fixup! Add sandboxing to systemd examples

bookwyrm-social · Aug 24, 2023 · bd765a7 · bd765a7
1 parent 8e8d850
commit bd765a7
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 9 deletions.
diff --git a/contrib/systemd/bookwyrm-scheduler.service b/contrib/systemd/bookwyrm-scheduler.service
@@ -5,15 +5,16 @@ After=network.target postgresql.service redis.service
 [Service]
 User=bookwyrm
 Group=bookwyrm
-WorkingDirectory=/opt/bookwyrm/
+WorkingDirectory=/opt/bookwyrm
 ExecStart=/opt/bookwyrm/venv/bin/celery -A celerywyrm beat -l INFO --scheduler django_celery_beat.schedulers:DatabaseScheduler
 StandardOutput=journal
 StandardError=inherit
 ProtectSystem=strict
 ProtectHome=tmpfs
 InaccessiblePaths=-/media -/mnt -/srv
-TemporaryFileSystem=/tmp /var /run
-BindPaths=/run/postgresql /var/run/postgresql /var/tmp /opt/bookwyrm
+PrivateTmp=yes
+TemporaryFileSystem=/var /run /opt
+BindPaths=/opt/bookwyrm /var/run/postgresql
 PrivateUsers=true
 
 [Install]

diff --git a/contrib/systemd/bookwyrm-worker.service b/contrib/systemd/bookwyrm-worker.service
@@ -5,15 +5,16 @@ After=network.target postgresql.service redis.service
 [Service]
 User=bookwyrm
 Group=bookwyrm
-WorkingDirectory=/opt/bookwyrm/
+WorkingDirectory=/opt/bookwyrm
 ExecStart=/opt/bookwyrm/venv/bin/celery -A celerywyrm worker -l info -Q high_priority,medium_priority,low_priority,streams,images,suggested_users,email,connectors,lists,inbox,imports,import_triggered,broadcast,misc
 StandardOutput=journal
 StandardError=inherit
 ProtectSystem=strict
 ProtectHome=tmpfs
 InaccessiblePaths=-/media -/mnt -/srv
-TemporaryFileSystem=/tmp /var /run
-BindPaths=/run/postgresql /var/run/postgresql /var/tmp /opt/bookwyrm
+PrivateTmp=yes
+TemporaryFileSystem=/var /run /opt
+BindPaths=/opt/bookwyrm /var/run/postgresql
 PrivateUsers=true
 
 [Install]

diff --git a/contrib/systemd/bookwyrm.service b/contrib/systemd/bookwyrm.service
@@ -5,15 +5,16 @@ After=network.target postgresql.service redis.service
 [Service]
 User=bookwyrm
 Group=bookwyrm
-WorkingDirectory=/opt/bookwyrm/
+WorkingDirectory=/opt/bookwyrm
 ExecStart=/opt/bookwyrm/venv/bin/gunicorn bookwyrm.wsgi:application --bind 0.0.0.0:8000
 StandardOutput=journal
 StandardError=inherit
 ProtectSystem=strict
 ProtectHome=tmpfs
 InaccessiblePaths=-/media -/mnt -/srv
-TemporaryFileSystem=/tmp /var /run
-BindPaths=/run/postgresql /var/run/postgresql /var/tmp /opt/bookwyrm
+PrivateTmp=yes
+TemporaryFileSystem=/var /run /opt
+BindPaths=/opt/bookwyrm /var/run/postgresql
 PrivateUsers=true
 
 [Install]