49 lines
1.2 KiB
Bash
Executable File
49 lines
1.2 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
cd "$(dirname "$0")/.."
|
|
|
|
service=deploy/systemd/system/jwebot-extension-host@.service
|
|
socket=deploy/systemd/system/jwebot-extension-host@.socket
|
|
|
|
test -f "$service"
|
|
test -f "$socket"
|
|
|
|
for setting in \
|
|
'User=jwebot-ext' \
|
|
'Group=jwebot-ext' \
|
|
'Environment=PYTHONDONTWRITEBYTECODE=1' \
|
|
'ConditionPathExists=/etc/jwebot-extension-host/allowed_signers' \
|
|
'ExecStart=/opt/jwebot-extension-host/venv/bin/python -I -m jwebot_extension_host --release-dir /var/lib/jwebot-extensions/%i/current --allowed-signers /etc/jwebot-extension-host/allowed_signers' \
|
|
'StandardInput=socket' \
|
|
'StandardOutput=socket' \
|
|
'NoNewPrivileges=true' \
|
|
'CapabilityBoundingSet=' \
|
|
'PrivateNetwork=true' \
|
|
'ProtectSystem=strict' \
|
|
'ProtectHome=true' \
|
|
'MemoryDenyWriteExecute=true' \
|
|
'RestrictAddressFamilies=AF_UNIX' \
|
|
'RuntimeMaxSec=12s' \
|
|
'MemoryMax=128M' \
|
|
'TasksMax=16' \
|
|
'LimitCORE=0'
|
|
do
|
|
grep -Fxq "$setting" "$service"
|
|
done
|
|
|
|
for setting in \
|
|
'SocketUser=jwebot' \
|
|
'SocketGroup=jwebot' \
|
|
'SocketMode=0600' \
|
|
'RemoveOnStop=true'
|
|
do
|
|
grep -Fxq "$setting" "$socket"
|
|
done
|
|
|
|
if [ "${JWEBOT_VERIFY_SYSTEMD:-0}" = 1 ] &&
|
|
command -v systemd-analyze >/dev/null 2>&1
|
|
then
|
|
systemd-analyze verify "$service" "$socket"
|
|
fi
|