diff options
| author | Leitwolf | 2026-10-23 06:36:56 +0300 |
|---|---|---|
| committer | GitHub | 2026-10-23 06:36:56 +0300 |
| commit | 7f1cb91eb16bc3d7fd78320465c32d5e2f47ec97 (patch) | |
| tree | 4e5f6caf530344fb13f2b892238d1e1b1f89c10c | |
| parent | d8c4fafd30647b0063e3ec52e1c4a95cf61106eb (diff) | |
| parent | a68bb18e2d750fabcbcff985b5fe921d7c828d7e (diff) | |
| download | progmaweb-feature/progmasoft-credentials.tar.gz | |
Merge branch 'main' into feature/progmasoft-credentialsfeature/progmasoft-credentials
| -rw-r--r-- | ops/systemd/progmaweb-api.service | 11 | ||||
| -rw-r--r-- | ops/systemd/progmaweb-web.service | 11 |
2 files changed, 22 insertions, 0 deletions
diff --git a/ops/systemd/progmaweb-api.service b/ops/systemd/progmaweb-api.service index daab684..e2ff8e7 100644 --- a/ops/systemd/progmaweb-api.service +++ b/ops/systemd/progmaweb-api.service @@ -24,13 +24,24 @@ TimeoutStopSec=30s # The API has no writable application files. Its state is in PostgreSQL, reached through the local Unix socket; the # connection string is in the environment file above. +UMask=0077 +AmbientCapabilities= +CapabilityBoundingSet= NoNewPrivileges=true +PrivateDevices=true PrivateTmp=true +ProtectClock=true ProtectHome=true +ProtectHostname=true ProtectSystem=strict +ProtectKernelLogs=true ProtectKernelTunables=true ProtectKernelModules=true ProtectControlGroups=true +RemoveIPC=true +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=true +RestrictRealtime=true RestrictSUIDSGID=true LockPersonality=true # MemoryDenyWriteExecute is intentionally omitted: CoreCLR's JIT requires managed executable mappings at runtime. diff --git a/ops/systemd/progmaweb-web.service b/ops/systemd/progmaweb-web.service index acf4690..47698bd 100644 --- a/ops/systemd/progmaweb-web.service +++ b/ops/systemd/progmaweb-web.service @@ -26,13 +26,24 @@ TimeoutStopSec=30s SuccessExitStatus=143 # Standalone Next.js only reads immutable release files and opens its loopback listener. +UMask=0077 +AmbientCapabilities= +CapabilityBoundingSet= NoNewPrivileges=true +PrivateDevices=true PrivateTmp=true +ProtectClock=true ProtectHome=true +ProtectHostname=true ProtectSystem=strict +ProtectKernelLogs=true ProtectKernelTunables=true ProtectKernelModules=true ProtectControlGroups=true +RemoveIPC=true +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=true +RestrictRealtime=true RestrictSUIDSGID=true LockPersonality=true SystemCallArchitectures=native |