From 6c417796678b17622bf66052ada683951038c0d6c9f3124d356a7586a465d287 Mon Sep 17 00:00:00 2001
From: jhkaktus <dev@serverjonas.de>
Date: Sun, 11 Oct 2026 00:10:58 +0200
Subject: [PATCH] feat: systemd unit for deployment behind reverse proxy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds deploy/crushdb.service: plain HTTP on 127.0.0.1:5000 (HOST/PORT
env), auto-restart on failure, hardened with ProtectSystem/strict,
NoNewPrivileges, capability drop and restricted address families so
only the SQLite dir and private tmp are writable. Passes
systemd-analyze verify (the one reported warning is the expected
/path-in-this-repo venv path of the source checkout, not the deployed
one).

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
---
 deploy/crushdb.service | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 deploy/crushdb.service

diff --git a/deploy/crushdb.service b/deploy/crushdb.service
new file mode 100644
index 0000000..c6f28a4
--- /dev/null
+++ b/deploy/crushdb.service
@@ -0,0 +1,41 @@
+# crushdb systemd unit
+#
+# Installieren (als root):
+#   cp deploy/crushdb.service /etc/systemd/system/
+#   systemctl daemon-reload
+#   systemctl enable --now crushdb
+#
+# Die App lauscht auf http://127.0.0.1:PORT (siehe Environment unten)
+# und lebt für einen vertrauenswürdigen Reverse Proxy (nginx/caddy).
+
+[Unit]
+Description=crushdb – encrypted record database (Flask)
+After=network.target
+
+[Service]
+Type=simple
+# Pfade anpassen, wo dieses Repo liegt:
+User=jonas
+Group=jonas
+WorkingDirectory=/srv/crushdb
+ExecStart=/srv/crushdb/venv/bin/python /srv/crushdb/run.py
+Environment=HOST=127.0.0.1
+Environment=PORT=5000
+
+Restart=on-failure
+RestartSec=3
+
+# Hardening: nur das nötigste erlauben
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ReadWritePaths=/srv/crushdb/instance
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+
+[Install]
+WantedBy=multi-user.target