chages in systemd

scripts/normalize-systemd-unit.py

@@ -0,0 +1,42 @@
+#!/usr/bin/env python3
+"""Normalize the packaged RustProxy systemd unit for Linux DEB/RPM."""
+
+from pathlib import Path
+import re
+import sys
+path = Path(sys.argv[1])
+name = sys.argv[2]
+text = path.read_text()
+if not re.search(r'^\[Service\][ \t]*$', text, re.M):
+    raise SystemExit('unit has no [Service] section')
+# This normalization also covers older/source-provided debian/*.service units:
+# ProtectHome=true masks /home completely, so neither chgrp nor setfacl can
+# make web roots/certificate files there readable. Keep the directories
+# read-only, in addition to the existing strict filesystem sandbox.
+if re.search(r'^[ \t]*ProtectHome[ \t]*=', text, re.M):
+    text = re.sub(r'^[ \t]*ProtectHome[ \t]*=.*$', 'ProtectHome=read-only',
+                  text, flags=re.M)
+else:
+    text = re.sub(r'^(\[Service\][ \t]*\n)',
+                  lambda m: m.group(1) + 'ProtectHome=read-only\n',
+                  text, count=1, flags=re.M)
+if not re.search(r'^ExecReload=', text, re.M):
+    if not re.search(r'^ExecStart=', text, re.M):
+        raise SystemExit('unit has no ExecStart; cannot attach reload')
+    text = re.sub(
+        r'^(ExecStart=[^\n]*\n)',
+        lambda m: m.group(1) +
+        f'ExecReload=/usr/bin/{name} --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 reload\n',
+        text,
+        count=1,
+        flags=re.M,
+    )
+if re.search(r'^ProtectSystem=strict\s*$', text, re.M) and not re.search(
+    r'^ReadWritePaths=.*(?:^|[ \t])-?/etc/rustproxy(?:[ \t]|$)', text, re.M
+):
+    text = re.sub(
+        r'^(ProtectSystem=strict\s*\n)',
+        lambda m: m.group(1) + 'ReadWritePaths=-/etc/rustproxy\n',
+        text, count=1, flags=re.M,
+    )
+path.write_text(text)