Merge branch 'testing' into media

README.md

@@ -45,7 +45,7 @@ a public page.
 - 📥️ **Import your collection** from many other [recipe managers](https://docs.tandoor.dev/features/import_export/)
 - ➕ Many more like recipe scaling, image compression, printing views and supermarkets
 
-**Shipped version:** 1.5.18~ynh1
+**Shipped version:** 1.5.18~ynh2
 
 **Demo:** <https://app.tandoor.dev/accounts/login/?demo>
 

README_es.md

@@ -45,7 +45,7 @@ a public page.
 - 📥️ **Import your collection** from many other [recipe managers](https://docs.tandoor.dev/features/import_export/)
 - ➕ Many more like recipe scaling, image compression, printing views and supermarkets
 
-**Versión actual:** 1.5.18~ynh1
+**Versión actual:** 1.5.18~ynh2
 
 **Demo:** <https://app.tandoor.dev/accounts/login/?demo>
 

README_eu.md

@@ -45,7 +45,7 @@ a public page.
 - 📥️ **Import your collection** from many other [recipe managers](https://docs.tandoor.dev/features/import_export/)
 - ➕ Many more like recipe scaling, image compression, printing views and supermarkets
 
-**Paketatutako bertsioa:** 1.5.18~ynh1
+**Paketatutako bertsioa:** 1.5.18~ynh2
 
 **Demoa:** <https://app.tandoor.dev/accounts/login/?demo>
 

README_fr.md

@@ -45,7 +45,7 @@ a public page.
 - 📥️ **Import your collection** from many other [recipe managers](https://docs.tandoor.dev/features/import_export/)
 - ➕ Many more like recipe scaling, image compression, printing views and supermarkets
 
-**Version incluse :** 1.5.18~ynh1
+**Version incluse :** 1.5.18~ynh2
 
 **Démo :** <https://app.tandoor.dev/accounts/login/?demo>
 

README_gl.md

@@ -45,7 +45,7 @@ a public page.
 - 📥️ **Import your collection** from many other [recipe managers](https://docs.tandoor.dev/features/import_export/)
 - ➕ Many more like recipe scaling, image compression, printing views and supermarkets
 
-**Versión proporcionada:** 1.5.18~ynh1
+**Versión proporcionada:** 1.5.18~ynh2
 
 **Demo:** <https://app.tandoor.dev/accounts/login/?demo>
 

README_id.md

@@ -45,7 +45,7 @@ a public page.
 - 📥️ **Import your collection** from many other [recipe managers](https://docs.tandoor.dev/features/import_export/)
 - ➕ Many more like recipe scaling, image compression, printing views and supermarkets
 
-**Versi terkirim:** 1.5.18~ynh1
+**Versi terkirim:** 1.5.18~ynh2
 
 **Demo:** <https://app.tandoor.dev/accounts/login/?demo>
 

README_zh_Hans.md

@@ -45,7 +45,7 @@ a public page.
 - 📥️ **Import your collection** from many other [recipe managers](https://docs.tandoor.dev/features/import_export/)
 - ➕ Many more like recipe scaling, image compression, printing views and supermarkets
 
-**分发版本：** 1.5.18~ynh1
+**分发版本：** 1.5.18~ynh2
 
 **演示：** <https://app.tandoor.dev/accounts/login/?demo>
 

conf/dot_env

@@ -12,9 +12,7 @@ TANDOOR_PORT=__PORT__
 ALLOWED_HOSTS=__DOMAIN__
 
 # random secret key, use for example `base64 /dev/urandom | head -c50` to generate one
-# ---------------------------- REQUIRED -------------------------
 SECRET_KEY=__SECRETKEY__
-# ---------------------------------------------------------------
 
 # your default timezone See https://timezonedb.com/time-zones for a list of timezones
 TZ=__TIMEZONE__
@@ -25,9 +23,7 @@ DB_ENGINE=django.db.backends.postgresql
 POSTGRES_HOST=127.0.0.1
 POSTGRES_PORT=5432
 POSTGRES_USER=__DB_USER__
-# ---------------------------- REQUIRED -------------------------
 POSTGRES_PASSWORD=__DB_PWD__
-# ---------------------------------------------------------------
 POSTGRES_DB=__DB_NAME__
 
 # the default value for the user preference 'fractions' (enable/disable fraction support)
@@ -85,8 +81,8 @@ GUNICORN_MEDIA=0
 # Required for email confirmation and password reset (automatically activates if host is set)
 EMAIL_HOST='127.0.0.1'
 EMAIL_PORT=25
-EMAIL_HOST_USER=
-EMAIL_HOST_PASSWORD=
+EMAIL_HOST_USER='__APP__'
+EMAIL_HOST_PASSWORD='__MAIL_PWD__'
 EMAIL_USE_TLS=0
 EMAIL_USE_SSL=0
 # email sender address (default 'webmaster@localhost')

conf/nginx.conf

@@ -20,5 +20,3 @@ location __PATH__/ {
 location /media/ {
   alias __DATA_DIR__/media/;
 }
-
-

conf/systemd.service

@@ -1,16 +1,50 @@
 [Unit]
-Description=Tandoor, smart recipe mangement
+Description=Tandoor: smart recipe mangement
 After=network.target
 
 [Service]
 Type=simple
 User=__APP__
 Group=__APP__
-WorkingDirectory=__INSTALL_DIR__/source/
+WorkingDirectory=__INSTALL_DIR__/
 EnvironmentFile=__INSTALL_DIR__/.env
 ExecStart=__INSTALL_DIR__/venv/bin/gunicorn --bind 127.0.0.1:__PORT__ recipes.wsgi:application
 Restart=on-failure
 RestartSec=10
 
+### Depending on specificities of your service/app, you may need to tweak these
+### .. but this should be a good baseline
+# Sandboxing options to harden security
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallArchitectures=native
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged
+
+# Denying access to capabilities that should not be relevant for webapps
+# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
+
 [Install]
 WantedBy=multi-user.target

manifest.toml

@@ -4,10 +4,10 @@ packaging_format = 2
 
 id = "tandoor"
 name = "Tandoor"
-description.en = "Application for managing and sharing recipes, planning meals, building shopping lists and much much more!"
-description.fr = "Gérez et partagez vos recettes, planifiez vos repas, créez vos listes de courses et beaucoup plus encore !"
+description.en = "Manage and share recipes, plan meals, build shopping lists"
+description.fr = "Gérez et partagez des recettes, planifiez des repas, créez des listes de courses"
 
-version = "1.5.18~ynh1"
+version = "1.5.18~ynh2"
 
 maintainers = ["Navan Chauhan"]
 
@@ -21,14 +21,14 @@ code = "https://github.com/TandoorRecipes/recipes"
 cpe = "cpe:2.3:a:tandoor:recipes"
 
 [integration]
-yunohost = ">= 11.2"
+yunohost = ">= 11.2.20"
 architectures = "all"
 multi_instance = true
 ldap = false
 sso = false
-disk = "50M"
-ram.build = "50M"
-ram.runtime = "50M"
+disk = "1000M"
+ram.build = "2000M"
+ram.runtime = "1500M"
 
 [install]
     [install.domain]
@@ -47,6 +47,7 @@ ram.runtime = "50M"
     autoupdate.asset = "tarball"
 
     [resources.system_user]
+    allow_email = true
     
     [resources.install_dir]
 

scripts/_common.sh

@@ -6,7 +6,6 @@
 
 nodejs_version=16
 
-# Used in .env
 timezone="$(cat /etc/timezone)"
 
 #=================================================
@@ -17,13 +16,13 @@ _tandoor_venv_install() {
     ynh_exec_as "$app" python3 -m venv --upgrade "$install_dir/venv"
     venvpy="$install_dir/venv/bin/python3"
 
-    pushd "$install_dir/source"
+    pushd "$install_dir"
         ynh_exec_as "$app" "$venvpy" -m pip install -r requirements.txt
     popd
 }
 
 _tandoor_build_frontend() {
-    pushd "$install_dir/source/vue"
+    pushd "$install_dir/vue"
         ynh_use_nodejs
         ynh_exec_warn_less ynh_exec_as "$app" env "$ynh_node_load_PATH" yarn install
         ynh_exec_warn_less ynh_exec_as "$app" env "$ynh_node_load_PATH" yarn build

scripts/backup

@@ -44,12 +44,6 @@ ynh_backup --src_path="/etc/logrotate.d/$app"
 ynh_backup --src_path="/etc/fail2ban/jail.d/$app.conf"
 ynh_backup --src_path="/etc/fail2ban/filter.d/$app.conf"
 
-#=================================================
-# BACKUP VARIOUS FILES
-#=================================================
-
-ynh_backup --src_path="/var/log/$app/"
-
 #=================================================
 # BACKUP THE PostgreSQL DATABASE
 #=================================================

scripts/change_url

@@ -14,14 +14,14 @@ source /usr/share/yunohost/helpers
 #=================================================
 # STOP SYSTEMD SERVICE
 #=================================================
-ynh_script_progression --message="Stopping a systemd service..." --time --weight=1
+ynh_script_progression --message="Stopping a systemd service..." --weight=1
 
-ynh_systemd_action --service_name=$app --action="stop" --log_path="/var/log/$app/$app.log"
+ynh_systemd_action --service_name=$app --action="stop" --log_path="systemd"
 
 #=================================================
 # MODIFY URL IN NGINX CONF
 #=================================================
-ynh_script_progression --message="Updating NGINX web server configuration..." --time --weight=1
+ynh_script_progression --message="Updating NGINX web server configuration..." --weight=1
 
 ynh_change_url_nginx_config
 
@@ -40,12 +40,12 @@ chown "$app:$app" "$install_dir/.env"
 #=================================================
 # START SYSTEMD SERVICE
 #=================================================
-ynh_script_progression --message="Starting a systemd service..." --time --weight=1
+ynh_script_progression --message="Starting a systemd service..." --weight=1
 
-ynh_systemd_action --service_name="$app" --action="start" --log_path="/var/log/$app/$app.log"
+ynh_systemd_action --service_name="$app" --action="start" --log_path="systemd"
 
 #=================================================
 # END OF SCRIPT
 #=================================================
 
-ynh_script_progression --message="Change of URL completed for $app" --time --last
+ynh_script_progression --message="Change of URL completed for $app" --last

scripts/install

@@ -38,16 +38,10 @@ ynh_psql_execute_as_root --sql="ALTER USER $db_name WITH SUPERUSER;"
 ynh_script_progression --message="Setting up source files..." --weight=1
 
 # Download, check integrity, uncompress and patch the source from app.src
-ynh_setup_source --dest_dir="$install_dir/source"
+ynh_setup_source --dest_dir="$install_dir"
 
-chmod 750 "$install_dir"
-chmod -R o-rwx "$install_dir"
 chown -R "$app:www-data" "$install_dir"
 
-chmod 750 "$data_dir"
-chmod -R o-rwx "$data_dir"
-chown -R "$app:www-data" "$data_dir"
-
 #=================================================
 # ADD A CONFIGURATION
 #=================================================
@@ -60,9 +54,10 @@ chown "$app:$app" "$install_dir/.env"
 
 version=$(ynh_app_upstream_version)
 
-ynh_add_config --template="version.py" --destination="$install_dir/source/recipes/version.py"
-chmod 400 "$install_dir/source/recipes/version.py"
-chown "$app:$app" "$install_dir/source/recipes/version.py"
+ynh_add_config --template="version.py" --destination="$install_dir/recipes/version.py"
+
+chmod 400 "$install_dir/recipes/version.py"
+chown "$app:$app" "$install_dir/recipes/version.py"
 
 #=================================================
 # SPECIFIC SETUP
@@ -75,7 +70,7 @@ _tandoor_venv_install
 
 ynh_script_progression --message="Running migrations and generating static files..." --weight=2
 
-pushd "$install_dir/source"
+pushd "$install_dir"
     (
         source "$install_dir/.env"
         ynh_exec_as "$app" "$venvpy" manage.py migrate
@@ -106,7 +101,7 @@ ynh_use_logrotate
 ynh_script_progression --message="Starting a systemd service..." --weight=1
 
 # Start a systemd service
-ynh_systemd_action --service_name="$app" --action="start" --log_path="/var/log/$app/$app.log"
+ynh_systemd_action --service_name="$app" --action="start" --log_path="systemd"
 
 #=================================================
 # END OF SCRIPT

scripts/restore

@@ -17,8 +17,6 @@ ynh_script_progression --message="Restoring the app main directory..." --weight=
 
 ynh_restore_file --origin_path="$install_dir"
 
-chmod 750 "$install_dir"
-chmod -R o-rwx "$install_dir"
 chown -R "$app:www-data" "$install_dir"
 
 #=================================================
@@ -28,8 +26,6 @@ ynh_script_progression --message="Restoring the data directory..." --weight=1
 
 ynh_restore_file --origin_path="$data_dir" --not_mandatory
 
-chmod 750 "$data_dir"
-chmod -R o-rwx "$data_dir"
 chown -R "$app:www-data" "$data_dir"
 
 #=================================================
@@ -52,12 +48,6 @@ yunohost service add "$app" --description="Smart recipe management" --log="/var/
 
 ynh_restore_file --origin_path="/etc/logrotate.d/$app"
 
-#=================================================
-# RESTORE VARIOUS FILES
-#=================================================
-
-ynh_restore_file --origin_path="/var/log/$app/"
-
 #=================================================
 # GENERIC FINALIZATION
 #=================================================
@@ -65,7 +55,7 @@ ynh_restore_file --origin_path="/var/log/$app/"
 #=================================================
 ynh_script_progression --message="Reloading NGINX web server and $app's service..." --weight=1
 
-ynh_systemd_action --service_name="$app" --action="start" --log_path="/var/log/$app/$app.log"
+ynh_systemd_action --service_name="$app" --action="start" --log_path="systemd"
 
 ynh_systemd_action --service_name=nginx --action=reload
 

scripts/upgrade

@@ -16,7 +16,7 @@ source /usr/share/yunohost/helpers
 #=================================================
 ynh_script_progression --message="Stopping a systemd service..." --weight=1
 
-ynh_systemd_action --service_name="$app" --action="stop" --log_path="/var/log/$app/$app.log"
+ynh_systemd_action --service_name="$app" --action="stop" --log_path="systemd"
 
 #=================================================
 # UPGRADE DEPENDENCIES
@@ -31,7 +31,7 @@ ynh_exec_warn_less ynh_install_nodejs --nodejs_version="$nodejs_version"
 ynh_script_progression --message="Upgrading source files..." --weight=1
 
 # Download, check integrity, uncompress and patch the source from app.src
-ynh_setup_source --dest_dir="$install_dir/source" --full_replace=1
+ynh_setup_source --dest_dir="$install_dir" --full_replace=1 --keep="$install_dir/.env"
 
 chmod 750 "$install_dir"
 chmod -R o-rwx "$install_dir"
@@ -49,24 +49,26 @@ chown "$app:$app" "$install_dir/.env"
 
 version=$(ynh_app_upstream_version)
 
-ynh_add_config --template="version.py" --destination="$install_dir/source/recipes/version.py"
-chmod 400 "$install_dir/source/recipes/version.py"
-chown "$app:$app" "$install_dir/source/recipes/version.py"
+ynh_add_config --template="version.py" --destination="$install_dir/recipes/version.py"
+
+chmod 400 "$install_dir/recipes/version.py"
+chown "$app:$app" "$install_dir/recipes/version.py"
 
 #=================================================
 # SPECIFIC SETUP
 #=================================================
 ynh_script_progression --message="Building frontend..." --weight=5
+
 _tandoor_build_frontend
 
 ynh_script_progression --message="Installing Tandoor and its python dependencies..." --weight=1
+
 _tandoor_venv_install
 
 ynh_script_progression --message="Running migrations and generating static files..." --weight=2
-pushd "$install_dir/source"
+pushd "$install_dir"
     (
         source "$install_dir/.env"
-
         ynh_exec_as "$app" "$venvpy" manage.py migrate
         ynh_psql_execute_as_root --sql="ALTER USER $app WITH NOSUPERUSER;"
         ynh_exec_as "$app" "$venvpy" manage.py collectstatic --no-input
@@ -94,7 +96,7 @@ ynh_use_logrotate --non-append
 #=================================================
 ynh_script_progression --message="Starting a systemd service..." --weight=1
 
-ynh_systemd_action --service_name=$app --action="start" --log_path="/var/log/$app/$app.log"
+ynh_systemd_action --service_name=$app --action="start" --log_path="systemd"
 
 #=================================================
 # END OF SCRIPT