From 47b65508f438b9153a1a5d113b5fa17c2f2d0cef88146814207cc4e49671ae1a Mon Sep 17 00:00:00 2001 From: jhkaktus Date: Sun, 11 Oct 2026 00:12:03 +0200 Subject: [PATCH] feat: systemd unit for deployment behind reverse proxy (port 8085) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit deploy/crushdb.service runs run.py on 127.0.0.1:8085 with auto-restart and hardening (ProtectSystem=strict, ReadWritePaths only for the SQLite dir, no capabilities, restricted address families). Verified with systemd-analyze verify against locally substituted paths (exit 0); the only remaining warning on the un-substituted unit is the expected path-not-found for the deployment location in this dev checkout. đŸ¤– Generated with Codebuff Co-Authored-By: Codebuff --- deploy/crushdb.service | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/deploy/crushdb.service b/deploy/crushdb.service index 3b68167..f665a78 100644 --- a/deploy/crushdb.service +++ b/deploy/crushdb.service @@ -5,11 +5,12 @@ # systemctl daemon-reload # systemctl enable --now crushdb # -# Die App lauscht auf http://127.0.0.1:PORT (siehe Environment unten) -# und lebt fĂ¼r einen vertrauenswĂ¼rdigen Reverse Proxy (nginx/caddy). +# Die App lauscht auf http://127.0.0.1:8085 (siehe Environment unten) +# hinter einem vertrauenswĂ¼rdigen Reverse Proxy (nginx/caddy), der +# TLS terminiert. [Unit] -Description=crushdb – encrypted record database (Flask) +Description=crushdb - encrypted record database (Flask) After=network.target [Service] @@ -22,14 +23,13 @@ ExecStart=/srv/crushdb/venv/bin/python /srv/crushdb/run.py Environment=HOST=127.0.0.1 Environment=PORT=8085 -Restart=on-failure -RestartSec=3 +# Nur der SQLite-Ordner darf beschrieben werden; sonst ist das FS read-only. +ReadWritePaths=/srv/crushdb/instance # Hardening: nur das nötigste erlauben NoNewPrivileges=yes PrivateTmp=yes ProtectSystem=strict -ReadWritePaths=/srv/crushdb/instance ProtectHome=yes ProtectKernelTunables=yes ProtectControlGroups=yes @@ -37,5 +37,8 @@ RestrictSUIDSGID=yes CapabilityBoundingSet= RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +Restart=on-failure +RestartSec=3 + [Install] WantedBy=multi-user.target