File default-paths.patch of Package gotosocial

Overview Repositories Revisions Requests Users Attributes Meta

File default-paths.patch of Package gotosocial (Revision 15edb33a2bc73ca7a8b031bbb23dfb27)

Currently displaying revision 15edb33a2bc73ca7a8b031bbb23dfb27 , Show latest

From fa307813da41057492df096417ce8c405cc7a02e Mon Sep 17 00:00:00 2001
From: tux93 <tux93@opensuse.org>
Date: Fri, 26 Jan 2024 14:51:58 +0100
Subject: [PATCH] Modify default paths to match packaging, extend AppArmor
 profile

---
 example/apparmor/gotosocial | 31 +++++++++++--------------------
 example/config.yaml         | 12 ++++++------
 example/gotosocial.service  |  5 +++--
 3 files changed, 20 insertions(+), 28 deletions(-)

diff --git a/example/apparmor/gotosocial b/example/apparmor/gotosocial
index 40686194..d052f54f 100644
--- a/example/apparmor/gotosocial
+++ b/example/apparmor/gotosocial
@@ -2,39 +2,30 @@
 
 profile gotosocial flags=(attach_disconnected, mediate_deleted) {
   #include <abstractions/base>
+  #include <abstractions/dbus-session-strict>
+  #include <abstractions/gio-open>
   #include <abstractions/nameservice>
 
-  /gotosocial/gotosocial mrix,
-  /usr/bin/gotosocial mrix,
-  /usr/local/bin/gotosocial mrix,
-
-  owner /gotosocial/{,**} r,
-  owner /gotosocial/db/* wk,
-  owner /gotosocial/storage/** wk,
+  /usr/sbin/gotosocial mrix,
 
   # Allow GoToSocial to write logs
   #
   # NOTE: you only need to allow write permissions to /var/log/syslog if you've
   # enabled logging to syslog. Otherwise, you can comment out that line.
-  /var/log/gotosocial/* w,
-  owner /var/log/syslog w,
+  # owner /var/log/syslog w,
 
-  # These directories are not currently used by any of the recommended
-  # GoToSocial installation methods, but they may be used in the future and/or
-  # for custom installations.
   owner /etc/gotosocial/{,**} r,
-  owner /usr/lib/gotosocial/{,**} r,
   owner /usr/share/gotosocial/{,**} r,
-  owner /usr/local/etc/gotosocial/{,**} r,
-  owner /usr/local/lib/gotosocial/{,**} r,
-  owner /usr/local/share/gotosocial/{,**} r,
-  owner /var/lib/gotosocial/{,**} r,
-  owner /opt/gotosocial/{,**} r,
-  owner /run/gotosocial/{,**} r,
+  owner /var/lib/gotosocial/{,**} rwk,
 
+  /etc/mime.types r,
   /proc/sys/net/core/somaxconn r,
+  /sys/fs/cgroup/system.slice/gotosocial.service/cgroup.controllers r,
+  /sys/fs/cgroup/system.slice/gotosocial.service/pids.current r,
   /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
-  owner @{PROC}/@{pid}/cpuset r,
+  owner /proc/*/cgroup r,
+  owner /proc/*/cpuset r,
+  owner /proc/*/mountinfo r,
 
   # TCP / UDP network access
   network inet stream,
diff --git a/example/config.yaml b/example/config.yaml
index bbdd8adb..90cca340 100644
--- a/example/config.yaml
+++ b/example/config.yaml
@@ -266,12 +266,12 @@ cache:
 # String. Directory from which gotosocial will attempt to load html templates (.tmpl files).
 # Examples: ["/some/absolute/path/", "./relative/path/", "../../some/weird/path/"]
 # Default: "./web/template/"
-web-template-base-dir: "./web/template/"
+web-template-base-dir: "/usr/share/gotosocial/web/template/"
 
 # String. Directory from which gotosocial will attempt to serve static web assets (images, scripts).
 # Examples: ["/some/absolute/path/", "./relative/path/", "../../some/weird/path/"]
 # Default: "./web/assets/"
-web-asset-base-dir: "./web/assets/"
+web-asset-base-dir: "/usr/share/gotosocial/web/assets/"
 
 ###########################
 ##### INSTANCE CONFIG #####
@@ -496,8 +496,8 @@ storage-backend: "local"
 # this directory, and create new subdirectories and files within it.
 # Only required when running with the local storage backend.
 # Examples: ["/home/gotosocial/storage", "/opt/gotosocial/datastorage"]
-# Default: "/gotosocial/storage"
-storage-local-base-path: "/gotosocial/storage"
+# Default: "/var/lib/gotosocial/storage"
+storage-local-base-path: "/var/lib/gotosocial/storage"
 
 # String. API endpoint of the S3 compatible service.
 # Only required when running with the s3 storage backend.
@@ -608,8 +608,8 @@ letsencrypt-port: 80
 # backup easier, but you might wish to move them elsewhere if they're also accessed by other services.
 # In any case, make sure GoToSocial has permissions to write to / read from this directory.
 # Examples: ["/home/gotosocial/storage/certs", "/acmecerts"]
-# Default: "/gotosocial/storage/certs"
-letsencrypt-cert-dir: "/gotosocial/storage/certs"
+# Default: "/var/lib/gotosocial/storage/certs"
+letsencrypt-cert-dir: "/var/lib/gotosocial/storage/certs"
 
 # String. Email address to use when registering LetsEncrypt certs.
 # Most likely, this will be the email address of the instance administrator.
diff --git a/example/gotosocial.service b/example/gotosocial.service
index 37a66c66..606ff8ee 100644
--- a/example/gotosocial.service
+++ b/example/gotosocial.service
@@ -12,10 +12,11 @@ Group=gotosocial
 
 Type=exec
 Restart=on-failure
+AppArmorProfile=gotosocial
 
 # change if your path to the GoToSocial binary is different
-ExecStart=/gotosocial/gotosocial --config-path config.yaml server start
-WorkingDirectory=/gotosocial
+ExecStart=/usr/sbin/gotosocial --config-path /etc/gotosocial/config.yaml server start
+WorkingDirectory=/var/lib/gotosocial
 
 # Sandboxing options to harden security
 # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
-- 
2.43.0

Places

File default-paths.patch of Package gotosocial (Revision 15edb33a2bc73ca7a8b031bbb23dfb27)

Places