From e0211677b94a70274a7527489ea4f09618b306b3 Mon Sep 17 00:00:00 2001 From: ericgaspar Date: Fri, 20 Aug 2021 09:31:11 +0200 Subject: [PATCH 1/6] Update systemd.service --- conf/systemd.service | 36 ++++++++++++++++++++++++++++++++---- 1 file changed, 32 insertions(+), 4 deletions(-) diff --git a/conf/systemd.service b/conf/systemd.service index 1a0ee2b..8f38aa5 100644 --- a/conf/systemd.service +++ b/conf/systemd.service @@ -1,9 +1,7 @@ [Unit] Description=Vikunja: To-Do list -After=syslog.target -After=network.target -Requires=postgresql.service -Requires=redis.service +After=network.target syslog.target +Requires=postgresql.service redis.service [Service] Type=simple @@ -14,5 +12,35 @@ ExecStart=/opt/vikunja/vikunja RestartSec=2s Restart=always +# Sandboxing options to harden security +# Depending on specificities of your service/app, you may need to tweak these +# .. but this should be a good baseline +# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG + [Install] WantedBy=multi-user.target From ef7ead286d551220c95a56333b0aac934f0cb318 Mon Sep 17 00:00:00 2001 From: ericgaspar Date: Fri, 20 Aug 2021 09:40:35 +0200 Subject: [PATCH 2/6] Add path --- check_process | 4 ++-- conf/nginx.conf | 7 ++++--- manifest.json | 8 +++++++- scripts/install | 2 +- 4 files changed, 14 insertions(+), 7 deletions(-) diff --git a/check_process b/check_process index f048339..286ba0e 100644 --- a/check_process +++ b/check_process @@ -7,7 +7,7 @@ password="password" ; Checks pkg_linter=1 - setup_sub_dir=0 + setup_sub_dir=1 setup_root=1 setup_nourl=0 setup_private=1 @@ -15,7 +15,7 @@ upgrade=1 #upgrade=1 from_commit= backup_restore=1 - multi_instance=0 + multi_instance=1 change_url=1 ;;; Options Email= diff --git a/conf/nginx.conf b/conf/nginx.conf index 665ba1c..42be42e 100644 --- a/conf/nginx.conf +++ b/conf/nginx.conf @@ -1,4 +1,5 @@ -location / { +#sub_path_only rewrite ^__PATH__$ __PATH__/ permanent; +location __PATH__/ { # Path to source alias __FINALPATH__/ ; @@ -8,7 +9,7 @@ location / { rewrite ^ https://$server_name$request_uri? permanent; } - try_files $uri $uri/ /; + try_files $uri $uri/ __PATH__/__PATH__/index.php?$query_string; index index.html index.htm; @@ -16,7 +17,7 @@ location / { include conf.d/yunohost_panel.conf.inc; } -location ~* ^/(api|dav|\.well-known)/ { +location __PATH__/(api|dav|\.well-known)/ { proxy_pass http://127.0.0.1:__PORT__; client_max_body_size 20M; } diff --git a/manifest.json b/manifest.json index ef639f2..127633a 100644 --- a/manifest.json +++ b/manifest.json @@ -22,7 +22,7 @@ "requirements": { "yunohost": ">= 4.2.4" }, - "multi_instance": false, + "multi_instance": true, "services": [ "nginx" ], @@ -33,6 +33,12 @@ "type": "domain", "example": "domain.org" }, + { + "name": "path", + "type": "path", + "example": "/vikunja", + "default": "/vikunja" + }, { "name": "is_public", "type": "boolean", diff --git a/scripts/install b/scripts/install index 1e035bd..56559c7 100644 --- a/scripts/install +++ b/scripts/install @@ -21,7 +21,7 @@ ynh_abort_if_errors #================================================= domain=$YNH_APP_ARG_DOMAIN -path_url="/" +path_url=$YNH_APP_ARG_PATH is_public=$YNH_APP_ARG_IS_PUBLIC timezone="$(cat /etc/timezone)" architecture=$(ynh_detect_arch) From 70ef7c0b8f9f71b3d31f9a2078935fa8f7f74a69 Mon Sep 17 00:00:00 2001 From: ericgaspar Date: Fri, 20 Aug 2021 17:14:42 +0200 Subject: [PATCH 3/6] Update config.yml --- conf/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conf/config.yml b/conf/config.yml index 4ea9c3c..0da5998 100644 --- a/conf/config.yml +++ b/conf/config.yml @@ -6,7 +6,7 @@ service: # The interface on which to run the webserver interface: ":__PORT__" # The URL of the frontend, used to send password reset emails. - frontendurl: "https://__DOMAIN__" + frontendurl: "https://__DOMAIN____PATH__" # The base path on the file system where the binary and assets are. # Vikunja will also look in this path for a config file, so you could provide only this variable to point to a folder # with a config file which will then be used. From 36b7d8e4f7b5d8d90a83d9250b0152a2f718fb59 Mon Sep 17 00:00:00 2001 From: ericgaspar Date: Fri, 20 Aug 2021 17:33:20 +0200 Subject: [PATCH 4/6] fix --- check_process | 2 +- conf/nginx.conf | 2 +- manifest.json | 6 ------ scripts/install | 2 +- 4 files changed, 3 insertions(+), 9 deletions(-) diff --git a/check_process b/check_process index 286ba0e..88c0bfb 100644 --- a/check_process +++ b/check_process @@ -7,7 +7,7 @@ password="password" ; Checks pkg_linter=1 - setup_sub_dir=1 + setup_sub_dir=0 setup_root=1 setup_nourl=0 setup_private=1 diff --git a/conf/nginx.conf b/conf/nginx.conf index 42be42e..d04ffea 100644 --- a/conf/nginx.conf +++ b/conf/nginx.conf @@ -9,7 +9,7 @@ location __PATH__/ { rewrite ^ https://$server_name$request_uri? permanent; } - try_files $uri $uri/ __PATH__/__PATH__/index.php?$query_string; + try_files $uri $uri/ __PATH__/; index index.html index.htm; diff --git a/manifest.json b/manifest.json index 3e14034..ee30e77 100644 --- a/manifest.json +++ b/manifest.json @@ -33,12 +33,6 @@ "type": "domain", "example": "domain.org" }, - { - "name": "path", - "type": "path", - "example": "/vikunja", - "default": "/vikunja" - }, { "name": "is_public", "type": "boolean", diff --git a/scripts/install b/scripts/install index 643c835..6812e5f 100644 --- a/scripts/install +++ b/scripts/install @@ -21,7 +21,7 @@ ynh_abort_if_errors #================================================= domain=$YNH_APP_ARG_DOMAIN -path_url=$YNH_APP_ARG_PATH +path_url="/" is_public=$YNH_APP_ARG_IS_PUBLIC timezone="$(cat /etc/timezone)" architecture=$(ynh_detect_arch) From f322eb70974837a4505526f737ed859c925f3421 Mon Sep 17 00:00:00 2001 From: ericgaspar Date: Fri, 20 Aug 2021 17:33:43 +0200 Subject: [PATCH 5/6] Update nginx.conf --- conf/nginx.conf | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/conf/nginx.conf b/conf/nginx.conf index d04ffea..665ba1c 100644 --- a/conf/nginx.conf +++ b/conf/nginx.conf @@ -1,5 +1,4 @@ -#sub_path_only rewrite ^__PATH__$ __PATH__/ permanent; -location __PATH__/ { +location / { # Path to source alias __FINALPATH__/ ; @@ -9,7 +8,7 @@ location __PATH__/ { rewrite ^ https://$server_name$request_uri? permanent; } - try_files $uri $uri/ __PATH__/; + try_files $uri $uri/ /; index index.html index.htm; @@ -17,7 +16,7 @@ location __PATH__/ { include conf.d/yunohost_panel.conf.inc; } -location __PATH__/(api|dav|\.well-known)/ { +location ~* ^/(api|dav|\.well-known)/ { proxy_pass http://127.0.0.1:__PORT__; client_max_body_size 20M; } From 8db7b653013f1e42a4b823f93be3ce39edecc8a6 Mon Sep 17 00:00:00 2001 From: ericgaspar Date: Fri, 20 Aug 2021 17:34:12 +0200 Subject: [PATCH 6/6] Update config.yml --- conf/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conf/config.yml b/conf/config.yml index 0da5998..4ea9c3c 100644 --- a/conf/config.yml +++ b/conf/config.yml @@ -6,7 +6,7 @@ service: # The interface on which to run the webserver interface: ":__PORT__" # The URL of the frontend, used to send password reset emails. - frontendurl: "https://__DOMAIN____PATH__" + frontendurl: "https://__DOMAIN__" # The base path on the file system where the binary and assets are. # Vikunja will also look in this path for a config file, so you could provide only this variable to point to a folder # with a config file which will then be used.