|
||||
# NGINX CONFIGURATION
|
||||
#=================================================
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue