nginx is the only way in, so AyaNova listens on 127.0.0.1:7575 instead of all
interfaces. The service account (www-data, which nginx also runs as) no longer
has write access to the program folder, only to data. The unit gets
NoNewPrivileges, ProtectSystem=strict with ReadWritePaths=/var/ayanova/data,
PrivateTmp and ProtectHome.
Tested on devtestn10 (Ubuntu 24.04.5) with the 8.3.0 build: report render
including the first browser download, backup, attachment upload, download and
delete; nothing blocked.
Do not deploy a client built from this before 8.3.0 is released: the script
installs the released zip.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- PostgreSQL from the PostgreSQL project's repository via postgresql-common's
apt.postgresql.org.sh (apt-key is gone on newer Ubuntu)
- libgdk-pixbuf2.0-0 renamed libgdk-pixbuf-2.0-0 (needed on 26.04, also valid on 24.04)
- random PostgreSQL password and JWT secret per server, written to PostgreSQL and
config.json (replacing the shipped defaults) and to /root/ayanova-secrets.txt (600)
- config.json 640 root:www-data
- APT::Get::Never-Include-Phased-Updates, as set by hand on every server today
Tested end to end on a fresh Ubuntu 26.04.1 droplet with the 8.3.0 build.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AyaNova 8.3.0 runs on .NET 10 and downloads the report browser under the
data folder. Do not deploy a client built from this before 8.3.0 is released:
the script installs the released zip, and 8.2.4 needs .NET 8.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
