yunohost-gitea_ynh/conf/systemd.service

[Unit]
Description=Gitea
After=syslog.target
After=network.target
After=mysql.service
After=slapd.service

[Service]
# Modify these two values and uncomment them if you have
# repos with lots of files and get an HTTP error 500 because
# of that
###
#LimitMEMLOCK=infinity
#LimitNOFILE=65535
Type=simple
User=__APP__
Group=__APP__
WorkingDirectory=/home/yunohost.app/__APP__
ExecStart=__INSTALL_DIR__/gitea web
Restart=always
Environment=USER=__APP__ HOME=/home/yunohost.app/__APP__

# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap

# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG

[Install]
WantedBy=multi-user.target
Init 2018-02-25 21:45:24 +01:00			`[Unit]`
			`Description=Gitea`
			`After=syslog.target`
			`After=network.target`
			`After=mysql.service`
			`After=slapd.service`

			`[Service]`
			`# Modify these two values and uncomment them if you have`
			`# repos with lots of files and get an HTTP error 500 because`
			`# of that`
			`###`
			`#LimitMEMLOCK=infinity`
			`#LimitNOFILE=65535`
			`Type=simple`
			`User=__APP__`
			`Group=__APP__`
Fix install and fix linter 2022-04-23 19:40:27 +02:00			`WorkingDirectory=/home/yunohost.app/__APP__`
Migrate to manifestv2 and other changes: * Move app install dir from /opt to /var/www * Revamp the way binaries are downloaded thanks to manifestv2 (no need to check for arch, etc) * Remove custom helpers (exec_as, ynh_handle_app_migration) * Rename LFS_KEY as LFS_JWT_SECRET and KEY as SECRET_KEY as named in app.ini * Add JWT_SECRET for oauth and INTERNAL_TOKEN in app.ini * update upstream sample app.ini URL * Disable actions for now. * Automatically add ssh permissions to the system user * Remove support for upgrade before 1.6.4. Edit test_upgrade_from accordingly. 2023-09-09 11:17:52 +02:00			`ExecStart=__INSTALL_DIR__/gitea web`
Init 2018-02-25 21:45:24 +01:00			`Restart=always`
Fix install and fix linter 2022-04-23 19:40:27 +02:00			`Environment=USER=__APP__ HOME=/home/yunohost.app/__APP__`
Init 2018-02-25 21:45:24 +01:00
systemd hardening 2021-09-07 10:03:19 +02:00			`# Sandboxing options to harden security`
Migrate to manifestv2 and other changes: * Move app install dir from /opt to /var/www * Revamp the way binaries are downloaded thanks to manifestv2 (no need to check for arch, etc) * Remove custom helpers (exec_as, ynh_handle_app_migration) * Rename LFS_KEY as LFS_JWT_SECRET and KEY as SECRET_KEY as named in app.ini * Add JWT_SECRET for oauth and INTERNAL_TOKEN in app.ini * update upstream sample app.ini URL * Disable actions for now. * Automatically add ssh permissions to the system user * Remove support for upgrade before 1.6.4. Edit test_upgrade_from accordingly. 2023-09-09 11:17:52 +02:00			`# Depending on specificities of your service/app, you may need to tweak these`
systemd hardening 2021-09-07 10:03:19 +02:00			`# .. but this should be a good baseline`
			`# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html`
			`NoNewPrivileges=yes`
			`PrivateTmp=yes`
			`PrivateDevices=yes`
			`RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6`
			`RestrictNamespaces=yes`
			`RestrictRealtime=yes`
			`DevicePolicy=closed`
			`ProtectSystem=full`
			`ProtectControlGroups=yes`
			`ProtectKernelModules=yes`
			`ProtectKernelTunables=yes`
			`LockPersonality=yes`
			`SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap`

			`# Denying access to capabilities that should not be relevant for webapps`
			`# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html`
			`CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD`
			`CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE`
			`CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT`
			`CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK`
			`CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM`
			`CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG`
			`CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE`
			`CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW`
Migrate to manifestv2 and other changes: * Move app install dir from /opt to /var/www * Revamp the way binaries are downloaded thanks to manifestv2 (no need to check for arch, etc) * Remove custom helpers (exec_as, ynh_handle_app_migration) * Rename LFS_KEY as LFS_JWT_SECRET and KEY as SECRET_KEY as named in app.ini * Add JWT_SECRET for oauth and INTERNAL_TOKEN in app.ini * update upstream sample app.ini URL * Disable actions for now. * Automatically add ssh permissions to the system user * Remove support for upgrade before 1.6.4. Edit test_upgrade_from accordingly. 2023-09-09 11:17:52 +02:00			`CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG`
systemd hardening 2021-09-07 10:03:19 +02:00
Init 2018-02-25 21:45:24 +01:00			`[Install]`
			`WantedBy=multi-user.target`