Packaging v2 (#399)

* Convert to v2 (#383)

* convert script

* v2

* Auto-update README

* Update documentation cc @panomaki

* Bump ruby version from 3.0.6 to 3.2.2

* v2

* Auto-update README

* woops

* v2

* v2

* s/final_path/install_dir

* Update PRE_INSTALL.md

* too soon...

* v2

* v2

* v2

* Update tests.toml

* Update doc/PRE_INSTALL.md

Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org>

* Update doc/PRE_INSTALL_fr.md

Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org>

* Update tests.toml

Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org>

* Update tests.toml

Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org>

* Update doc/PRE_INSTALL.md

Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org>

* Update doc/PRE_INSTALL_fr.md

Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org>

* Apply suggestions

* Update manifest.toml

* Auto-update README

* Update manifest.toml

* Update scripts

* Auto-update README

* Remove SSO integration

* Use new mail mechanism

* cleaning

* Update manifest.toml

---------

Co-authored-by: yunohost-bot <yunohost@yunohost.org>
Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org>
Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com>

* Bump ynh version

* Auto-update README

* Update manifest.toml

* Update doc/PRE_INSTALL.md

Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org>

* Add service setting for app shell

* Use logrotate

* smtp config follow-up

Sidekiq service can be properly hardened since it doesn't use sendmail anymore o/

* Fix mkdir failing if /var/log/mastodon already exists

* upgrade: Rename database to match packaging v2

* Bump 4.1.6~ynh2

* Auto-update README

* Disable install.private test

* remove full_domain

* 4.1.7 (#403)

* 4.1.7

* Auto-update README

* Update manifest.toml

* Auto-update README

---------

Co-authored-by: yunohost-bot <yunohost@yunohost.org>
Co-authored-by: Tagada <36127788+Tagadda@users.noreply.github.com>

* fix

* fix

* Don't swap when running on a LXC

* Hardcore the needed RAM

* Auto-update README

* Auto-update README

* Update manifest.toml

* Auto-update README

* Update _common.sh

* Auto-update README

* cleaning

* cleaning

* Auto-update README

* Auto-update README

* Update tests.toml

* Fix restore

* Fix manifest.toml

* Auto-update README

* Auto-update README

* add `tootctl self-destruct` info

* format

* Auto-update README

* lol autotranslate

* break line

* break lines

* translation from french

* update version

* Auto-update README

* Update manifest.toml

---------

Co-authored-by: yunohost-bot <yunohost@yunohost.org>
Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org>
Co-authored-by: Éric Gaspar <46165813+ericgaspar@users.noreply.github.com>
Co-authored-by: ericgaspar <junk.eg@free.fr>
Co-authored-by: OniriCorpe <oniricorpe@disroot.org>

1 files changed, 12 insertions, 10 deletions

diff --git a/conf/mastodon-sidekiq.service b/conf/mastodon-sidekiq.service
index 25a46fb..14bd592 100644
--- a/conf/mastodon-sidekiq.service
+++ b/conf/mastodon-sidekiq.service
@@ -5,15 +5,17 @@ After=network.target
 [Service]
 Type=simple
 User=__APP__
-WorkingDirectory=__FINALPATH__/live
+WorkingDirectory=__INSTALL_DIR__/live
 Environment="__LD_PRELOAD__"
 Environment="RAILS_ENV=production"
 Environment="DB_POOL=25"
 Environment="MALLOC_ARENA_MAX=2"
 Environment="__YNH_RUBY_LOAD_PATH__"
-ExecStart=__FINALPATH__/live/bin/bundle exec sidekiq -c 25
+ExecStart=__INSTALL_DIR__/live/bin/bundle exec sidekiq -c 25
 TimeoutSec=15
 Restart=always
+StandardOutput=append:/var/log/__APP__/__APP__-sidekiq.log
+StandardError=inherit
 
 # Sandboxing options to harden security
 # Depending on specificities of your service/app, you may need to tweak these 
@@ -21,17 +23,17 @@ Restart=always
 # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
 NoNewPrivileges=no
 PrivateTmp=yes
-#PrivateDevices=yes
-#RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-#RestrictNamespaces=yes
-#RestrictRealtime=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=yes
+RestrictRealtime=yes
 DevicePolicy=closed
 ProtectSystem=full
 ProtectControlGroups=yes
-#ProtectKernelModules=yes
-#ProtectKernelTunables=yes
-#LockPersonality=yes
-#SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
 
 # Denying access to capabilities that should not be relevant for webapps
 # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html