diff options
| author | Leitwolf11 | 2026-10-23 03:21:38 +0300 |
|---|---|---|
| committer | Leitwolf11 | 2026-10-23 03:21:38 +0300 |
| commit | 11d91cba681e48afe0fcec6640d07b9100301f86 (patch) | |
| tree | b8940e6b724ad162e91f28fda988d38b118f0a02 /apps/api-tests/PostgresTestDatabase.cs | |
| parent | 46e526f91e805319e0b0b65bae8d09dc4fabfa0c (diff) | |
| download | progmaweb-11d91cba681e48afe0fcec6640d07b9100301f86.tar.gz | |
Harden the systemd units of the API and the web frontend
systemd-analyze security rated both services 7.2 MEDIUM. They now
carry the restrictions the Tala website API already runs with: no
capabilities (empty bounding and ambient sets), private /dev, no
access to the clock, hostname, kernel logs, modules, tunables or
control groups, only AF_UNIX/AF_INET/AF_INET6 sockets, no new
namespaces, no realtime scheduling, IPC removed on stop, and a 0077
umask. MemoryDenyWriteExecute stays off, since CoreCLR and V8 JIT
need writable executable mappings.
Deployed and verified on the server: systemd-analyze verify is clean,
both services restarted and rate 3.0 OK, the API health endpoint and
the frontend answer 200 on loopback, and progmasoft.com,
account.progmasoft.com and viget.progmasoft.com answer 200.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'apps/api-tests/PostgresTestDatabase.cs')
0 files changed, 0 insertions, 0 deletions