9 Commits

Author SHA1 Message Date
Sunil Mohan Adapa
efe303de31
ttrss: Use drop-in config component for /etc files
Tests:

- Config files are all symlinks in /etc/
- Web interface works

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-06-05 20:29:56 -04:00
Sunil Mohan Adapa
40eecb6446
*: Move modules-enabled files to /usr/share
- This will leave /etc/{plinth,freedombox} empty by default making service more
robust to run across various environments and situations. See systemd's
explanation for more details.

- Use Debian maintainer scripts remove all the existing files in
/etc/plinth/modules-enabled.

- Read from /usr/share/freedombox/modules-enabled then from
/etc/plinth/modules-enabled and finally from /etc/freedombox/modules-enabled.
Later read ones override previously read files. Any file pointing to /dev/null
will mean the module must be ignored.

Tests:

- Clean up /etc/plinth, /etc/freedombox and
/usr/share/freedombox/modules-enabled. Run service and notice that files are
getting loaded from development folder using a debug message.

- Run setup.py and notice that files get installed in
/usr/share/freedombox/modules-enabled/ and in the next run they get loaded from
there.

- Create a override file in /etc/plinth/modules-enabled/transmission and notice
that overriden file gets priority over the one in
/usr/share/freedombox/modules-enabled.

- Link the file /etc/plinth/modules-enabled/transmission to /dev/null and notice
that is not loaded.

- Create another file in /etc/freedombox/modules-enabled/transmission and notice
that it overrides the previous two files.

- All affected modules are loaded.

- Build a new Debian package and ensure that upgrading 23.8 to new version
removes are all configuration files.

- Build developer documentation and test that Tutorial -> Full Code and Tutorial
-> Skeleton sections have been updated with references to
-.../modules-enabled/... paths.

- Install quassel and notice that certificates were copied to /var/lib/quassel
directory. Change domain to another domain and notice that certificates were
copied again to that directory.

Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-05-13 07:08:43 -04:00
nbenedek
97d9174775
ttrss: Allow apps to use /tt-rss URL instead of separate one
- When tt-rss is accessed via a smart device, authenticate the
user with basic auth, otherwise authenticate with mod_auth_pubtkt.

- I tested logging in with the official TT-RSS Android app and
Fiery Feeds for iPhone.

- Reload apache2 to apply the changes.

Signed-off-by: nbenedek <contact@nbenedek.me>
[sunil: Use Authorization header instead of user agent]
[sunil: Update description to talk about both URLs]
[sunil: Increment app version to reload apache]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2023-04-25 12:13:42 -07:00
Benedek Nagy
1f83c92802
tt-rss: Restrict access to feed-reader group in "/tt-rss-app"
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2022-02-14 18:03:02 -05:00
Benedek Nagy
e662e091dd
tt-rss: Allow published articles to be publicly available
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2022-01-13 11:03:14 -08:00
Sunil Mohan Adapa
c7c9d49939
ttrss: Add systemd security hardening to daemon
→ Overall exposure level for tt-rss.service: 1.1 OK 🙂

Tests:

- Run ./setup.py install. systemctl daemon-reload. Subscribe to a new feed and
don't wait for it load the feed. Then start/restart the daemon. The daemon
successfully fetches the feed. When tt-rss interface is loaded again the feed
items are available.

- For getting output of the daemon add StandardOutput=journal option to the
service file.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2021-10-11 15:47:05 -04:00
Sunil Mohan Adapa
2c4423baaf
ttrss: Fix daemon not running sometimes on startup
- Sometimes when postgres is not available, the daemon fails to create a
database connection. In this case the daemon permanently exits with code 101
instead of trying again.

- This happens more prominently when booting the system and postgres may not be
available. Although tt-rss.service has Wants= and After= on postgres.service, it
appears that postgres does not have proper startup notification with systemd.

- This may also happen in other situations such as when temporarily restarting
postgres during upgrades or backup/restore operations.

- Fix the issue by make the daemon restart after a failure. This seems
appropriate because the daemon is coded like a web page to fail and exit on
all, even temporary, errors.

Tests:

- Without the patch, stop postgres@13-main.service. Start tt-rss.service. It
will fail permanently and not try to restart.

- With the patch, daemon-reload systemd. Notice that the intended changes
reflect with systemd status. Start the service. It fails. But retries 2 minutes
later with failure again. When postgres is started again, the next attempt
succeeds.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2021-10-11 15:46:59 -04:00
Sunil Mohan Adapa
ff247fa5aa
setup: Move app data files into respective apps
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2019-03-17 16:20:57 -04:00
Sunil Mohan Adapa
fdcbd46513
setup: Move app enabling files to respective apps
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2019-03-17 16:20:54 -04:00