v0.3.0-prod

packaging/ts3monolith-init-rrd

@@ -0,0 +1,40 @@
+#!/bin/sh
+set -eu
+
+# Tworzy nowa baze RRD dla ts3monolith, jesli jeszcze nie istnieje. Uzyj tego
+# przy swiezej instalacji (brak starego pliku z archiwum). Uruchom jako
+# uzytkownik ts3monolith, np.:
+#   sudo -u ts3monolith /usr/lib/ts3monolith/init-rrd
+#
+# Zmienne RRD_PATH / RRDTOOL mozna nadpisac w srodowisku, domyslnie czyta
+# te same wartosci co /etc/default/ts3monolith.
+
+RRD_PATH="${RRD_PATH:-/var/lib/ts3monolith/online.rrd}"
+RRDTOOL="${RRDTOOL:-rrdtool}"
+
+if [ -e "$RRD_PATH" ]; then
+  echo "RRD juz istnieje: $RRD_PATH (pomijam)"
+  exit 0
+fi
+
+command -v "$RRDTOOL" >/dev/null 2>&1 || { echo "error: $RRDTOOL nie znaleziony w PATH" >&2; exit 1; }
+
+install -d -m 0750 "$(dirname "$RRD_PATH")"
+
+# step=60s. RRA pokrywaja wszystkie zakresy wykresow aplikacji:
+#   LAST 1x60s   x4500 ~ 75h  -> 12h / 24h / 72h
+#   AVG  5x60s   x2016 ~ 7d   -> tydzien
+#   AVG  30x60s  x1488 ~ 31d  -> miesiac
+#   AVG  360x60s x1460 ~ 365d -> rok
+"$RRDTOOL" create "$RRD_PATH" \
+  --start now-1h --step 60 \
+  DS:online:GAUGE:120:0:U \
+  RRA:LAST:0.5:1:4500 \
+  RRA:AVERAGE:0.5:5:2016 \
+  RRA:MAX:0.5:5:2016 \
+  RRA:AVERAGE:0.5:30:1488 \
+  RRA:MAX:0.5:30:1488 \
+  RRA:AVERAGE:0.5:360:1460 \
+  RRA:MAX:0.5:360:1460
+
+echo "Utworzono nowa baze RRD: $RRD_PATH"

packaging/ts3monolith.default

@@ -0,0 +1,29 @@
+# Zmienne srodowiskowe ts3monolith (EnvironmentFile uslugi systemd).
+# Po edycji: systemctl restart ts3monolith
+#
+# === WYMAGANE przed pierwszym uruchomieniem ================================
+APP_SECRET=CHANGE_ME_TO_A_LONG_RANDOM_SECRET
+TS_QUERY_USER=CHANGE_ME
+TS_QUERY_PASSWORD=CHANGE_ME
+
+# === Siec / bezpieczenstwo ===================================================
+LISTEN_ADDR=127.0.0.1:8080
+HTTPS_ONLY=true
+# Originy (tylko schemat+host), ktore moga osadzic /embed/channel w <iframe>.
+FRAME_ANCESTORS=https://www.example.org
+# Sieci reverse proxy, ktorym ufamy co do naglowkow X-Forwarded-For/X-Real-IP.
+TRUSTED_PROXIES=127.0.0.1/32
+
+# === TeamSpeak 3 ServerQuery ==================================================
+TS_QUERY_HOST=127.0.0.1
+TS_QUERY_PORT=10011
+TS_VOICE_HOST=example.org
+TS_VOICE_PORT=9987
+TS_CHANNEL_ADMIN_GID=5
+TS_QUERY_TIMEOUT=3s
+
+# === RRD / statystyki =========================================================
+RRDTOOL=rrdtool
+RRD_PATH=/var/lib/ts3monolith/online.rrd
+GRAPH_DIR=/var/lib/ts3monolith/graphs
+STATS_INTERVAL=60s

packaging/ts3monolith.service

@@ -0,0 +1,51 @@
+[Unit]
+Description=TS3 Monolith - panel TeamSpeak 3 (tworzenie kanalow + statystyki RRD)
+Documentation=https://github.com/linuxiarz/ts3-monolith-go
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=ts3monolith
+Group=ts3monolith
+WorkingDirectory=/var/lib/ts3monolith
+EnvironmentFile=/etc/default/ts3monolith
+ExecStart=/usr/bin/ts3monolith
+Restart=on-failure
+RestartSec=3s
+UMask=0027
+StateDirectory=ts3monolith
+StateDirectoryMode=0750
+
+# Hardening. Usluga nie wymaga zadnych uprawnien poza siecia (TS3 ServerQuery,
+# HTTP) i zapisem do /var/lib/ts3monolith (RRD + wygenerowane wykresy PNG).
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/ts3monolith
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictAddressFamilies=AF_INET AF_INET6
+LockPersonality=true
+CapabilityBoundingSet=
+AmbientCapabilities=
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+
+# MemoryDenyWriteExecute=true i SystemCallFilter=~@privileged @resources sa
+# NIE wlaczone celowo: sa znanym zrodlem "code=dumped, signal=SYS" (seccomp
+# zabija proces) dla binarek Go, w przeciwienstwie do np. Rusta/LLVM. Jesli
+# chcesz dokrecic bardziej, wlaczaj je pojedynczo i patrz na
+# `journalctl -u ts3monolith` / `dmesg | grep -i seccomp` po kazdej zmianie.
+
+[Install]
+WantedBy=multi-user.target