diff options
| author | Leitwolf11 | 2026-09-08 01:29:57 +0300 |
|---|---|---|
| committer | Leitwolf11 | 2026-09-08 01:29:57 +0300 |
| commit | 41b6d47bd69e0545420612e1eebe9d01fb77be9e (patch) | |
| tree | 6899343e23a09f5468bf6b915a6a2b5681dc6028 | |
| parent | 171b443addac11e07559b6c4127e622341fe1961 (diff) | |
| download | progmaweb-41b6d47bd69e0545420612e1eebe9d01fb77be9e.tar.gz | |
Make Progmaweb API activation SELinux-stable
Invoke the framework-dependent API through the installed dotnet runtime instead of relying on a copied apphost inode retaining executable SELinux metadata. Document the production service contract so immutable releases activate consistently on the AlmaLinux host.
| -rw-r--r-- | apps/api/packages.lock.json | 2 | ||||
| -rw-r--r-- | ops/README.md | 5 | ||||
| -rw-r--r-- | ops/systemd/progmaweb-api.service | 5 |
3 files changed, 8 insertions, 4 deletions
diff --git a/apps/api/packages.lock.json b/apps/api/packages.lock.json index b7d7ff4..d134eda 100644 --- a/apps/api/packages.lock.json +++ b/apps/api/packages.lock.json @@ -10,4 +10,4 @@ } } } -}
\ No newline at end of file +} diff --git a/ops/README.md b/ops/README.md index 13fc54a..2dfe38e 100644 --- a/ops/README.md +++ b/ops/README.md @@ -25,8 +25,9 @@ release atomically. The account API and Next.js frontend listen only on loopback The web directory is the full Next.js standalone output. In this pnpm monorepo the runnable server is emitted at `apps/web/server.js`; root-level standalone modules must remain above it. Copy `.next/static` into `apps/web/.next/static` and `public` into `apps/web/public`, because Next.js intentionally excludes those assets from the -standalone bundle. The API is published as a framework-dependent Linux x64 executable and uses the server's supported -.NET runtime. +standalone bundle. The API is published as a framework-dependent Linux x64 deployment and is started explicitly as +`/usr/bin/dotnet /srv/progmaweb/current/api/Progmaweb.Api.dll`. Keeping the runtime invocation in the service contract +avoids depending on an apphost inode copied from a build machine retaining an executable SELinux label. ## Activation contract diff --git a/ops/systemd/progmaweb-api.service b/ops/systemd/progmaweb-api.service index 092c9d5..a2b4fd8 100644 --- a/ops/systemd/progmaweb-api.service +++ b/ops/systemd/progmaweb-api.service @@ -11,7 +11,10 @@ Type=exec User=progmaweb Group=progmaweb WorkingDirectory=/srv/progmaweb/current/api -ExecStart=/usr/bin/env /srv/progmaweb/current/api/Progmaweb.Api +# Invoke the framework-dependent deployment through the installed runtime. This +# avoids relying on the copied apphost inode being executable under the host's +# SELinux policy while preserving the same immutable application payload. +ExecStart=/usr/bin/dotnet /srv/progmaweb/current/api/Progmaweb.Api.dll Environment=ASPNETCORE_ENVIRONMENT=Production Environment=ASPNETCORE_URLS=http://127.0.0.1:5085 EnvironmentFile=-/etc/progmaweb/account.env |