fix zaleznosci

.env.example

@@ -2,3 +2,4 @@ SOURCE_REPO=https://git.linuxiarz.pl/gru/RustProxy.git
 SOURCE_BRANCH=master
 REPOSITORY_URL=https://packages.linuxiarz.pl
 POLL_INTERVAL=300
+RUN_LINUX_TESTS=0

scripts/prepare-package.sh

@@ -28,9 +28,40 @@ After=network-online.target
 
 [Service]
 Type=simple
-ExecStart=/usr/bin/$BINARY_NAME
+User=rustproxy
+Group=rustproxy
+WorkingDirectory=/var/lib/rustproxy
+UMask=0077
+Environment=RUST_LOG=rust_proxy=info,warn
+Environment=MALLOC_ARENA_MAX=2
+Environment=PATH=/opt/rustproxy-certbot/bin:/usr/local/bin:/usr/bin:/bin
+EnvironmentFile=-/etc/rustproxy/environment
+ExecStart=/usr/bin/$BINARY_NAME --data-dir /var/lib/rustproxy --admin-listen 0.0.0.0:9090 serve --proxy-listen 0.0.0.0:80 --tls-listen 0.0.0.0:443
 Restart=on-failure
 RestartSec=3
+KillSignal=SIGINT
+KillMode=control-group
+TimeoutStopSec=120
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+LogsDirectory=rustproxy
+LogsDirectoryMode=0770
+ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallArchitectures=native
+LockPersonality=true
 
 [Install]
 WantedBy=multi-user.target
@@ -183,6 +214,10 @@ depends:
   - ca-certificates
   - gzip
   - logrotate
+  - python3
+  - certbot
+  - python3-certbot-dns-rfc2136
+  - python3-certbot-dns-cloudflare
   - systemd
 scripts:
   postinstall: "$PKG/scripts/deb-postinstall.sh"
@@ -215,6 +250,10 @@ depends:
   - gzip
   - logrotate
   - shadow-utils
+  - python3
+  - certbot
+  - python3-certbot-dns-rfc2136
+  - python3-certbot-dns-cloudflare
   - systemd
 scripts:
   postinstall: "$PKG/scripts/rpm-postinstall.sh"