chibisafe_ynh/conf/systemd.service

[Unit]
Description=A modern and self-hosted take on file uploading services that can handle anything you throw at it thanks to it's robust and fast API, chunked uploads support and more.
After=network.target

[Service]
Type=simple
User=__APP__
Group=__APP__
WorkingDirectory=__INSTALL_DIR__/
Environment="PATH=__PATH_WITH_NODEJS__"
Environment="NODE_ENV=production"
ExecStart=yarn start
Restart=always
RestartSec=5
StandardOutput=append:/var/log/__APP__/__APP__.log
StandardError=inherit

### Depending on specificities of your service/app, you may need to tweak these
### .. but this should be a good baseline
# Sandboxing options to harden security
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
ProtectClock=yes
ProtectHostname=yes
ProtectProc=invisible
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallArchitectures=native
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged

# Denying access to capabilities that should not be relevant for webapps
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG

[Install]
WantedBy=multi-user.target
Add a systemd default file 2017-09-05 11:47:31 -04:00			`[Unit]`
Update conf/systemd.service 2024-11-07 04:31:44 -05:00			`Description=A modern and self-hosted take on file uploading services that can handle anything you throw at it thanks to it's robust and fast API, chunked uploads support and more.`
Add a systemd default file 2017-09-05 11:47:31 -04:00			`After=network.target`

			`[Service]`
			`Type=simple`
			`User=__APP__`
			`Group=__APP__`
Propagate changes related to manifestv2 2023-01-30 13:10:14 -05:00			`WorkingDirectory=__INSTALL_DIR__/`
Update conf/systemd.service 2024-11-15 17:36:17 -05:00			`Environment="PATH=__PATH_WITH_NODEJS__"`
Update conf/systemd.service 2024-11-15 12:16:59 -05:00			`Environment="NODE_ENV=production"`
Update conf/systemd.service 2024-11-15 12:03:20 -05:00			`ExecStart=yarn start`
Update conf/systemd.service 2024-11-15 12:16:59 -05:00			`Restart=always`
			`RestartSec=5`
Fix systemd stdout/stderr 2020-12-10 07:46:39 -05:00			`StandardOutput=append:/var/log/__APP__/__APP__.log`
			`StandardError=inherit`
Add a systemd default file 2017-09-05 11:47:31 -04:00
Fix comments: # for real scripts comments, ### for app packaging doc 2024-01-10 17:52:57 -05:00			`### Depending on specificities of your service/app, you may need to tweak these`
			`### .. but this should be a good baseline`
Update systemd.service 2020-11-11 10:02:30 -05:00			`# Sandboxing options to harden security`
			`# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html`
			`NoNewPrivileges=yes`
			`PrivateTmp=yes`
			`PrivateDevices=yes`
systemd conf: Add AF_NETLINK address family 2022-01-24 19:29:14 -05:00			`RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK`
Add RestrictNamespaces=yes 2020-11-11 13:15:01 -05:00			`RestrictNamespaces=yes`
			`RestrictRealtime=yes`
Update systemd.service 2020-11-11 10:02:30 -05:00			`DevicePolicy=closed`
Update systemd.service 2022-01-19 13:40:39 -05:00			`ProtectClock=yes`
			`ProtectHostname=yes`
			`ProtectProc=invisible`
Update systemd.service 2020-11-11 10:02:30 -05:00			`ProtectSystem=full`
			`ProtectControlGroups=yes`
			`ProtectKernelModules=yes`
			`ProtectKernelTunables=yes`
			`LockPersonality=yes`
Update systemd.service 2022-01-19 13:40:39 -05:00			`SystemCallArchitectures=native`
			`SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged`
Add RestrictNamespaces=yes 2020-11-11 13:15:01 -05:00
Remove two options that may in fact cause issues ... and add a bunch of CapabilityBoundingSet instructions that should be somewhat sane defaults ? 2020-11-11 12:50:52 -05:00			`# Denying access to capabilities that should not be relevant for webapps`
			`# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html`
			`CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD`
			`CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE`
			`CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT`
			`CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK`
			`CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM`
			`CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG`
			`CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE`
			`CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW`
spaces 2022-07-02 12:44:48 -04:00			`CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG`
Remove two options that may in fact cause issues ... and add a bunch of CapabilityBoundingSet instructions that should be somewhat sane defaults ? 2020-11-11 12:50:52 -05:00
Add a systemd default file 2017-09-05 11:47:31 -04:00			`[Install]`
			`WantedBy=multi-user.target`