diff --git a/usr/share/dist/Library/LaunchDaemons/cloud.telebit.remote.plist.tpl b/usr/share/dist/Library/LaunchDaemons/cloud.telebit.remote.plist.tpl new file mode 100644 index 0000000..6d9f496 --- /dev/null +++ b/usr/share/dist/Library/LaunchDaemons/cloud.telebit.remote.plist.tpl @@ -0,0 +1,61 @@ + + + + + Label + Telebit Remote + ProgramArguments + + {TELEBIT_PATH}/bin/node + {TELEBIT_PATH}/bin/telebitd.js + daemon + --config + {TELEBIT_PATH}/etc/telebitd.yml + + EnvironmentVariables + + TELEBIT_PATH + {TELEBIT_PATH} + NODE_PATH + {TELEBIT_PATH}/lib/node_modules + NPM_CONFIG_PREFIX + {TELEBIT_PATH} + + + UserName + {TELEBIT_USER} + GroupName + {TELEBIT_GROUP} + InitGroups + + + RunAtLoad + + KeepAlive + + + + SoftResourceLimits + + NumberOfFiles + 8192 + + HardResourceLimits + + + WorkingDirectory + {TELEBIT_PATH} + + StandardErrorPath + {TELEBIT_PATH}/var/log/error.log + StandardOutPath + {TELEBIT_PATH}/var/log/info.log + + diff --git a/usr/share/dist/etc/systemd/system/telebit.service.tpl b/usr/share/dist/etc/systemd/system/telebit.service.tpl new file mode 100644 index 0000000..b4ceee1 --- /dev/null +++ b/usr/share/dist/etc/systemd/system/telebit.service.tpl @@ -0,0 +1,64 @@ +# Pre-req +# sudo adduser telebit --home {TELEBIT_PATH} +# sudo mkdir -p {TELEBIT_PATH}/ +# sudo chown -R {TELEBIT_USER}:{TELEBIT_GROUP} {TELEBIT_PATH}/ + +[Unit] +Description=Telebit Remote +Documentation=https://git.coolaj86.com/coolaj86/telebit.js/ +After=network-online.target +Wants=network-online.target systemd-networkd-wait-online.service + +[Service] +# Restart on crash (bad signal), and also on 'clean' failure (error exit code) +# Allow up to 3 restarts within 10 seconds +# (it's unlikely that a user or properly-running script will do this) +Restart=always +StartLimitInterval=10 +StartLimitBurst=3 + +# User and group the process will run as +User={TELEBIT_USER} +Group={TELEBIT_GROUP} + +WorkingDirectory={TELEBIT_PATH} +# custom directory cannot be set and will be the place where this exists, not the working directory +ExecStart={TELEBIT_PATH}/bin/node {TELEBIT_PATH}/bin/telebitd.js daemon --config {TELEBIT_PATH}/etc/telebitd.yml +ExecReload=/bin/kill -USR1 $MAINPID + +# Limit the number of file descriptors and processes; see `man systemd.exec` for more limit settings. +# Unmodified, this is not expected to use more than this. +LimitNOFILE=1048576 +LimitNPROC=64 + +# Use private /tmp and /var/tmp, which are discarded after this stops. +PrivateTmp=true +# Use a minimal /dev +PrivateDevices=true +# Hide /home, /root, and /run/user. Nobody will steal your SSH-keys. +ProtectHome=true +# Make /usr, /boot, /etc and possibly some more folders read-only. +ProtectSystem=full +# ... except for a few because we want a place for config, logs, etc +# This merely retains r/w access rights, it does not add any new. +# Must still be writable on the host! +ReadWriteDirectories={TELEBIT_RW_DIRS} + +# Note: in v231 and above ReadWritePaths has been renamed to ReadWriteDirectories +; ReadWritePaths={TELEBIT_RW_DIRS} + +# The following additional security directives only work with systemd v229 or later. +# They further retrict privileges that can be gained. +# Note that you may have to add capabilities required by any plugins in use. +CapabilityBoundingSet=CAP_NET_BIND_SERVICE +AmbientCapabilities=CAP_NET_BIND_SERVICE +NoNewPrivileges=true + +# Caveat: Some features may need additional capabilities. +# For example an "upload" may need CAP_LEASE +; CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_LEASE +; AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_LEASE +; NoNewPrivileges=true + +[Install] +WantedBy=multi-user.target diff --git a/usr/share/template-launcher.js b/usr/share/template-launcher.js new file mode 100644 index 0000000..a53731a --- /dev/null +++ b/usr/share/template-launcher.js @@ -0,0 +1,33 @@ +'use strict'; + +var path = require('path'); +var fs = require('fs'); +var os = require('os'); + +var files = [ + [ (process.env.TELEBIT_SERVICE_TPL || path.join(__dirname, 'dist/etc/systemd/system/telebit.service.tpl')) + , (process.env.TELEBIT_SERVICE || path.join(__dirname, 'dist/etc/systemd/system/telebit.service')) + ] +, [ (process.env.TELEBIT_PLIST_TPL || path.join(__dirname, 'dist/Library/LaunchDaemons/cloud.telebit.remote.plist.tpl')) + ,(process.env.TELEBIT_PLIST || path.join(__dirname, 'dist/Library/LaunchDaemons/cloud.telebit.remote.plist')) + ] +]; +var vars = { + telebitPath: process.env.TELEBIT_PATH || path.resolve(__dirname, '../..') +, telebitRwDirs: [ + (process.env.TELEBIT_PATH || path.resolve(__dirname, '../..')) + , path.join(os.homedir(), '.config/telebit') + , path.join(os.homedir(), '.local/share/telebit') + , ].join(' ') +, telebitUser: process.env.TELEBIT_USER || os.userInfo().username +, telebitGroup: process.env.TELEBIT_GROUP || ('darwin' === os.platform() ? 'staff' : os.userInfo().username) +}; +files.forEach(function (f) { + var text = fs.readFileSync(f[0], 'utf8') + .replace(/{TELEBIT_PATH}/g, vars.telebitPath) + .replace(/{TELEBIT_USER}/g, vars.telebitUser) + .replace(/{TELEBIT_GROUP}/g, vars.telebitGroup) + .replace(/{TELEBIT_RW_DIRS}/g, vars.telebitRwDirs) + ; + fs.writeFileSync(f[1], text, 'utf8'); +});