diff options
| author | Leitwolf11 | 2026-08-10 01:18:12 +0300 |
|---|---|---|
| committer | Leitwolf11 | 2026-08-10 01:18:12 +0300 |
| commit | 0ea6b8d5db87cc03dbb2583f9b870dcc19debe59 (patch) | |
| tree | 2fa5fbb37585d276e7c34c027674366b41231f8b | |
| parent | 159a0d2ae37feb85e2ff8b1715f41a6b5e5685cd (diff) | |
| download | website-0ea6b8d5db87cc03dbb2583f9b870dcc19debe59.tar.gz | |
Make the production deployment reproducible from the website repository: run the API under the static non-login xsharp_web account used by PostgreSQL peer authentication, document the passwordless Unix-socket database boundary and closed firewall posture, and record the OpenDKIM tools, private-key ownership, parent-directory traversal, and SELinux requirements discovered during the clean AlmaLinux deployment.
| -rw-r--r-- | README.md | 4 | ||||
| -rw-r--r-- | ops/mail/README.md | 4 | ||||
| -rw-r--r-- | ops/systemd/xsharp-web-api.service | 5 |
3 files changed, 10 insertions, 3 deletions
@@ -43,6 +43,10 @@ Every completed Google authorization still requires the short-lived Visual X# em - PostgreSQL 16 or newer - Postfix and OpenDKIM for production transactional mail +Production runs the API as the non-login `xsharp_web` operating-system account. PostgreSQL uses a matching local role +over its Unix socket with peer authentication, so the web process does not need a database password and PostgreSQL is +never exposed through the firewall. + ## Development ```text diff --git a/ops/mail/README.md b/ops/mail/README.md index fe32e24..c942d8e 100644 --- a/ops/mail/README.md +++ b/ops/mail/README.md @@ -19,3 +19,7 @@ Production DNS publishes: The private DKIM key and ASP.NET Core connection/OAuth secrets live only on the host. They are never committed. The hosting provider should set reverse DNS for `193.111.77.89` to `mail.xsharp-lang.xyz`; this cannot be configured through Cloudflare DNS. + +Install both `opendkim` and `opendkim-tools`. Keep the selector private key owned by `opendkim:opendkim` with mode +`0600`, and make every parent key directory traversable by the `opendkim` group. On SELinux hosts, restore the packaged +OpenDKIM contexts before starting the service. diff --git a/ops/systemd/xsharp-web-api.service b/ops/systemd/xsharp-web-api.service index eff1112..dc18a57 100644 --- a/ops/systemd/xsharp-web-api.service +++ b/ops/systemd/xsharp-web-api.service @@ -8,9 +8,8 @@ Wants=network-online.target [Service] Type=simple -DynamicUser=yes -User=xsharp-web -Group=xsharp-web +User=xsharp_web +Group=xsharp_web WorkingDirectory=/srv/xsharp/website/current/backend ExecStart=/usr/bin/env /srv/xsharp/website/current/backend/XSharp.Web.Api EnvironmentFile=/etc/xsharp/web-api.env |