update conf files

conf/redis.conf

@@ -100,7 +100,7 @@ tcp-keepalive 300
 
 # By default Redis does not run as a daemon. Use 'yes' if you need it.
 # Note that Redis will write a pid file in /var/run/redis.pid when daemonized.
-daemonize yes
+daemonize no
 
 # If you run Redis from upstart or systemd, Redis can interact with your
 # supervision tree. Options:
@@ -122,7 +122,7 @@ supervised no
 #
 # Creating a pid file is best effort: if Redis is not able to create it
 # nothing bad happens, the server will start and run normally.
-pidfile /var/run/redis/redis-server__REDIS_PORT__.pid
+pidfile __FINAL_PATH__/redis-server-__REDIS_PORT__.pid
 
 # Specify the server verbosity level.
 # This can be one of:
@@ -135,7 +135,7 @@ loglevel notice
 # Specify the log file name. Also the empty string can be used to force
 # Redis to log on the standard output. Note that if you use standard
 # output for logging but daemonize, logs will be sent to /dev/null
-logfile /var/log/redis/redis-server-__REDIS_PORT__.log
+logfile /var/log/__APP__/redis-__REDIS_PORT__.log
 
 # Set the number of databases. The default database is DB 0, you can select
 # a different one on a per-connection basis using SELECT <dbid> where

conf/scrumblr_redis.service

@@ -7,41 +7,32 @@ Type=simple
 User=__APP__
 Group=__APP__
 WorkingDirectory=__FINALPATH__/
-ExecStart=redis-server redis.conf 
+ExecStart=/usr/bin/redis-server __FINALPATH__/redis.conf 
-StandardOutput=syslog
+ExecStop=/bin/kill -s TERM $MAINPID
-StandardError=syslog
+PIDFile=__FINALPATH__/redis-server-__PORT__.pid
-SyslogIdentifier=redis-__APP__
+TimeoutStopSec=0
 Restart=always
 
-# Sandboxing options to harden security
+UMask=007
-# Depending on specificities of your service/app, you may need to tweak these 
-# .. but this should be a good baseline
-# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
-NoNewPrivileges=yes
 PrivateTmp=yes
+LimitNOFILE=65535
 PrivateDevices=yes
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ProtectHome=yes
-RestrictNamespaces=yes
+#ReadOnlyDirectories=/
-RestrictRealtime=yes
+ReadWriteDirectories=-/var/lib/__APP__
-DevicePolicy=closed
+ReadWriteDirectories=-/var/log/__APP__
-ProtectSystem=full
+ReadWriteDirectories=-__FINALPATH__
-ProtectControlGroups=yes
+
-ProtectKernelModules=yes
+NoNewPrivileges=true
-ProtectKernelTunables=yes
+CapabilityBoundingSet=CAP_SETGID CAP_SETUID CAP_SYS_RESOURCE
-LockPersonality=yes
+MemoryDenyWriteExecute=true
-SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictRealtime=true
+RestrictNamespaces=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+
 
-# Denying access to capabilities that should not be relevant for webapps
-# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
-CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
-CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
-CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
-CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
-CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
-CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
-CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
-CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
-CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 
 
 [Install]
 WantedBy=multi-user.target

conf/systemd.service

@@ -1,6 +1,6 @@
 [Unit]
 Description=Scrumblr: software to take note.
-After=network.target
+Requires=redis-__APP__.service
 
 [Service]
 Type=simple
@@ -9,7 +9,7 @@ Group=__APP__
 WorkingDirectory=__FINALPATH__
 Environment="PATH=_PATH__"
 Environment="NODE_ENV=production"
-ExecStart=__YNH_NODE__ server.js --port=__PORT__ --baseurl=__PATH__ --redis localhot:__REDIS_PORT__
+ExecStart=__YNH_NODE__ server.js --port=__PORT__ --baseurl=__PATH__ --redis localhost:__REDIS_PORT__
 Restart=always
 
 # Sandboxing options to harden security

scripts/backup

@@ -30,7 +30,7 @@ app=$YNH_APP_INSTANCE_NAME
 
 final_path=$(ynh_app_setting_get --app=$app --key=final_path)
 domain=$(ynh_app_setting_get --app=$app --key=domain)
-db_name=$(ynh_app_setting_get --app=$app --key=db_name)
+redis_port=$(ynh_app_setting_get --app=$app --key=redis_port)
 codename=$(ynh_app_setting_get $app codename)
 
 #=================================================
@@ -38,6 +38,13 @@ codename=$(ynh_app_setting_get $app codename)
 #=================================================
 ynh_print_info --message="Declaring files to be backed up..."
 
+
+#=================================================
+# EXPORT DATABASE
+#=================================================
+
+redis-cli --rdb "$final_path/redis-$app.rdb" -p $redis_port
+
 #=================================================
 # BACKUP THE APP MAIN DIR
 #=================================================
@@ -63,6 +70,7 @@ ynh_backup --src_path="/etc/logrotate.d/$app"
 #=================================================
 
 ynh_backup --src_path="/etc/systemd/system/$app.service"
+ynh_backup --src_path="/etc/systemd/system/redis-$app.service"
 
 #=================================================
 # END OF SCRIPT

scripts/install

@@ -59,21 +59,6 @@ ynh_script_progression --message="Finding an available port..." --weight=1
 port=$(ynh_find_port --port=8080)
 ynh_app_setting_set --app=$app --key=port --value=$port
 
-#==================================================
-# CONFIGURE REDIS SERVICE
-#==================================================
-
-ynh_install_app_dependencies redis-server redis-tools
-
-# Find an available port for redis
-redis_port=$(ynh_find_port --port=8081)
-ynh_app_setting_set --app=$app --key=redis_port --value=$redis_port
-
-ynh_add_config --template="redis.conf" --destination="$final_path/redis.conf"
-
-redis_service="redis-$app$"
-ynh_add_systemd_config --service $redis_service --template scrumblr_redis
-
 #=================================================
 # INSTALL NODEJS
 #=================================================
@@ -100,10 +85,25 @@ ynh_app_setting_set --app=$app --key=final_path --value=$final_path
 # Download, check integrity, uncompress and patch the source from app.src
 ynh_setup_source --dest_dir="$final_path"
 
-chmod 750 "$final_path"
+#==================================================
-chmod -R o-rwx "$final_path"
+# CONFIGURE REDIS SERVICE
-chown -R $app:www-data "$final_path"
+#==================================================
 
+ynh_install_app_dependencies redis-server redis-tools
+
+# Find an available port for redis
+redis_port=$(ynh_find_port --port=8081)
+ynh_app_setting_set --app=$app --key=redis_port --value=$redis_port
+
+ynh_add_config --template="redis.conf" --destination="$final_path/redis.conf"
+
+redis_service="redis-$app"
+ynh_add_systemd_config --service $redis_service --template scrumblr_redis.service
+
+
+chmod 770 "$final_path"
+chmod -R o-rwx "$final_path"
+chown -R $app:$app "$final_path"
 #=================================================
 # NGINX CONFIGURATION
 #=================================================
@@ -122,6 +122,8 @@ ynh_script_progression --message="Configuring log rotation..." --weight=1
 # Use logrotate to manage application logfile(s)
 ynh_use_logrotate
 
+chown -R $app:$app "/var/log/$app/"
+
 #=================================================
 # SETUP SYSTEMD
 #=================================================

scripts/remove

@@ -41,6 +41,10 @@ ynh_script_progression --message="Stopping and removing the systemd service..."
 # Remove the dedicated systemd config
 ynh_remove_systemd_config
 
+ynh_remove_systemd_config --service="redis-$app"
+
+
+
 #=================================================
 # REMOVE LOGROTATE CONFIGURATION
 #=================================================

scripts/restore

@@ -63,10 +63,6 @@ ynh_script_progression --message="Restoring the app main directory..." --weight=
 
 ynh_restore_file --origin_path="$final_path"
 
-chmod 750 "$final_path"
-chmod -R o-rwx "$final_path"
-chown -R $app:www-data "$final_path"
-
 #=================================================
 # SPECIFIC RESTORATION
 #=================================================
@@ -92,6 +88,10 @@ ynh_script_progression --message="Restoring the redis configuration..." --weight
 ynh_restore_file --origin_path="/etc/systemd/system/redis-$app.service"
 systemctl enable "redis-$app.service" --quiet
 
+chmod 750 "$final_path"
+chmod -R o-rwx "$final_path"
+chown -R $app:redis "$final_path"
+
 #=================================================
 # RESTORE THE LOGROTATE CONFIGURATION
 #=================================================

scripts/upgrade

@@ -54,9 +54,9 @@ ynh_script_progression --message="Stopping a systemd service..." --weight=1
 
 ynh_systemd_action --service_name=$app --action="stop" --log_path="/var/log/$app/$app.log"
 
-if [ $(ynh_compare_current_package_version --comparison lt --version "0.2.0~ynh2") ] 
+if [ $(ynh_compare_current_package_version --comparison gt --version "0.2.0~ynh1") ] 
 then
-    ynh_systemd_action --service_name=redis-$app --action="stop" --log_path="/var/log/$app/redis-$app.log"ls
+    ynh_systemd_action --service_name=redis-$app --action="stop" --log_path="/var/log/$app/redis-$app.log"
 fi
 #=================================================
 # ENSURE DOWNWARD COMPATIBILITY
@@ -97,10 +97,6 @@ then
 	ynh_setup_source --dest_dir="$final_path"
 fi
 
-chmod 750 "$final_path"
-chmod -R o-rwx "$final_path"
-chown -R $app:www-data "$final_path"
-
 if [ "$upgrade_type" == "UPGRADE_APP" ]
 then
 	pushd $final_path
@@ -114,6 +110,8 @@ fi
 #=================================================
 ynh_script_progression --message="migrating database... $(ynh_package_version --package=scrumblr)" --weight=1
 
+echo "$(ynh_package_version --package=srumblr)"
+
 
 
 if [  $(ynh_compare_current_package_version --comparison lt --version "0.2.0~ynh2")  ] 
@@ -139,6 +137,11 @@ ynh_add_config --template="redis.conf" --destination="$final_path/redis.conf"
 redis_service="redis-$app$"
 ynh_add_systemd_config --service $redis_service --template scrumblr_redis
 
+chmod 750 "$final_path"
+chmod -R o-rwx "$final_path"
+chown -R $app:redis "$final_path"
+
+
 #=================================================
 # NGINX CONFIGURATION
 #=================================================