mirror of
https://github.com/freedombox/FreedomBox.git
synced 2026-09-19 04:59:01 +00:00
11801de288
After enabling the calibre app, the app uses IP 127.0.0.1 to advertise ODPS feeds via BonJour/mDNS. It breaks accessing freedombox.local as it now points to 127.0.0.1. This MR disables the BonJour in Calibre. Fixes #2027. Tests performed on both Debian stable and testing containers: - Check the accessability of freedombox.local: 1) Before applying patch: - Start the container, check on the host that freedombox.local points to correct IP address of the container: ``` host$ avahi-resolve -4 --name freedombox.local freedombox.local 10.42.1.166 ``` - Enable the calibre app. Check on the host that freedombox.local points to wrong ip address 127.0.0.1: ``` host$ avahi-resolve -4 --name freedombox.local freedombox.local 127.0.0.1 ``` 2) Stop the calibre app, apply patch (update the calibre systemd service file, reload systemd), restart the Service Discovery app, check on the host that freedombox.local points to correct address. 3) Start the calibre app, check on the host that freedombox.local points to correct address. - All the calibre functional tests pass. Signed-off-by: Veiko Aasa <veiko17@disroot.org> Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
47 lines
2.0 KiB
Desktop File
47 lines
2.0 KiB
Desktop File
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
[Unit]
|
|
Description=calibre Content Server
|
|
Documentation=man:calibre-server(1)
|
|
After=network.target
|
|
|
|
[Service]
|
|
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER CAP_NET_ADMIN CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE CAP_KILL CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_LINUX_IMMUTABLE CAP_IPC_LOCK CAP_SYS_CHROOT CAP_BLOCK_SUSPEND CAP_LEASE CAP_SYS_PACCT CAP_SYS_TTY_CONFIG CAP_SYS_BOOT CAP_MAC_ADMIN CAP_MAC_OVERRIDE CAP_SYS_NICE CAP_SYS_RESOURCE
|
|
DevicePolicy=closed
|
|
Environment=HOME="/var/lib/calibre-server-freedombox"
|
|
Environment=DEFAULT_LIBRARY="/var/lib/calibre-server-freedombox/libraries/Library"
|
|
Environment=ARGS="--listen-on 127.0.0.1 --url-prefix /calibre --port 8844 --enable-local-write --disable-auth --disable-use-bonjour"
|
|
ExecStartPre=sh -e -c "files=$$(ls ${HOME}/libraries/*/metadata.db 2>/dev/null || true); [ \"x$${files}\" = \"x\" ] && (mkdir -p \"${DEFAULT_LIBRARY}\" && calibredb --with-library=\"${DEFAULT_LIBRARY}\" list_categories > /dev/null) || true"
|
|
ExecStart=sh -e -c "files=${HOME}/libraries/*/metadata.db; libraries=$$(dirname $${files}) ; exec /usr/bin/calibre-server $ARGS $${libraries}"
|
|
Restart=on-failure
|
|
ExecReload=/bin/kill -HUP $MAINPID
|
|
DynamicUser=yes
|
|
LockPersonality=yes
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateMounts=yes
|
|
PrivateTmp=yes
|
|
PrivateUsers=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHome=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectSystem=strict
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
StateDirectory=calibre-server-freedombox
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@resources
|
|
SystemCallFilter=~@privileged
|
|
SystemCallErrorNumber=EPERM
|
|
Type=simple
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|