admin/sockeye-client
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4727 - setup script: listen on 127.0.0.1 only, read-only program folder, systemd sandboxing

Browse Source 
nginx is the only way in, so AyaNova listens on 127.0.0.1:7575 instead of all
interfaces. The service account (www-data, which nginx also runs as) no longer
has write access to the program folder, only to data. The unit gets
NoNewPrivileges, ProtectSystem=strict with ReadWritePaths=/var/ayanova/data,
PrivateTmp and ProtectHome.

Tested on devtestn10 (Ubuntu 24.04.5) with the 8.3.0 build: report render
including the first browser download, backup, attachment upload, download and
delete; nothing blocked.

Do not deploy a client built from this before 8.3.0 is released: the script
installs the released zip.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-26 13:59:53 -07:00
parent cb8d6da832
commit 9f300a65ff
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/views/biz-subscription-server.vue
View File

@@ -1407,9 +1407,12 @@ curl -O https://www.ayanova.com/download/ayanova-subscription-linux-x64-server.z
# put this server's own secrets in place of the shipped defaults
sed -i "s/Password=YOUR_PASSWORD_HERE;/Password=$DBPASSWORD;/" /var/ayanova/config.json
sed -i "s/12345YourRandom32CharacterSecret/$JWTSECRET/" /var/ayanova/config.json
# nginx is the only way in: listen on this server only, not on its public address
sed -i 's#http://[*]:7575#http://127.0.0.1:7575#' /var/ayanova/config.json
chown -vR :www-data /var/ayanova
# program files read only for the service account; it writes to data only
chmod -R go-w /var/ayanova
chmod -R g+rw /var/ayanova/data
chmod g+rw /var/ayanova/
# config.json holds the database password: readable by root and the service group only
chmod 640 /var/ayanova/config.json
echo '[Unit]' >> /etc/systemd/system/ayanova.service
@@ -1425,6 +1428,11 @@ echo 'SyslogIdentifier=ayanova-server' >> /etc/systemd/system/ayanova.service
echo 'User=www-data' >> /etc/systemd/system/ayanova.service
echo 'Environment=ASPNETCORE_ENVIRONMENT=Production' >> /etc/systemd/system/ayanova.service
echo 'Environment=DOTNET_PRINT_TELEMETRY_MESSAGE=false' >> /etc/systemd/system/ayanova.service
echo 'NoNewPrivileges=true' >> /etc/systemd/system/ayanova.service
echo 'ProtectSystem=strict' >> /etc/systemd/system/ayanova.service
echo 'ReadWritePaths=/var/ayanova/data' >> /etc/systemd/system/ayanova.service
echo 'PrivateTmp=true' >> /etc/systemd/system/ayanova.service
echo 'ProtectHome=true' >> /etc/systemd/system/ayanova.service
echo '' >> /etc/systemd/system/ayanova.service
echo '[Install]' >> /etc/systemd/system/ayanova.service
echo 'WantedBy=multi-user.target' >> /etc/systemd/system/ayanova.service