mf-hosting 2.1.0 → 2.1.2

package/package.json

@@ -1,21 +1,28 @@
 {
   "name": "mf-hosting",
-  "version": "2.1.0",
+  "version": "2.1.2",
+  "files": [
+    ".releaserc.json",
+    "pkg/hooks.sh",
+    "pkg/nginx.conf",
+    "pkg/service.backup",
+    "pkg/systemd.service",
+    "pkg/systemd.socket",
+    "pkg/sysusers.conf",
+    "pkg/tmpfiles.conf"
+  ],
+  "main": ".releaserc.json",
   "description": "hosting definitions @MF",
   "keywords": [
     "npm-pkgbuild",
     "semantic-release-config"
   ],
-  "files": [
-    ".releaserc.json"
-  ],
-  "main": ".releaserc.json",
   "devDependencies": {
-    "semantic-release": "^23.1.1",
     "@semantic-release/commit-analyzer": "^12.0.0",
     "@semantic-release/exec": "^6.0.3",
-    "@semantic-release/github": "^10.0.4",
-    "@semantic-release/release-notes-generator": "^13.0.0"
+    "@semantic-release/github": "^10.0.5",
+    "@semantic-release/release-notes-generator": "^13.0.0",
+    "semantic-release": "^23.1.1"
   },
   "repository": {
     "type": "git",
@@ -37,7 +44,7 @@
             "aarch64"
           ],
           "dependencies": {
-            "systemd": ">=255.6",
+            "systemd": ">=255.7",
             "nginx-mainline": ">=1.25.5"
           },
           "content": {

package/pkg/hooks.sh

@@ -0,0 +1,23 @@
+
+post_install() {
+	systemctl daemon-reload
+	systemctl enable {{name}}
+	systemctl enable {{name}}.socket
+	systemctl start {{name}}.socket
+}
+
+pre_upgrade() {
+	systemctl stop {{name}}
+}
+
+post_upgrade() {
+	systemctl daemon-reload
+	systemctl restart {{name}}.socket
+}
+
+pre_remove() {
+	systemctl stop {{name}}.socket
+	systemctl disable {{name}}.socket
+	systemctl stop {{name}}
+	systemctl disable {{name}}
+}

package/pkg/nginx.conf

@@ -0,0 +1,15 @@
+location {{http.path}} {
+  rewrite {{http.path}}(.*) $1 break;
+  proxy_set_header X-Real-IP $remote_addr;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  proxy_set_header Host $http_host;
+  proxy_set_header X-NginX-Proxy true;
+  proxy_set_header Upgrade $http_upgrade;
+  proxy_set_header Connection "upgrade";
+  proxy_pass http://unix:{{socket.http}};
+
+  add_header X-Content-Type-Options nosniff;
+  add_header Content-Security-Policy "{{csp.header}}" always;
+  add_header Cache-Control "private,no-store";
+  add_header alt-svc 'h3=":443";ma=7776000;persist=1';
+{{nginx.location.trailer}}}

package/pkg/service.backup

@@ -0,0 +1,17 @@
+backup()
+{
+    mkdir -p $1/{{name}}
+    cp -ra /etc/{{name}}/* $1/{{name}}
+}
+
+restore()
+{
+    mkdir -p /etc/{{name}}
+    cp -ra $1/{{name}}/* /etc/{{name}}
+}
+
+sync()
+{
+    mkdir -p /etc/{{name}}
+    rsync -e "ssh -i /root/.ssh/rsync" -ra -X -A -S --stats root@$SOURCE_HOST:/etc/{{name}} /etc/|grep -E -v '(data|time):'
+}

package/pkg/systemd.service

@@ -0,0 +1,55 @@
+[Unit]
+Description={{description}}
+Wants=network-online.target
+After=network-online.target
+StopWhenUnneeded=true
+
+[Service]
+Type=notify
+ExecStart={{node.exe}} --unhandled-rejections=strict --trace-uncaught --trace-warnings --title {{name}} {{install.dir}}src/{{name}}-cli.mjs
+ExecReload=/bin/kill -HUP $MAINPID
+ExecStop=sleep 20
+RestartSec=40
+TimeoutStartSec=25
+TimeoutStopSec=30
+Restart=on-failure
+NotifyAccess=all
+FileDescriptorStoreMax=5
+OOMPolicy=stop
+User={{os.user}}
+Group={{os.user}}
+DynamicUser=false
+SupplementaryGroups=http
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_ADMIN CAP_NET_ADMIN CAP_SYS_NICE CAP_SYS_RESOURCE CAP_KILLC AP_IPC_LOCK CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_WAKE_ALARM CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_KILL
+NoNewPrivileges=true
+UMask=0077
+ProtectSystem=full
+ProtectHome=true
+RuntimeDirectory={{name}}
+StateDirectory={{name}}
+CacheDirectory={{name}}
+ConfigurationDirectory={{name}}
+RuntimeDirectoryMode=755
+RuntimeDirectoryPreserve=yes
+PrivateTmp=true
+PrivateDevices=true
+PrivateUsers=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+CPUWeight=10
+IOWeight=10
+MemoryAccounting=true
+MemoryHigh=30M
+MemoryMax=60M
+ProtectProc=noaccess
+SystemCallErrorNumber=EPERM
+
+[Install]
+WantedBy=multi-user.target

package/pkg/systemd.socket

@@ -0,0 +1,9 @@
+[Socket]
+ListenStream={{socket.http}}
+SocketUser={{socket.http.user}}
+SocketGroup={{socket.http.group}}
+MaxConnections=4
+FileDescriptorName=http.listen.socket
+
+[Install]
+RequiredBy={{name}}.service

package/pkg/sysusers.conf

@@ -0,0 +1 @@
+u {{os.user}} - "{{description}}" {{var.dir}} /usr/bin/nologin

package/pkg/tmpfiles.conf

@@ -0,0 +1,3 @@
+D {{run.dir}} 0755 {{os.user}} {{os.group}} -
+d {{var.dir}} 0755 {{os.user}} {{os.group}} -
+D {{run.dir}}http 2775 {{os.user}} {{socket.http.user}} -