v0.1.0

packaging/postfixadmin-rs.service

@@ -1,6 +1,7 @@
 [Unit]
 Description=PostfixAdmin-RS mail administration panel
-After=network-online.target
+Documentation=https://github.com/postfixadmin/postfixadmin
+After=network-online.target mariadb.service mysql.service postgresql.service
 Wants=network-online.target
 
 [Service]
@@ -10,22 +11,39 @@ Group=postfixadmin
 WorkingDirectory=/var/lib/postfixadmin-rs
 Environment=POSTFIXADMIN_RS_CONFIG=/etc/postfixadmin-rs/config.toml
 EnvironmentFile=-/etc/default/postfixadmin-rs
+ExecStartPre=/usr/bin/postfixadmin-rs --check-config
 ExecStart=/usr/bin/postfixadmin-rs
 Restart=on-failure
 RestartSec=3s
 UMask=0077
 StateDirectory=postfixadmin-rs
 StateDirectoryMode=0750
+
+# Hardening. Hooks (doveadm, maildir scripts) run with the same restrictions;
+# grant write access to additional paths with ReadWritePaths= if a hook needs it,
+# e.g. ReadWritePaths=/var/lib/rspamd/dkim /etc/rspamd/local.d
 NoNewPrivileges=true
 PrivateTmp=true
 PrivateDevices=true
 ProtectHome=true
-ProtectSystem=true
+ProtectSystem=full
 ProtectKernelTunables=true
 ProtectKernelModules=true
+ProtectKernelLogs=true
 ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
 RestrictSUIDSGID=true
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
 LockPersonality=true
+MemoryDenyWriteExecute=true
+CapabilityBoundingSet=
+AmbientCapabilities=
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources
 
 [Install]
 WantedBy=multi-user.target