admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4727 - docs: Linux server permissions, service security settings, 127.0.0.1 behind NGINX

Browse Source 
Install: program files read only for the service account, config.json 640,
systemd security settings in the service file, and a final step binding
AyaNova to 127.0.0.1 once NGINX works. Upgrade: the pre-8.3.0 step sets the
same permissions instead of re-adding group write on the program folder,
offers the security settings as a drop-in, and the upgrade commands use
curl -fO so a failed download stops before the program files are deleted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-26 14:14:05 -07:00
parent ad5da2ffa5
commit c6c9e6c5d3
5 changed files with 73 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/8.0/ayanova/docs/ops-config-use-urls.md
View File

@@ -8,7 +8,11 @@ If no override is specified AyaNova will use the following default value:
`"http://*:7575"`
This means AyaNova will listen on port 7575
This means AyaNova will listen on port 7575 on all of the computer's network addresses.
## Behind a reverse proxy
When all users connect through a reverse proxy (such as NGINX) on the same computer, use `127.0.0.1` in place of `*`, for example `"http://127.0.0.1:7575"`. AyaNova then accepts connections only from that computer, so it can not be reached directly over unencrypted HTTP, bypassing the reverse proxy. See the [Linux server installation](ops-install-linux-server.md#f-accept-connections-only-through-nginx) instructions.
## Overriding

48
docs/8.0/ayanova/docs/ops-install-linux-server.md
View File

@@ -215,16 +215,22 @@ Give www-data ownership of the ayanova directory:
sudo chown -vR :www-data /var/ayanova
```
Set permissions to read / write for the AyaNova data directory:
Make the AyaNova program files read only for everyone but root, so the account AyaNova runs as can not change them:
```bash
sudo chmod -R go-w /var/ayanova
```
Set permissions to read / write for the AyaNova data directory, the only place AyaNova needs to write to:
```bash
sudo chmod -R g+rw /var/ayanova/data
```
Set permissions for the AyaNova folder
The config.json file holds the database password, make it readable only by root and AyaNova:
```bash
chmod g+rw /var/ayanova/
sudo chmod 640 /var/ayanova/config.json
```
### 10\. Create and install a service to run AyaNova automatically
@@ -254,6 +260,12 @@ SyslogIdentifier=ayanova-server
User=www-data
Environment=ASPNETCORE_ENVIRONMENT=Production
Environment=DOTNET_PRINT_TELEMETRY_MESSAGE=false
# Security: AyaNova can write only to its data directory
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/var/ayanova/data
PrivateTmp=true
ProtectHome=true
[Install]
WantedBy=multi-user.target
@@ -261,6 +273,8 @@ WantedBy=multi-user.target
Make the changes and save with `ctr-x` and type `y` to answer "Save modified buffer?" prompt.
The lines under `# Security` limit what the AyaNova service can do on the server: it can not gain extra privileges, sees the rest of the system as read only and can write only to its data directory. AyaNova keeps all of its files (logs, attachments, backups, temporary files and the report rendering browser) in the data directory by default so nothing else is needed. If you have set a [log](ops-log.md#log-path), [attachments](ops-config-folder-user-files.md), [backup](ops-config-folder-backup-files.md) or [temporary files](ops-config-folder-temporary-files.md) path outside of the data directory, add each of those folders to the `ReadWritePaths` line separated by spaces, otherwise AyaNova will not be able to write to them.
Enable the service:
```bash
@@ -614,7 +628,33 @@ Certbot will also install a systemd timer event which will auto-renew the SSL ce
Confirm that you can now navigate to AyaNova web app login page through encrypted HTTPS via the domain name configured earlier. i.e. `https://ayanova.yourdomain.com` or `https://yourdomain.com` if not using a subdomain.
You should now see the login (or license agreement) page through an encrypted SSL connection and AyaNova is ready for use.
You should now see the login (or license agreement) page through an encrypted SSL connection.
#### F\. Accept connections only through NGINX
AyaNova still listens on port 7575 on all of the server's network addresses, where it can be reached directly over unencrypted HTTP, bypassing NGINX and its encryption. Now that NGINX is working, set AyaNova to accept connections only from this server itself so all users connect through NGINX.
Edit the [AYANOVA_USE_URLS](ops-config-use-urls.md) setting in config.json:
```bash
sudo nano /var/ayanova/config.json
```
and change `http://*:7575` to `http://127.0.0.1:7575` so the line reads:
```json
"AYANOVA_USE_URLS": "http://127.0.0.1:7575",
```
Save, then restart AyaNova:
```bash
sudo systemctl restart ayanova.service
```
Confirm again that the login page opens through `https://` as in the previous step. AyaNova is now ready for use.
Only make this change if all users connect through NGINX: users connecting directly to port 7575 on the local network will no longer be able to connect and must use the `https://` address instead.
## Getting started and using AyaNova

24
docs/8.0/ayanova/docs/ops-upgrade-linux-server.md
View File

@@ -18,7 +18,7 @@ If you do not have a fresh backup there will be no way to recover from potential
**Only if** your current AyaNova version is older than 8.3.0 there is an extra step before the normal upgrade process.
8.3.0 switched to .NET 10 LTS from the prior used .NET 8 LTS (8.2.0 to 8.2.4), so the .NET 10 runtime must be installed first. If you are upgrading from a version older than 8.2.0 this script also accommodates that release's changes to folder ownership and permissions.
8.3.0 switched to .NET 10 LTS from the prior used .NET 8 LTS (8.2.0 to 8.2.4), so the .NET 10 runtime must be installed first. This script also sets the folder ownership and permissions the [installation instructions](ops-install-linux-server.md#9-set-ownership-and-permissions) now use: the program files read only for the account AyaNova runs as, which only needs to write to the data directory, and config.json, which holds the database password, readable only by root and AyaNova.
From a terminal window run the following commands:
@@ -26,15 +26,33 @@ From a terminal window run the following commands:
sudo apt-get update && sudo apt-get upgrade && \
sudo apt-get install -y aspnetcore-runtime-10.0 && \
sudo chown -vR :www-data /var/ayanova && \
sudo chmod g+rw /var/ayanova/
sudo chmod -R go-w /var/ayanova && \
sudo chmod -R g+rw /var/ayanova/data && \
sudo chmod 640 /var/ayanova/config.json
```
These commands assume AyaNova runs as `www-data`, as in the installation instructions. If you chose another account, use its group in the `chown` line.
On Ubuntu 24.04 and 26.04 the .NET 10 runtime comes from Ubuntu's own package archive. On Ubuntu 22.04 first add the Ubuntu .NET backports package repository with `sudo add-apt-repository ppa:dotnet/backports`.
Installing the .NET 10 runtime replaces the shared `dotnet` command, the .NET 8 runtime stays installed and can be removed later if nothing else on the server uses it.
If there is an issue or error break apart the commands and execute each one individually to find the error.
#### Recommended: security settings for the AyaNova service
The [installation instructions](ops-install-linux-server.md#10-create-and-install-a-service-to-run-ayanova-automatically) now add security settings to the AyaNova service so it can write only to its data directory. To add them to an existing installation without editing the service file, run:
```bash
sudo mkdir -p /etc/systemd/system/ayanova.service.d && \
printf '[Service]\nNoNewPrivileges=true\nProtectSystem=strict\nReadWritePaths=/var/ayanova/data\nPrivateTmp=true\nProtectHome=true\n' | sudo tee /etc/systemd/system/ayanova.service.d/hardening.conf && \
sudo systemctl daemon-reload
```
They take effect when the AyaNova service next starts, in the upgrade step below. If you have set a log, attachments, backup or temporary files path outside of the data directory, first read the note about `ReadWritePaths` in the [installation instructions](ops-install-linux-server.md#10-create-and-install-a-service-to-run-ayanova-automatically).
If users connect through NGINX as in the [internet access](ops-install-linux-server.md#internet-access) instructions, also set AyaNova to [accept connections only through NGINX](ops-install-linux-server.md#f-accept-connections-only-through-nginx).
After this step has completed you can continue with the normal upgrade process in the next step.
### 2\. Upgrade
@@ -48,7 +66,7 @@ Run the following shell commands:
```bash
cd /var/ayanova && \
sudo systemctl stop ayanova.service && \
sudo curl -O https://www.ayanova.com/download/ayanova-linux-x64-server.zip && \
sudo curl -fO https://www.ayanova.com/download/ayanova-linux-x64-server.zip && \
sudo rm *.dll && \
sudo rm -r ./resource && \
sudo rm -r ./wwwroot && \