feat(general): Rework default paths, harden service
This commit is contained in:
jeanluc
20
gitea/files/default/gitea.main.socket.j2
Normal file
20
gitea/files/default/gitea.main.socket.j2
Normal file
@@ -0,0 +1,20 @@
|
||||
{%- if "unix" in gitea.config | traverse("server:protocol", "http") -%}
|
||||
{%- set stream = gitea.config | traverse("server:http_addr", "/run/gitea/gitea.socket") -%}
|
||||
{%- else -%}
|
||||
{%- set stream = gitea.config | traverse("server:http_port", "3000") -%}
|
||||
{%- if gitea.config | traverse("server:http_addr", "") -%}
|
||||
{%- set stream = gitea.config.server.http_addr ~ ":" ~ stream -%}
|
||||
{%- endif -%}
|
||||
{%- endif -%}
|
||||
|
||||
[Unit]
|
||||
Description=Gitea Web Socket
|
||||
PartOf={{ gitea.lookup.service.name }}.service
|
||||
|
||||
[Socket]
|
||||
Service={{ gitea.lookup.service.name }}.service
|
||||
ListenStream={{ stream }}
|
||||
NoDelay=true
|
||||
|
||||
[Install]
|
||||
WantedBy=sockets.target
|
||||
@@ -1,103 +1,107 @@
|
||||
{#- To keep the below "readable", set short vars here. -#}
|
||||
{%- set work = gitea.lookup.paths.work -%}
|
||||
{%- set bin = gitea.lookup.paths.bin | path_join('gitea') -%}
|
||||
{%- set user = gitea.lookup.user -%}
|
||||
{%- set home = salt['user.info'](gitea.lookup.user).home -%}
|
||||
{%- set config = gitea.lookup.paths.conf | path_join('app.ini') -%}
|
||||
{%- set custom_needed = gitea.lookup.paths.custom != (gitea.lookup.paths.work | path_join('custom')) -%}
|
||||
{%- set custom = gitea.lookup.paths.custom -%}
|
||||
{%- set rw = gitea._rw + [
|
||||
gitea.lookup.paths.conf | path_join("app.ini")
|
||||
] -%}
|
||||
|
||||
{%- set needs_port_cap =
|
||||
gitea.config | traverse("server:http_port", 3000) < 1024
|
||||
or (
|
||||
not gitea.config | traverse("server:disable_ssh", false)
|
||||
and gitea.config | traverse("server:start_ssh_server", false)
|
||||
and gitea.config | traverse("server:ssh_port", 22) < 1024
|
||||
)
|
||||
-%}
|
||||
|
||||
{%- set needs_custom = gitea.lookup.paths.custom != (gitea.lookup.paths.work | path_join('custom')) -%}
|
||||
|
||||
# https://github.com/archlinux/svntogit-community/blob/3474a4abbfa932796b33cf5d11d9e5312cebec1a/trunk/gitea.service
|
||||
|
||||
[Unit]
|
||||
Description=Gitea (Git with a cup of tea)
|
||||
After=syslog.target
|
||||
Documentation=https://docs.gitea.io/en-us/
|
||||
After=network.target
|
||||
|
||||
{%- if gitea.service.socket_activation %}
|
||||
After={{ gitea.lookup.service.name }}.main.socket
|
||||
Requires={{ gitea.lookup.service.name }}.main.socket
|
||||
{%- endif %}
|
||||
|
||||
{%- if gitea.service.wants %}
|
||||
{%- for wanted in gitea.service.wants %}
|
||||
Wants={{ wanted }}.service
|
||||
After={{ wanted }}.service
|
||||
Wants={{ wanted }}{{ ".service" if "." not in wanted }}
|
||||
After={{ wanted }}{{ ".service" if "." not in wanted }}
|
||||
{%- endfor %}
|
||||
{%- endif %}
|
||||
|
||||
{%- if gitea.service.requires_mount %}
|
||||
{%- for mount in gitea.service.requires_mount %}
|
||||
RequiresMountsFor={{ mount }}
|
||||
{%- endfor %}
|
||||
{%- endif %}
|
||||
###
|
||||
# Don't forget to add the database service dependencies
|
||||
###
|
||||
#
|
||||
#Wants=mysql.service
|
||||
#After=mysql.service
|
||||
#
|
||||
#Wants=mariadb.service
|
||||
#After=mariadb.service
|
||||
#
|
||||
#Wants=postgresql.service
|
||||
#After=postgresql.service
|
||||
#
|
||||
#Wants=memcached.service
|
||||
#After=memcached.service
|
||||
#
|
||||
#Wants=redis.service
|
||||
#After=redis.service
|
||||
#
|
||||
###
|
||||
# If using socket activation for main http/s
|
||||
###
|
||||
#
|
||||
#After=gitea.main.socket
|
||||
#Requires=gitea.main.socket
|
||||
#
|
||||
###
|
||||
# (You can also provide gitea an http fallback and/or ssh socket too)
|
||||
#
|
||||
# An example of /etc/systemd/system/gitea.main.socket
|
||||
###
|
||||
##
|
||||
## [Unit]
|
||||
## Description=Gitea Web Socket
|
||||
## PartOf=gitea.service
|
||||
##
|
||||
## [Socket]
|
||||
## Service=gitea.service
|
||||
## ListenStream=<some_port>
|
||||
## NoDelay=true
|
||||
##
|
||||
## [Install]
|
||||
## WantedBy=sockets.target
|
||||
##
|
||||
###
|
||||
|
||||
[Service]
|
||||
# Modify these two values and uncomment them if you have
|
||||
# repos with lots of files and get an HTTP error 500 because
|
||||
# of that
|
||||
###
|
||||
#LimitMEMLOCK=infinity
|
||||
#LimitNOFILE=65535
|
||||
RestartSec=2s
|
||||
ExecStart={{ gitea.lookup.paths.bin | path_join("gitea") }} web --config '{{ gitea.lookup.paths.conf | path_join("app.ini") }}'
|
||||
Environment=USER={{ gitea.lookup.user }} HOME={{ gitea.lookup.paths.work }} GITEA_WORK_DIR={{ gitea.lookup.paths.work }}
|
||||
{%- if needs_custom %} GITEA_CUSTOM={{ gitea.lookup.paths.custom }}{%- endif %}
|
||||
|
||||
# Process management
|
||||
####################
|
||||
Type=simple
|
||||
User={{ user }}
|
||||
Group={{ gitea.lookup.group }}
|
||||
WorkingDirectory={{ work }}
|
||||
# If using Unix socket: tells systemd to create the /run/gitea folder, which will contain the gitea.sock file
|
||||
# (manually creating /run/gitea doesn't work, because it would not persist across reboots)
|
||||
#RuntimeDirectory=gitea
|
||||
ExecStart={{ bin }} web --config '{{ config }}'
|
||||
Restart=always
|
||||
Environment=USER={{ user }} HOME={{ home }} GITEA_WORK_DIR={{ work }}{% if custom_needed %} GITEA_CUSTOM={{ custom }}{% endif %}
|
||||
# If you install Git to directory prefix other than default PATH (which happens
|
||||
# for example if you install other versions of Git side-to-side with
|
||||
# distribution version), uncomment below line and add that prefix to PATH
|
||||
# Don't forget to place git-lfs binary on the PATH below if you want to enable
|
||||
# Git LFS support
|
||||
#Environment=PATH=/path/to/git/bin:/bin:/sbin:/usr/bin:/usr/sbin
|
||||
# If you want to bind Gitea to a port below 1024, uncomment
|
||||
# the two values below, or use socket activation to pass Gitea its ports as above
|
||||
###
|
||||
#CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
||||
#AmbientCapabilities=CAP_NET_BIND_SERVICE
|
||||
###
|
||||
RestartSec=2s
|
||||
|
||||
# Directory creation and permissions
|
||||
####################################
|
||||
User={{ gitea.lookup.user }}
|
||||
Group={{ gitea.lookup.group }}
|
||||
WorkingDirectory={{ gitea.lookup.paths.work }}
|
||||
{%- if "unix" in gitea.config | traverse("server:protocol", "") %}
|
||||
RuntimeDirectory=gitea
|
||||
{%- endif %}
|
||||
|
||||
{%- if "file" in gitea.config | traverse("log:mode", "console") %}
|
||||
{%- if "/var/log/gitea" == gitea.lookup.paths.log %}
|
||||
LogsDirectory=gitea
|
||||
{%- else %}
|
||||
{%- do rw.append(gitea.lookup.paths.log) %}
|
||||
{%- endif %}
|
||||
{%- endif %}
|
||||
|
||||
{%- if "/var/lib/gitea" == gitea.lookup.paths.work %}
|
||||
StateDirectory=gitea
|
||||
{%- else %}
|
||||
{%- do rw.append(gitea.lookup.paths.work) %}
|
||||
{%- endif %}
|
||||
ReadWritePaths={{ rw | join(" ") }}
|
||||
|
||||
# Hardening measures
|
||||
####################
|
||||
# https://wiki.archlinux.org/title/Gitea#Binding_on_restricted_ports
|
||||
AmbientCapabilities={{ "CAP_NET_BIND_SERVICE" if needs_port_cap }}
|
||||
CapabilityBoundingSet={{ "CAP_NET_BIND_SERVICE" if needs_port_cap }}
|
||||
PrivateUsers={{ (not needs_port_cap) | string | lower }}
|
||||
LockPersonality=true
|
||||
# Required by commit search
|
||||
#MemoryDenyWriteExecute=true
|
||||
NoNewPrivileges=True
|
||||
#SecureBits=noroot-locked
|
||||
PrivateDevices=true
|
||||
PrivateTmp=true
|
||||
ProtectClock=true
|
||||
ProtectControlGroups=true
|
||||
ProtectHome=true
|
||||
ProtectHostname=true
|
||||
ProtectKernelLogs=true
|
||||
ProtectKernelModules=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectProc=invisible
|
||||
ProtectSystem=strict
|
||||
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
|
||||
RestrictNamespaces=true
|
||||
RestrictRealtime=true
|
||||
RestrictSUIDSGID=true
|
||||
SystemCallArchitectures=native
|
||||
SystemCallFilter=@system-service
|
||||
SystemCallErrorNumber=EPERM
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
||||
Reference in New Issue
Block a user