diff options
| author | Leitwolf | 2026-10-23 06:36:23 +0300 |
|---|---|---|
| committer | GitHub | 2026-10-23 06:36:23 +0300 |
| commit | a68bb18e2d750fabcbcff985b5fe921d7c828d7e (patch) | |
| tree | eefb78eaeb556ce0ecd39a6061d7b0bc4e2e5fd3 | |
| parent | 415e949e6621b3d21dd5fbe7cd66440af14e410d (diff) | |
| parent | 8a2a3ed0bdc109216a75a345407d61deda60fa28 (diff) | |
| download | progmaweb-a68bb18e2d750fabcbcff985b5fe921d7c828d7e.tar.gz | |
Merge pull request #42 from Progmasoft/ops/harden-systemd-units
Harden the systemd units of the API and the web frontend
| -rw-r--r-- | ops/systemd/progmaweb-api.service | 11 | ||||
| -rw-r--r-- | ops/systemd/progmaweb-web.service | 11 |
2 files changed, 22 insertions, 0 deletions
diff --git a/ops/systemd/progmaweb-api.service b/ops/systemd/progmaweb-api.service index daab684..e2ff8e7 100644 --- a/ops/systemd/progmaweb-api.service +++ b/ops/systemd/progmaweb-api.service @@ -24,13 +24,24 @@ TimeoutStopSec=30s # The API has no writable application files. Its state is in PostgreSQL, reached through the local Unix socket; the # connection string is in the environment file above. +UMask=0077 +AmbientCapabilities= +CapabilityBoundingSet= NoNewPrivileges=true +PrivateDevices=true PrivateTmp=true +ProtectClock=true ProtectHome=true +ProtectHostname=true ProtectSystem=strict +ProtectKernelLogs=true ProtectKernelTunables=true ProtectKernelModules=true ProtectControlGroups=true +RemoveIPC=true +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=true +RestrictRealtime=true RestrictSUIDSGID=true LockPersonality=true # MemoryDenyWriteExecute is intentionally omitted: CoreCLR's JIT requires managed executable mappings at runtime. diff --git a/ops/systemd/progmaweb-web.service b/ops/systemd/progmaweb-web.service index acf4690..47698bd 100644 --- a/ops/systemd/progmaweb-web.service +++ b/ops/systemd/progmaweb-web.service @@ -26,13 +26,24 @@ TimeoutStopSec=30s SuccessExitStatus=143 # Standalone Next.js only reads immutable release files and opens its loopback listener. +UMask=0077 +AmbientCapabilities= +CapabilityBoundingSet= NoNewPrivileges=true +PrivateDevices=true PrivateTmp=true +ProtectClock=true ProtectHome=true +ProtectHostname=true ProtectSystem=strict +ProtectKernelLogs=true ProtectKernelTunables=true ProtectKernelModules=true ProtectControlGroups=true +RemoveIPC=true +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=true +RestrictRealtime=true RestrictSUIDSGID=true LockPersonality=true SystemCallArchitectures=native |