diff --git a/hellopy_ynh/conf/nginx.conf b/hellopy_ynh/conf/nginx.conf new file mode 100644 index 0000000..9adb8c8 --- /dev/null +++ b/hellopy_ynh/conf/nginx.conf @@ -0,0 +1,13 @@ +#sub_path_only rewrite ^__PATH__$ __PATH__/ permanent; +location __PATH__/ { + + client_max_body_size 10M; + + proxy_pass http://127.0.0.1:__PORT__; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "Upgrade"; + + # preserve client IP + proxy_set_header X-Forwarded-For $remote_addr; +} diff --git a/hellopy_ynh/conf/server.py b/hellopy_ynh/conf/server.py new file mode 100644 index 0000000..1b76fd4 --- /dev/null +++ b/hellopy_ynh/conf/server.py @@ -0,0 +1,31 @@ +from http.server import BaseHTTPRequestHandler, HTTPServer +import sys +import base64 + + +class MyServer(BaseHTTPRequestHandler): + def do_GET(self): + auth = self.headers.get("Authorization") + if auth: + auth = auth.replace("Basic ", "") + user, pwd = base64.b64decode(auth.encode()).decode().split(":") if auth else (None, None) + self.send_response(200) + self.end_headers() + + if self.path == "/": + self.wfile.write("Hello world!\n".encode()) + elif self.path == "/show-auth": + self.wfile.write(f"User: {user}\n".encode()) + self.wfile.write(f"Pwd: {pwd}\n".encode()) + + +webServer = HTTPServer(("127.0.0.1", int(sys.argv[1])), MyServer) +print("Server started") + +try: + webServer.serve_forever() +except BaseException: + sys.exit(0) +finally: + webServer.server_close() + print("Server stopped.") diff --git a/hellopy_ynh/conf/systemd.service b/hellopy_ynh/conf/systemd.service new file mode 100644 index 0000000..664179c --- /dev/null +++ b/hellopy_ynh/conf/systemd.service @@ -0,0 +1,52 @@ +[Unit] +Description=Service for hellopy (__APP__) +After=network.target + +[Service] +Type=simple +User=__APP__ +Group=__APP__ + +WorkingDirectory=__INSTALL_DIR__/ +ExecStart=python3 __INSTALL_DIR__/server.py __PORT__ +StandardOutput=append:/var/log/__APP__/__APP__.log +StandardError=inherit +Restart=on-failure +RestartSec=10 + +# Sandboxing options to harden security +# Depending on specificities of your service/app, you may need to tweak these +# .. but this should be a good baseline +# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectClock=yes +ProtectHostname=yes +ProtectProc=invisible +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallArchitectures=native +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG + +[Install] +WantedBy=multi-user.target diff --git a/hellopy_ynh/manifest.toml b/hellopy_ynh/manifest.toml new file mode 100644 index 0000000..05091e9 --- /dev/null +++ b/hellopy_ynh/manifest.toml @@ -0,0 +1,43 @@ +packaging_format = 2 + +id = "hellopy" +name = "hellopy" + +description.en = "Dummy app" + +version = "1.0~ynh1" + +maintainers = ["Aleks"] + +[upstream] +license = "WTFPL" + +[integration] +yunohost = '>= 11.2' +architectures = "all" +multi_instance = false +ldap = "not_relevant" +sso = false +disk = "50M" +ram.build = "50M" +ram.runtime = "50M" + +[install] + + [install.domain] + type = "domain" + + [install.init_main_permission] + type = "group" + default = "visitors" + +[resources] + + [resources.system_user] + + [resources.install_dir] + + [resources.permissions] + main.url = "/" + + [resources.ports] diff --git a/hellopy_ynh/scripts/_common.sh b/hellopy_ynh/scripts/_common.sh new file mode 100644 index 0000000..05a7907 --- /dev/null +++ b/hellopy_ynh/scripts/_common.sh @@ -0,0 +1,2 @@ +#!/bin/bash + diff --git a/hellopy_ynh/scripts/install b/hellopy_ynh/scripts/install new file mode 100644 index 0000000..d96d705 --- /dev/null +++ b/hellopy_ynh/scripts/install @@ -0,0 +1,41 @@ +#!/bin/bash + +source _common.sh +source /usr/share/yunohost/helpers + +#================================================= +# DOWNLOAD, CHECK AND UNPACK SOURCE +#================================================= +ynh_script_progression --message="Setting up source files..." + +cp ../conf/server.py $install_dir/ +chown -R $app:$app "$install_dir" + +#================================================= +# SYSTEM CONFIGURATION +#================================================= +ynh_script_progression --message="Adding system configurations related to $app..." + +# Create a dedicated NGINX config using the conf/nginx.conf template +ynh_add_nginx_config + +# Create a dedicated systemd config +ynh_add_systemd_config + +mkdir -p /var/log/$app/ +chown $app /var/log/$app + +yunohost service add $app --log="/var/log/$app/$app.log" + +#================================================= +# START SYSTEMD SERVICE +#================================================= +ynh_script_progression --message="Starting app's systemd service..." + +# Start a systemd service +ynh_systemd_action --service_name=$app --action="start" --log_path="/var/log/$app/$app.log" + +#================================================= +# END OF SCRIPT +#================================================= +ynh_script_progression --message="Installation of $app completed" --last diff --git a/hellopy_ynh/scripts/remove b/hellopy_ynh/scripts/remove new file mode 100644 index 0000000..91a509b --- /dev/null +++ b/hellopy_ynh/scripts/remove @@ -0,0 +1,32 @@ +#!/bin/bash + +source _common.sh +source /usr/share/yunohost/helpers + +#================================================= +# REMOVE SYSTEM CONFIGURATIONS +#================================================= +# REMOVE SYSTEMD SERVICE +#================================================= +ynh_script_progression --message="Removing system configurations related to $app..." + +# Remove the service from the list of services known by YunoHost (added from `yunohost service add`) +if ynh_exec_warn_less yunohost service status $app >/dev/null +then + ynh_script_progression --message="Removing $app service integration..." + yunohost service remove $app +fi + +ynh_remove_systemd_config + +ynh_remove_nginx_config + +# Remove other various files specific to the app... such as : + +ynh_secure_remove --file="/var/log/$app" + +#================================================= +# END OF SCRIPT +#================================================= + +ynh_script_progression --message="Removal of $app completed" --last