52 lines
1.6 KiB
Desktop File
52 lines
1.6 KiB
Desktop File
# systemd unit for running the blog directly on a server (no Docker).
|
|
#
|
|
# Setup, assuming the checkout lives at /opt/yap-blog:
|
|
#
|
|
# sudo useradd --system --home-dir /opt/yap-blog --shell /usr/sbin/nologin yap-blog
|
|
# cd /opt/yap-blog
|
|
# npm ci && npm run build # .env must hold the production DATABASE_URL
|
|
# npm run db:migrate && npm run db:seed
|
|
# sudo chown -R yap-blog:yap-blog /opt/yap-blog
|
|
# sudo cp deploy/yap-blog.service /etc/systemd/system/
|
|
# sudo systemctl daemon-reload
|
|
# sudo systemctl enable --now yap-blog
|
|
#
|
|
# After deploying new code: npm ci && npm run build && npm run db:migrate,
|
|
# then `sudo systemctl restart yap-blog`. Adjust the npm path in ExecStart
|
|
# if `which npm` says something else (e.g. a nodesource or nvm install).
|
|
|
|
[Unit]
|
|
Description=Yap Blog (Next.js)
|
|
Wants=network-online.target
|
|
After=network-online.target postgresql.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=yap-blog
|
|
Group=yap-blog
|
|
WorkingDirectory=/opt/yap-blog
|
|
# `next start` runs in production mode and reads .env from the working
|
|
# directory. To keep secrets outside the checkout instead, delete .env and
|
|
# uncomment:
|
|
# EnvironmentFile=/etc/yap-blog/env
|
|
ExecStart=/usr/bin/npm start
|
|
Restart=on-failure
|
|
RestartSec=3
|
|
|
|
# The filesystem is read-only to the service except where it writes:
|
|
# uploaded images, and .next (Next.js keeps runtime caches/traces there).
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectSystem=strict
|
|
ProtectHome=read-only
|
|
ReadWritePaths=/opt/yap-blog/uploads /opt/yap-blog/.next
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
RestrictSUIDSGID=true
|
|
RestrictRealtime=true
|
|
LockPersonality=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|