graphene-os-server-infrastr.../systemd/system/nginx.service.d/local.conf

[Service]
CapabilityBoundingSet=CAP_DAC_OVERRIDE CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID
ExecStart=
ExecStart=/usr/bin/nginx -g 'pid /run/nginx.pid;'
LockPersonality=true
NoNewPrivileges=true
MemoryDenyWriteExecute=true
PrivateIPC=true
PrivateTmp=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
ReadWritePaths=/var/lib/nginx /var/log/nginx -/var/cache/nginx
Restart=always
RestartSec=1
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
RuntimeDirectory=nginx
RuntimeDirectoryMode=700
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@obsolete
extend nginx service hardening 2022-08-09 04:43:51 -04:00			`[Service]`
limit nginx service capabilities Running nginx as non-root would be possible via CAP_NET_BIND_SERVICE as an ambient capability but it would be inherited by workers. It's better to leave the supervisor process as root for the time being unless nginx was taught to use socket activation or drop capabilities for workers. 2022-08-10 09:07:25 -04:00			`CapabilityBoundingSet=CAP_DAC_OVERRIDE CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID`
remove Arch Linux nginx error_log configuration error_log works the same way as add_header where defining it again on the same level is additive and logs to both places, meaning that there are duplicated logs when defining a proper syslog error_log output at the top level. 2023-02-17 16:37:57 -05:00			`ExecStart=`
			`ExecStart=/usr/bin/nginx -g 'pid /run/nginx.pid;'`
extend nginx service hardening 2022-08-09 04:43:51 -04:00			`LockPersonality=true`
			`NoNewPrivileges=true`
			`MemoryDenyWriteExecute=true`
			`PrivateIPC=true`
			`PrivateTmp=true`
			`ProcSubset=pid`
			`ProtectClock=true`
			`ProtectControlGroups=true`
sort nginx hardening.conf options 2022-08-10 08:27:43 -04:00			`ProtectHome=true`
			`ProtectHostname=true`
extend nginx service hardening 2022-08-09 04:43:51 -04:00			`ProtectKernelLogs=true`
			`ProtectKernelModules=true`
			`ProtectKernelTunables=true`
			`ProtectProc=invisible`
			`ProtectSystem=strict`
			`ReadWritePaths=/var/lib/nginx /var/log/nginx -/var/cache/nginx`
auto-restart nginx if master process is killed nginx handles restarting workers automatically but the master process is typically killed by the OOM killer too. 2022-09-26 16:03:12 -04:00			`Restart=always`
			`RestartSec=1`
extend nginx service hardening 2022-08-09 04:43:51 -04:00			`RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX`
			`RestrictNamespaces=true`
			`RestrictRealtime=true`
			`RestrictSUIDSGID=true`
replace tmpfiles.d with RuntimeDirectory for nginx This is much more robust because nginx will fail to start after being killed or crashing due to only removing old Unix domain sockets when it stops cleanly. It ends up owned by root:root instead of root:http which is fine because only the master process opens it. 2022-09-26 15:37:43 -04:00			`RuntimeDirectory=nginx`
			`RuntimeDirectoryMode=700`
extend nginx service hardening 2022-08-09 04:43:51 -04:00			`SystemCallArchitectures=native`
			`SystemCallFilter=@system-service`
			`SystemCallFilter=~@obsolete`