diff options
| author | Salamandar <6552989+Salamandar@users.noreply.github.com> | 2024-05-27 14:56:29 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-05-27 14:56:29 +0200 |
| commit | 8003baea29c5a5679c7475078ef16263e911b116 (patch) | |
| tree | cf5d2bb10ddb7e32b53ba0de888007b6f8341782 /conf/mastodon-sidekiq.service | |
| parent | a75e6726bca8d3b8a076da4164cd7a18ed29d06e (diff) | |
| parent | 7727e250c3c616bc59c311f20ec6d3e7f773d5da (diff) | |
| download | mastodon_ynh-8003baea29c5a5679c7475078ef16263e911b116.tar.gz mastodon_ynh-8003baea29c5a5679c7475078ef16263e911b116.tar.bz2 mastodon_ynh-8003baea29c5a5679c7475078ef16263e911b116.zip | |
Merge pull request #449 from YunoHost-Apps/testing
Testing Packaging v2
Diffstat (limited to 'conf/mastodon-sidekiq.service')
| -rw-r--r-- | conf/mastodon-sidekiq.service | 22 |
1 files changed, 12 insertions, 10 deletions
diff --git a/conf/mastodon-sidekiq.service b/conf/mastodon-sidekiq.service index 25a46fb..14bd592 100644 --- a/conf/mastodon-sidekiq.service +++ b/conf/mastodon-sidekiq.service @@ -5,15 +5,17 @@ After=network.target [Service] Type=simple User=__APP__ -WorkingDirectory=__FINALPATH__/live +WorkingDirectory=__INSTALL_DIR__/live Environment="__LD_PRELOAD__" Environment="RAILS_ENV=production" Environment="DB_POOL=25" Environment="MALLOC_ARENA_MAX=2" Environment="__YNH_RUBY_LOAD_PATH__" -ExecStart=__FINALPATH__/live/bin/bundle exec sidekiq -c 25 +ExecStart=__INSTALL_DIR__/live/bin/bundle exec sidekiq -c 25 TimeoutSec=15 Restart=always +StandardOutput=append:/var/log/__APP__/__APP__-sidekiq.log +StandardError=inherit # Sandboxing options to harden security # Depending on specificities of your service/app, you may need to tweak these @@ -21,17 +23,17 @@ Restart=always # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html NoNewPrivileges=no PrivateTmp=yes -#PrivateDevices=yes -#RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK -#RestrictNamespaces=yes -#RestrictRealtime=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK +RestrictNamespaces=yes +RestrictRealtime=yes DevicePolicy=closed ProtectSystem=full ProtectControlGroups=yes -#ProtectKernelModules=yes -#ProtectKernelTunables=yes -#LockPersonality=yes -#SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap # Denying access to capabilities that should not be relevant for webapps # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html |