release: public alpha 0.6.0 baseline

deploy/systemd/system/jwebot-extension-host@.service

@@ -0,0 +1,55 @@
+[Unit]
+Description=JWeBot isolated extension host for %i
+After=local-fs.target
+Requires=jwebot-extension-host@%i.socket
+ConditionPathExists=/etc/jwebot-extension-host/allowed_signers
+
+[Service]
+Type=exec
+User=jwebot-ext
+Group=jwebot-ext
+Environment=PYTHONDONTWRITEBYTECODE=1
+ExecStart=/opt/jwebot-extension-host/venv/bin/python -I -m jwebot_extension_host --release-dir /var/lib/jwebot-extensions/%i/current --allowed-signers /etc/jwebot-extension-host/allowed_signers
+WorkingDirectory=/
+StandardInput=socket
+StandardOutput=socket
+StandardError=journal
+Restart=no
+TimeoutStartSec=12s
+RuntimeMaxSec=12s
+UMask=0077
+
+NoNewPrivileges=true
+CapabilityBoundingSet=
+AmbientCapabilities=
+PrivateTmp=true
+PrivateDevices=true
+PrivateNetwork=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectProc=invisible
+ProcSubset=pid
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+RestrictAddressFamilies=AF_UNIX
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@clock @debug @module @mount @obsolete @privileged @raw-io @reboot @swap
+
+MemoryMax=128M
+CPUQuota=50%
+TasksMax=16
+LimitNOFILE=64
+LimitNPROC=16
+LimitCORE=0
+
+ReadOnlyPaths=/var/lib/jwebot-extensions/%i
+InaccessiblePaths=/home /root /srv /mnt /media