mirror of
https://github.com/freedombox/FreedomBox.git
synced 2026-04-29 10:10:19 +00:00
cfdf92cf0d
- Fix icon paths in copyright file. - Minor refactoring. - Add Kiwix library link to app page as well as users may want to see the content available before installing the app. - Consolidate terminology to 'content package' for UI and just 'package' internally. - Drop unused SYSTEM_USER constant. - Simplify the ExecStart= in systemd service file. - Fix incorrect i18n caused by non-lazy formatting of strings. - Confirm that xml parsing is not vulnerable as expat library of required version is used in Debian bookworm. - Don't start the kiwix daemon when managing library if app is disabled. - Ignore errors when removing files during uninstallation. - Handle failures more gracefully when library XML file does not have required attributes. - Update SVG/PNG icons to adhere to FreedomBox guidelines. - Trim block translations in templates. - Drop comments/deadcode inside translation strings. - Drop a comment inside add content page that only makes sense with multiple methods for adding content. - tests: Don't use pkg_resources library as it is deprecated. We can use importlib.resources library in future if we run tests on zip installations. - Fix potential security issues while writing file to tmp directory. Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
48 lines
1.9 KiB
Desktop File
48 lines
1.9 KiB
Desktop File
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
[Unit]
|
|
Description=Kiwix Content Server
|
|
Documentation=man:kiwix-serve(1)
|
|
After=network.target
|
|
ConditionPathExists=/usr/bin/kiwix-serve
|
|
|
|
[Service]
|
|
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER CAP_NET_ADMIN CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE CAP_KILL CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_LINUX_IMMUTABLE CAP_IPC_LOCK CAP_SYS_CHROOT CAP_BLOCK_SUSPEND CAP_LEASE CAP_SYS_PACCT CAP_SYS_TTY_CONFIG CAP_SYS_BOOT CAP_MAC_ADMIN CAP_MAC_OVERRIDE CAP_SYS_NICE CAP_SYS_RESOURCE
|
|
DevicePolicy=closed
|
|
Environment=HOME="/var/lib/kiwix-server-freedombox"
|
|
Environment=LIBRARY_PATH="/var/lib/kiwix-server-freedombox/library_zim.xml"
|
|
Environment=ARGS="--library --port=4201 --urlRootLocation=kiwix"
|
|
ExecStartPre=sh -e -c "mkdir -p $HOME/content; library=$$(ls ${LIBRARY_PATH} 2>/dev/null || true); [ \"x$${library}\" = \"x\" ] && (mkdir -p \"${HOME}\" && echo '<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n<library version=\"20110515\">\n</library>' > \"${LIBRARY_PATH}\") || true"
|
|
ExecStart=/usr/bin/kiwix-serve $ARGS $LIBRARY_PATH
|
|
Restart=on-failure
|
|
ExecReload=/bin/kill -HUP $MAINPID
|
|
DynamicUser=yes
|
|
LockPersonality=yes
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateMounts=yes
|
|
PrivateTmp=yes
|
|
PrivateUsers=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHome=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectSystem=strict
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
StateDirectory=kiwix-server-freedombox
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@resources
|
|
SystemCallFilter=~@privileged
|
|
SystemCallErrorNumber=EPERM
|
|
Type=simple
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|