SHA256
jhkaktus
47b65508f4
deploy/crushdb.service runs run.py on 127.0.0.1:8085 with auto-restart and hardening (ProtectSystem=strict, ReadWritePaths only for the SQLite dir, no capabilities, restricted address families). Verified with systemd-analyze verify against locally substituted paths (exit 0); the only remaining warning on the un-substituted unit is the expected path-not-found for the deployment location in this dev checkout. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
45 lines
1.1 KiB
Desktop File
45 lines
1.1 KiB
Desktop File
# crushdb systemd unit
|
|
#
|
|
# Installieren (als root):
|
|
# cp deploy/crushdb.service /etc/systemd/system/
|
|
# systemctl daemon-reload
|
|
# systemctl enable --now crushdb
|
|
#
|
|
# Die App lauscht auf http://127.0.0.1:8085 (siehe Environment unten)
|
|
# hinter einem vertrauenswürdigen Reverse Proxy (nginx/caddy), der
|
|
# TLS terminiert.
|
|
|
|
[Unit]
|
|
Description=crushdb - encrypted record database (Flask)
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
# Pfade anpassen, wo dieses Repo liegt:
|
|
User=jonas
|
|
Group=jonas
|
|
WorkingDirectory=/srv/crushdb
|
|
ExecStart=/srv/crushdb/venv/bin/python /srv/crushdb/run.py
|
|
Environment=HOST=127.0.0.1
|
|
Environment=PORT=8085
|
|
|
|
# Nur der SQLite-Ordner darf beschrieben werden; sonst ist das FS read-only.
|
|
ReadWritePaths=/srv/crushdb/instance
|
|
|
|
# Hardening: nur das nötigste erlauben
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectControlGroups=yes
|
|
RestrictSUIDSGID=yes
|
|
CapabilityBoundingSet=
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
|
|
Restart=on-failure
|
|
RestartSec=3
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|