mirror of
https://github.com/storytold/figcraft.git
synced 2026-10-24 10:27:00 -06:00
bflatastic
7edc61b8d2
Fixes from the security review of the public server: - team libraries only in key-published files on open servers; unpacking bounded by the file cap (zip bombs refused) - byte-bounded send queues per connection and in all, a bound on bytes waiting for the hub, per-address and global download budgets - batches checked against the file, per-address and total caps as files grow (refused with a Reject the app rolls back); the core's recent-batch memory bounded in bytes; nothing confirmed when a log can't be written - usage reports kept in memory; per-kind message caps checked while read - layered IPv6 limits (/64, /56, /48), a global publish rate, connections reserved for sessions, short idle timeout for one-shot requests - revoked links and removed files cut library connections - data directory 0700, server key 0600 from creation - install.sh: SSH ports from sshd, ufw left off when other services listen, unprivileged builds of the latest tag, settings checked before use, own Caddy snippet; systemd memory and network caps; backups check free space and say they hold the key - linger reads raw bytes after an oversized frame (tungstenite asserted)
65 lines
2.0 KiB
Desktop File
65 lines
2.0 KiB
Desktop File
# systemd unit for figcraft-server; setup in docs/server.md ("Deploy on a Linux server").
|
|
# Install: sudo cp figcraft-server.service /etc/systemd/system/ && sudo systemctl daemon-reload
|
|
# sudo systemctl enable --now figcraft-server
|
|
# Logs: journalctl -u figcraft-server
|
|
|
|
[Unit]
|
|
Description=FigCraft collaboration server
|
|
Documentation=https://github.com/storytold/figcraft/blob/main/docs/server.md
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=figcraft
|
|
Group=figcraft
|
|
ExecStart=/usr/local/bin/figcraft-server --config /etc/figcraft-server/server.toml
|
|
# SIGTERM (systemctl stop/restart) stops it gracefully: open files are saved and compacted, and
|
|
# apps are told the server is restarting (they reconnect when it is back).
|
|
KillSignal=SIGTERM
|
|
TimeoutStopSec=30
|
|
Restart=on-failure
|
|
RestartSec=2
|
|
# max_connections (512 by default) plus the files kept open.
|
|
LimitNOFILE=4096
|
|
UMask=0077
|
|
# Under memory pressure this service slows down, then it alone is stopped (and restarted), not the
|
|
# rest of the machine.
|
|
MemoryHigh=60%
|
|
MemoryMax=75%
|
|
# It talks only to the proxy on this machine (listen = "127.0.0.1:47900"). Listening on a network
|
|
# address without a proxy in front needs these two lines removed.
|
|
IPAddressAllow=localhost
|
|
IPAddressDeny=any
|
|
|
|
# Hardening: the only writable place is the data directory.
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/lib/figcraft-server
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
ProtectProc=invisible
|
|
ProcSubset=pid
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RemoveIPC=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|