v0.1.0

systemd/README.md

@@ -0,0 +1,10 @@
+# systemd installation
+
+1. Install the application files under `/opt/rustpad` and the binary as `/usr/local/bin/rustpad`.
+2. Create the service account: `useradd --system --home /var/lib/rustpad --shell /usr/sbin/nologin rustpad`.
+3. Copy `rustpad.yaml` to `/etc/rustpad/rustpad.yaml` and restrict secrets: `chmod 640 /etc/rustpad/rustpad.yaml`.
+4. Copy `rustpad.service` to `/etc/systemd/system/rustpad.service`.
+5. Validate before starting: `/usr/local/bin/rustpad --config /etc/rustpad/rustpad.yaml check-config`.
+6. Run `systemctl daemon-reload && systemctl enable --now rustpad`.
+
+Environment variables and an optional `.env` file override the YAML values. This allows secrets to be supplied by the service manager without editing the main configuration file.

systemd/rustpad.service

@@ -0,0 +1,39 @@
+[Unit]
+Description=RustPad collaborative notepad
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=rustpad
+Group=rustpad
+WorkingDirectory=/opt/rustpad
+ExecStartPre=/usr/local/bin/rustpad --config /etc/rustpad/rustpad.yaml check-config
+ExecStart=/usr/local/bin/rustpad --config /etc/rustpad/rustpad.yaml
+Restart=on-failure
+RestartSec=5s
+TimeoutStopSec=30s
+KillSignal=SIGTERM
+
+StateDirectory=rustpad
+StateDirectoryMode=0750
+UMask=0027
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+CapabilityBoundingSet=
+AmbientCapabilities=
+#ReadWritePaths=/var/lib/rustpad
+
+[Install]
+WantedBy=multi-user.target

systemd/rustpad.yaml

@@ -0,0 +1,63 @@
+# Environment variables override values from this file.
+app:
+  host: 127.0.0.1
+  port: 3000
+
+database:
+  url: "sqlite:///var/lib/rustpad/db/rustpad.db?mode=rwc"
+  max_connections: 8
+
+static_dir: /opt/rustpad/static
+files_dir: /var/lib/rustpad/files
+storage_driver: local
+upload_max_size_mb: 20
+asset_cache_max_age_seconds: 600
+file_cache_max_age_seconds: 600
+
+registration_enabled: false
+account_confirmation_required: false
+share_confirmation_required: false
+frontend_log_level: warn
+anonymous_access_token_ttl_days: 7
+user_session_ttl_days: 3
+unconfirmed_account_ttl_days: 3
+
+authorization:
+  type: local
+
+# Uncomment for LDAP/AD and set authorization.type to ldap or ad.
+# ldap:
+#   url: "ldaps://ldap.example.org:636"
+#   starttls: false
+#   bind_dn: "cn=rustpad,ou=services,dc=example,dc=org"
+#   bind_password: "change-me"
+#   base_dn: "ou=people,dc=example,dc=org"
+#   user_filter: "(uid={username})"
+#   username_attribute: uid
+#   email_attribute: mail
+#   display_name_attribute: displayName
+#   external_id_attribute: entryUUID
+#   organization: example
+#   email_required: true
+#   link_existing_by_email: false
+#   tls_verify: true
+#   connect_timeout_seconds: 5
+#   operation_timeout_seconds: 10
+
+# Uncomment to enable SMTP.
+# smtp:
+#   host: smtp.example.org
+#   port: 587
+#   username: rustpad
+#   password: "change-me"
+#   from: "RustPad <rustpad@example.org>"
+# public_url: "https://pad.example.org"
+
+# For S3, set storage_driver: s3 and configure:
+# s3:
+#   endpoint: "https://s3.example.org"
+#   region: eu-central-1
+#   bucket: rustpad
+#   access_key: "change-me"
+#   secret_key: "change-me"
+#   force_path_style: true