diff options
| author | eric_G <46165813+ericgaspar@users.noreply.github.com> | 2025-09-01 11:40:59 +0200 |
|---|---|---|
| committer | eric_G <46165813+ericgaspar@users.noreply.github.com> | 2025-09-01 11:40:59 +0200 |
| commit | f153dc5aa68f66d3fabe39baa54f7fcdad8e3ebf (patch) | |
| tree | 3ec47391ead537455cb4c613fc22654258a1d07c /conf/mastodon-streaming.service | |
| parent | 8d27dd88c49efc56bf983df313dc42af26c63a77 (diff) | |
| parent | edbf9871a19fd30634d86e7ff41d4f33b92521d4 (diff) | |
| download | mastodon_ynh-f153dc5aa68f66d3fabe39baa54f7fcdad8e3ebf.tar.gz mastodon_ynh-f153dc5aa68f66d3fabe39baa54f7fcdad8e3ebf.tar.bz2 mastodon_ynh-f153dc5aa68f66d3fabe39baa54f7fcdad8e3ebf.zip | |
Merge branch 'testing' into pr/466
Diffstat (limited to 'conf/mastodon-streaming.service')
| -rw-r--r-- | conf/mastodon-streaming.service | 40 |
1 files changed, 22 insertions, 18 deletions
diff --git a/conf/mastodon-streaming.service b/conf/mastodon-streaming.service index f63945e..735fe4c 100644 --- a/conf/mastodon-streaming.service +++ b/conf/mastodon-streaming.service @@ -1,5 +1,5 @@ [Unit] -Description=__APP__-streaming +Description=__APP__-streaming on port __PORT_STREAM__ After=network.target [Service] @@ -9,29 +9,33 @@ WorkingDirectory=__INSTALL_DIR__/live Environment="NODE_ENV=production" Environment="PORT=__PORT_STREAM__" Environment="STREAMING_CLUSTER_NUM=1" -Environment="__YNH_NODE_LOAD_PATH__" -ExecStart=__YNH_NODE__ ./streaming +Environment="PATH=__PATH_WITH_NODEJS__" +ExecStart=__NODEJS_DIR__/node ./streaming TimeoutSec=15 Restart=always StandardOutput=append:/var/log/__APP__/__APP__-streaming.log StandardError=inherit -# Sandboxing options to harden security -# Depending on specificities of your service/app, you may need to tweak these -# .. but this should be a good baseline -# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html -NoNewPrivileges=yes -PrivateTmp=yes -PrivateDevices=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK -RestrictNamespaces=yes -RestrictRealtime=yes -DevicePolicy=closed +# Proc filesystem +# Capabilities +# Security +NoNewPrivileges=true +# Sandboxing ProtectSystem=full -ProtectControlGroups=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -LockPersonality=yes +PrivateTmp=true +PrivateDevices=true +ProtectKernelModules=true +ProtectKernelTunables=true +ProtectControlGroups=true +RestrictAddressFamilies=AF_INET +RestrictAddressFamilies=AF_INET6 +RestrictAddressFamilies=AF_NETLINK +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=true +LockPersonality=true +RestrictRealtime=true +DevicePolicy=closed +# System Call Filtering SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap # Denying access to capabilities that should not be relevant for webapps |