74 lines
2.8 KiB
Desktop File
74 lines
2.8 KiB
Desktop File
# The Daily EPUB — rating endpoints, XTC OPDS feed and static files (spec §3.12, §3.15).
|
|
#
|
|
# Install:
|
|
# cargo build --release && sudo install -m0755 target/release/daily-epub /usr/local/bin/
|
|
# sudo install -d -m0750 -o daily-epub -g daily-epub /etc/daily-epub
|
|
# sudo install -m0640 -o daily-epub -g daily-epub config.example.toml /etc/daily-epub/config.toml
|
|
# printf 'DAILY_EPUB_SERVER__HMAC_SECRET=%s\n' "$(openssl rand -hex 32)" \
|
|
# | sudo tee /etc/daily-epub/env >/dev/null # plus DAILY_EPUB_MINIFLUX__API_KEY etc.
|
|
# sudo chmod 0600 /etc/daily-epub/env
|
|
# sudo useradd --system --home /var/lib/daily-epub --shell /usr/sbin/nologin daily-epub
|
|
# sudo install -m0644 systemd/daily-epub*.{service,timer} /etc/systemd/system/
|
|
# sudo systemctl daemon-reload && sudo systemctl enable --now daily-epub.service
|
|
#
|
|
# Then reverse-proxy daily.hallada.net → 127.0.0.1:3499 (spec §3.15).
|
|
|
|
[Unit]
|
|
Description=The Daily EPUB server (ratings, XTC OPDS)
|
|
Documentation=https://github.com/thallada/the-daily-epub
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=exec
|
|
User=daily-epub
|
|
Group=daily-epub
|
|
# The Jobs page reads `journalctl -u daily-epub-job@<name>` (dashboard plan §14.3).
|
|
SupplementaryGroups=systemd-journal
|
|
ExecStart=/usr/local/bin/daily-epub --config /etc/daily-epub/config.toml serve
|
|
EnvironmentFile=-/etc/daily-epub/env
|
|
Environment=RUST_LOG=info,sqlx=warn,hyper=warn
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
# SIGTERM triggers the graceful shutdown in server::serve.
|
|
KillSignal=SIGTERM
|
|
TimeoutStopSec=20s
|
|
|
|
# --- state + writable paths ---------------------------------------------
|
|
StateDirectory=daily-epub
|
|
StateDirectoryMode=0750
|
|
WorkingDirectory=/var/lib/daily-epub
|
|
# The publish dirs from [publish] in config.toml — keep these in sync — plus
|
|
# /etc/daily-epub so the dashboard settings page can rewrite config.toml.
|
|
# Every path listed here must exist at start, or the unit fails with 226/NAMESPACE.
|
|
ReadWritePaths=/home/thallada/bookorbit/books/daily-epub /var/lib/daily-epub/xtc /etc/daily-epub
|
|
|
|
# --- hardening (spec §3.15) ---------------------------------------------
|
|
ProtectSystem=strict
|
|
# read-only (not yes): the BookOrbit publish dir lives under /home, and
|
|
# ProtectHome=yes would mask it even with the ReadWritePaths entry above.
|
|
ProtectHome=read-only
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
NoNewPrivileges=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
ProtectProc=invisible
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|
|
UMask=0027
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|