SHA256
jhkaktus
6c41779667
Adds deploy/crushdb.service: plain HTTP on 127.0.0.1:5000 (HOST/PORT env), auto-restart on failure, hardened with ProtectSystem/strict, NoNewPrivileges, capability drop and restricted address families so only the SQLite dir and private tmp are writable. Passes systemd-analyze verify (the one reported warning is the expected /path-in-this-repo venv path of the source checkout, not the deployed one). 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
42 lines
985 B
Desktop File
42 lines
985 B
Desktop File
# crushdb systemd unit
|
||
#
|
||
# Installieren (als root):
|
||
# cp deploy/crushdb.service /etc/systemd/system/
|
||
# systemctl daemon-reload
|
||
# systemctl enable --now crushdb
|
||
#
|
||
# Die App lauscht auf http://127.0.0.1:PORT (siehe Environment unten)
|
||
# und lebt für einen vertrauenswürdigen Reverse Proxy (nginx/caddy).
|
||
|
||
[Unit]
|
||
Description=crushdb – encrypted record database (Flask)
|
||
After=network.target
|
||
|
||
[Service]
|
||
Type=simple
|
||
# Pfade anpassen, wo dieses Repo liegt:
|
||
User=jonas
|
||
Group=jonas
|
||
WorkingDirectory=/srv/crushdb
|
||
ExecStart=/srv/crushdb/venv/bin/python /srv/crushdb/run.py
|
||
Environment=HOST=127.0.0.1
|
||
Environment=PORT=5000
|
||
|
||
Restart=on-failure
|
||
RestartSec=3
|
||
|
||
# Hardening: nur das nötigste erlauben
|
||
NoNewPrivileges=yes
|
||
PrivateTmp=yes
|
||
ProtectSystem=strict
|
||
ReadWritePaths=/srv/crushdb/instance
|
||
ProtectHome=yes
|
||
ProtectKernelTunables=yes
|
||
ProtectControlGroups=yes
|
||
RestrictSUIDSGID=yes
|
||
CapabilityBoundingSet=
|
||
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|