From 9f300a65ff387fe83b22c2e2884e7e9ab1050094 Mon Sep 17 00:00:00 2001 From: John Cardinal Date: Mon, 26 Oct 2026 13:59:53 -0700 Subject: [PATCH] case 4727 - setup script: listen on 127.0.0.1 only, read-only program folder, systemd sandboxing nginx is the only way in, so AyaNova listens on 127.0.0.1:7575 instead of all interfaces. The service account (www-data, which nginx also runs as) no longer has write access to the program folder, only to data. The unit gets NoNewPrivileges, ProtectSystem=strict with ReadWritePaths=/var/ayanova/data, PrivateTmp and ProtectHome. Tested on devtestn10 (Ubuntu 24.04.5) with the 8.3.0 build: report render including the first browser download, backup, attachment upload, download and delete; nothing blocked. Do not deploy a client built from this before 8.3.0 is released: the script installs the released zip. Co-Authored-By: Claude Opus 5.5 --- src/views/biz-subscription-server.vue | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/views/biz-subscription-server.vue b/src/views/biz-subscription-server.vue index b88cd12..0bae383 100644 --- a/src/views/biz-subscription-server.vue +++ b/src/views/biz-subscription-server.vue @@ -1407,9 +1407,12 @@ curl -O https://www.ayanova.com/download/ayanova-subscription-linux-x64-server.z # put this server's own secrets in place of the shipped defaults sed -i "s/Password=YOUR_PASSWORD_HERE;/Password=$DBPASSWORD;/" /var/ayanova/config.json sed -i "s/12345YourRandom32CharacterSecret/$JWTSECRET/" /var/ayanova/config.json +# nginx is the only way in: listen on this server only, not on its public address +sed -i 's#http://[*]:7575#http://127.0.0.1:7575#' /var/ayanova/config.json chown -vR :www-data /var/ayanova +# program files read only for the service account; it writes to data only +chmod -R go-w /var/ayanova chmod -R g+rw /var/ayanova/data -chmod g+rw /var/ayanova/ # config.json holds the database password: readable by root and the service group only chmod 640 /var/ayanova/config.json echo '[Unit]' >> /etc/systemd/system/ayanova.service @@ -1425,6 +1428,11 @@ echo 'SyslogIdentifier=ayanova-server' >> /etc/systemd/system/ayanova.service echo 'User=www-data' >> /etc/systemd/system/ayanova.service echo 'Environment=ASPNETCORE_ENVIRONMENT=Production' >> /etc/systemd/system/ayanova.service echo 'Environment=DOTNET_PRINT_TELEMETRY_MESSAGE=false' >> /etc/systemd/system/ayanova.service +echo 'NoNewPrivileges=true' >> /etc/systemd/system/ayanova.service +echo 'ProtectSystem=strict' >> /etc/systemd/system/ayanova.service +echo 'ReadWritePaths=/var/ayanova/data' >> /etc/systemd/system/ayanova.service +echo 'PrivateTmp=true' >> /etc/systemd/system/ayanova.service +echo 'ProtectHome=true' >> /etc/systemd/system/ayanova.service echo '' >> /etc/systemd/system/ayanova.service echo '[Install]' >> /etc/systemd/system/ayanova.service echo 'WantedBy=multi-user.target' >> /etc/systemd/system/ayanova.service