update systemd configs

dist/etc/skel/.config/systemd/user/telebit.service

@@ -0,0 +1,61 @@
+# Pre-req
+# sudo adduser telebit --home /opt/telebit
+# sudo mkdir -p /opt/telebit/
+# sudo chown -R telebit:telebit /opt/telebit/
+
+[Unit]
+Description=Telebit Remote
+Documentation=https://git.coolaj86.com/coolaj86/telebit.js/
+
+[Service]
+# Restart on crash (bad signal), but not on 'clean' failure (error exit code)
+# Allow up to 3 restarts within 10 seconds
+# (it's unlikely that a user or properly-running script will do this)
+Restart=always
+StartLimitInterval=10
+StartLimitBurst=3
+
+# https://wiki.archlinux.org/index.php/Systemd/User
+# ~/.local/share/systemd/user/
+WorkingDirectory=%h/.config/telebit
+# custom directory cannot be set and will be the place where gitea exists, not the working directory
+ExecStart=/opt/telebit/bin/node /opt/telebit/bin/telebit.js --config /etc/telebit/telebit.yml
+ExecReload=/bin/kill -USR1 $MAINPID
+
+# Limit the number of file descriptors and processes; see `man systemd.exec` for more limit settings.
+# Unmodified gitea is not expected to use more than this.
+LimitNOFILE=1048576
+LimitNPROC=64
+
+# Use private /tmp and /var/tmp, which are discarded after gitea stops.
+PrivateTmp=true
+# Use a minimal /dev
+PrivateDevices=true
+# Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
+ProtectHome=true
+# Make /usr, /boot, /etc and possibly some more folders read-only.
+ProtectSystem=full
+# ... except /opt/gitea because we want a place for the database
+# and /var/log/gitea because we want a place where logs can go.
+# This merely retains r/w access rights, it does not add any new.
+# Must still be writable on the host!
+ReadWriteDirectories=/opt/telebit /etc/telebit
+
+# Note: in v231 and above ReadWritePaths has been renamed to ReadWriteDirectories
+; ReadWritePaths=/opt/telebit /etc/telebit
+
+# The following additional security directives only work with systemd v229 or later.
+# They further retrict privileges that can be gained by gitea.
+# Note that you may have to add capabilities required by any plugins in use.
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+NoNewPrivileges=true
+
+# Caveat: Some features may need additional capabilities.
+# For example an "upload" may need CAP_LEASE
+; CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_LEASE
+; AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_LEASE
+; NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target

dist/etc/systemd/system/telebit.service

@@ -4,7 +4,7 @@
 # sudo chown -R telebit:telebit /opt/telebit/
 
 [Unit]
-Description=Telebit Relay
+Description=Telebit Remote
 Documentation=https://git.coolaj86.com/coolaj86/telebit.js/
 After=network-online.target
 Wants=network-online.target systemd-networkd-wait-online.service
@@ -13,7 +13,7 @@ Wants=network-online.target systemd-networkd-wait-online.service
 # Restart on crash (bad signal), but not on 'clean' failure (error exit code)
 # Allow up to 3 restarts within 10 seconds
 # (it's unlikely that a user or properly-running script will do this)
-Restart=on-abnormal
+Restart=always
 StartLimitInterval=10
 StartLimitBurst=3
 

installer/get.sh

@@ -191,18 +191,38 @@ if [ -z "$(cat /etc/passwd | grep $my_user)" ]; then
   sudo adduser --home $TELEBIT_PATH --gecos '' --disabled-password $my_user >/dev/null 2>&1
 fi
 
-if [ ! -f "/etc/$my_user/$my_app.yml" ]; then
+my_config="$TELEBIT_PATH/etc/$my_app.yml"
-  echo "### Creating config file from template. sudo may be required"
+mkdir -p "$(dirname $my_config)"
-  #echo "sudo rsync -a examples/$my_app.yml /etc/$my_user/$my_app.yml"
+if [ ! -e "$my_config" ]; then
-  sudo bash -c "echo 'email: $my_email' >> /etc/$my_user/$my_app.yml"
+  #rsync -a examples/$my_app.yml "$my_config"
-  sudo bash -c "echo 'secret: $my_secret' >> /etc/$my_user/$my_app.yml"
+  echo "email: $my_email" >> "$my_config"
-  sudo bash -c "echo 'servernames: [ $my_servernames ]' >> /etc/$my_user/$my_app.yml"
+  echo "secret: $my_secret" >> "$my_config"
-  sudo bash -c "cat examples/$my_app.yml.tpl >> /etc/$my_user/$my_app.yml"
+  echo "servernames:\n  $my_servernames: {}" >> "$my_config"
+  #echo "dynamic_ports:\n  {}" >> "$my_config"
+  cat examples/$my_app.yml.tpl >> "$my_config"
+fi
+
+my_config="$HOME/.config/$my_user/$my_app.yml"
+mkdir -p "$(dirname $my_config)"
+if [ ! -e "$my_config" ]; then
+  echo "cli: true" >> "$my_config"
+  echo "email: $my_email" >> "$my_config"
+  echo "secret: $my_secret" >> "$my_config"
+  cat examples/$my_app.yml.tpl >> "$my_config"
+fi
+
+my_config_link="/etc/$my_user/$my_app.yml"
+if [ ! -e "$my_config_link" ]; then
+  echo "sudo ln -sf '$my_config' '$my_config_link'"
+  #sudo mkdir -p /etc/$my_user
+  sudo ln -sf "$my_config" "$my_config_link"
 fi
 
 echo "sudo chown -R $my_user '$TELEBIT_PATH' '/etc/$my_user'"
 sudo chown -R $my_user "$TELEBIT_PATH" "/etc/$my_user"
 
+# ~/.config/systemd/user/
+# %h/.config/telebit/telebit.yml
 echo "### Adding $my_app is a system service"
 echo "sudo rsync -a $TELEBIT_PATH/dist/etc/systemd/system/$my_app.service /etc/systemd/system/$my_app.service"
 sudo rsync -a $TELEBIT_PATH/dist/etc/systemd/system/$my_app.service /etc/systemd/system/$my_app.service