From e848e1466b17d5c7b358dddc4b1387975e657c8a Mon Sep 17 00:00:00 2001 From: AJ ONeal Date: Thu, 31 May 2018 02:38:01 -0600 Subject: [PATCH] update systemd configs --- .../skel/.config/systemd/user/telebit.service | 61 +++++++++++++++++++ .../{telebitd.service => telebit.service} | 4 +- installer/get.sh | 34 ++++++++--- 3 files changed, 90 insertions(+), 9 deletions(-) create mode 100644 dist/etc/skel/.config/systemd/user/telebit.service rename dist/etc/systemd/system/{telebitd.service => telebit.service} (98%) diff --git a/dist/etc/skel/.config/systemd/user/telebit.service b/dist/etc/skel/.config/systemd/user/telebit.service new file mode 100644 index 0000000..735d353 --- /dev/null +++ b/dist/etc/skel/.config/systemd/user/telebit.service @@ -0,0 +1,61 @@ +# Pre-req +# sudo adduser telebit --home /opt/telebit +# sudo mkdir -p /opt/telebit/ +# sudo chown -R telebit:telebit /opt/telebit/ + +[Unit] +Description=Telebit Remote +Documentation=https://git.coolaj86.com/coolaj86/telebit.js/ + +[Service] +# Restart on crash (bad signal), but not on 'clean' failure (error exit code) +# Allow up to 3 restarts within 10 seconds +# (it's unlikely that a user or properly-running script will do this) +Restart=always +StartLimitInterval=10 +StartLimitBurst=3 + +# https://wiki.archlinux.org/index.php/Systemd/User +# ~/.local/share/systemd/user/ +WorkingDirectory=%h/.config/telebit +# custom directory cannot be set and will be the place where gitea exists, not the working directory +ExecStart=/opt/telebit/bin/node /opt/telebit/bin/telebit.js --config /etc/telebit/telebit.yml +ExecReload=/bin/kill -USR1 $MAINPID + +# Limit the number of file descriptors and processes; see `man systemd.exec` for more limit settings. +# Unmodified gitea is not expected to use more than this. +LimitNOFILE=1048576 +LimitNPROC=64 + +# Use private /tmp and /var/tmp, which are discarded after gitea stops. +PrivateTmp=true +# Use a minimal /dev +PrivateDevices=true +# Hide /home, /root, and /run/user. Nobody will steal your SSH-keys. +ProtectHome=true +# Make /usr, /boot, /etc and possibly some more folders read-only. +ProtectSystem=full +# ... except /opt/gitea because we want a place for the database +# and /var/log/gitea because we want a place where logs can go. +# This merely retains r/w access rights, it does not add any new. +# Must still be writable on the host! +ReadWriteDirectories=/opt/telebit /etc/telebit + +# Note: in v231 and above ReadWritePaths has been renamed to ReadWriteDirectories +; ReadWritePaths=/opt/telebit /etc/telebit + +# The following additional security directives only work with systemd v229 or later. +# They further retrict privileges that can be gained by gitea. +# Note that you may have to add capabilities required by any plugins in use. +CapabilityBoundingSet=CAP_NET_BIND_SERVICE +AmbientCapabilities=CAP_NET_BIND_SERVICE +NoNewPrivileges=true + +# Caveat: Some features may need additional capabilities. +# For example an "upload" may need CAP_LEASE +; CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_LEASE +; AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_LEASE +; NoNewPrivileges=true + +[Install] +WantedBy=multi-user.target diff --git a/dist/etc/systemd/system/telebitd.service b/dist/etc/systemd/system/telebit.service similarity index 98% rename from dist/etc/systemd/system/telebitd.service rename to dist/etc/systemd/system/telebit.service index bc9e636..a9c1ca5 100644 --- a/dist/etc/systemd/system/telebitd.service +++ b/dist/etc/systemd/system/telebit.service @@ -4,7 +4,7 @@ # sudo chown -R telebit:telebit /opt/telebit/ [Unit] -Description=Telebit Relay +Description=Telebit Remote Documentation=https://git.coolaj86.com/coolaj86/telebit.js/ After=network-online.target Wants=network-online.target systemd-networkd-wait-online.service @@ -13,7 +13,7 @@ Wants=network-online.target systemd-networkd-wait-online.service # Restart on crash (bad signal), but not on 'clean' failure (error exit code) # Allow up to 3 restarts within 10 seconds # (it's unlikely that a user or properly-running script will do this) -Restart=on-abnormal +Restart=always StartLimitInterval=10 StartLimitBurst=3 diff --git a/installer/get.sh b/installer/get.sh index 5ee9b0c..acce785 100644 --- a/installer/get.sh +++ b/installer/get.sh @@ -191,18 +191,38 @@ if [ -z "$(cat /etc/passwd | grep $my_user)" ]; then sudo adduser --home $TELEBIT_PATH --gecos '' --disabled-password $my_user >/dev/null 2>&1 fi -if [ ! -f "/etc/$my_user/$my_app.yml" ]; then - echo "### Creating config file from template. sudo may be required" - #echo "sudo rsync -a examples/$my_app.yml /etc/$my_user/$my_app.yml" - sudo bash -c "echo 'email: $my_email' >> /etc/$my_user/$my_app.yml" - sudo bash -c "echo 'secret: $my_secret' >> /etc/$my_user/$my_app.yml" - sudo bash -c "echo 'servernames: [ $my_servernames ]' >> /etc/$my_user/$my_app.yml" - sudo bash -c "cat examples/$my_app.yml.tpl >> /etc/$my_user/$my_app.yml" +my_config="$TELEBIT_PATH/etc/$my_app.yml" +mkdir -p "$(dirname $my_config)" +if [ ! -e "$my_config" ]; then + #rsync -a examples/$my_app.yml "$my_config" + echo "email: $my_email" >> "$my_config" + echo "secret: $my_secret" >> "$my_config" + echo "servernames:\n $my_servernames: {}" >> "$my_config" + #echo "dynamic_ports:\n {}" >> "$my_config" + cat examples/$my_app.yml.tpl >> "$my_config" +fi + +my_config="$HOME/.config/$my_user/$my_app.yml" +mkdir -p "$(dirname $my_config)" +if [ ! -e "$my_config" ]; then + echo "cli: true" >> "$my_config" + echo "email: $my_email" >> "$my_config" + echo "secret: $my_secret" >> "$my_config" + cat examples/$my_app.yml.tpl >> "$my_config" +fi + +my_config_link="/etc/$my_user/$my_app.yml" +if [ ! -e "$my_config_link" ]; then + echo "sudo ln -sf '$my_config' '$my_config_link'" + #sudo mkdir -p /etc/$my_user + sudo ln -sf "$my_config" "$my_config_link" fi echo "sudo chown -R $my_user '$TELEBIT_PATH' '/etc/$my_user'" sudo chown -R $my_user "$TELEBIT_PATH" "/etc/$my_user" +# ~/.config/systemd/user/ +# %h/.config/telebit/telebit.yml echo "### Adding $my_app is a system service" echo "sudo rsync -a $TELEBIT_PATH/dist/etc/systemd/system/$my_app.service /etc/systemd/system/$my_app.service" sudo rsync -a $TELEBIT_PATH/dist/etc/systemd/system/$my_app.service /etc/systemd/system/$my_app.service