Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2025-07-21 06:03:11 -04:00
Code Issues Projects Releases Packages Wiki Activity

add tls group for session ticket keys

Browse source
This commit is contained in:
Daniel Micay 2025-05-27 14:21:58 -04:00
parent 72ffc14258
commit 94a2567b15
4 changed files with 6 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
deploy-initial
View file

@ -61,6 +61,7 @@ rsync -cv etc/nftables/nftables-${hosts_firewall[$host]:-web}.conf $remote:/mnt/
ssh $remote "arch-chroot /mnt systemctl enable chronyd.service fstrim.timer logrotate.timer nftables.service plocate-updatedb.timer systemd-networkd.service systemd-oomd.service sshd.service sysstat.service unbound.service"
ssh $remote "arch-chroot /mnt systemctl disable remote-fs.target systemd-network-generator.service systemd-userdbd.socket"
ssh $remote "arch-chroot /mnt groupadd -g 2000 io_uring"
ssh $remote "arch-chroot /mnt groupadd -g 2100 tls"
ssh $remote "umask 077 && dd if=/dev/random of=/mnt/swapfile bs=1M count=$swap status=progress"

2
etc/fstab.virtual
View file

@ -1,2 +1,2 @@
/dev/mapper/swap none swap defaults 0 0
tmpfs /etc/session-ticket-keys tmpfs size=1M,mode=750,noswap,x-systemd.before=create-session-ticket-keys.service,x-systemd.required-by=create-session-ticket-keys.service 0 0
tmpfs /etc/session-ticket-keys tmpfs size=1M,mode=750,gid=2100,noswap,x-systemd.before=create-session-ticket-keys.service,x-systemd.required-by=create-session-ticket-keys.service 0 0

3
etc/systemd/system/create-session-ticket-keys.service
View file

@ -4,8 +4,9 @@ Before=nginx.service
[Service]
ExecStart=/usr/local/bin/create-session-ticket-keys
Group=tls
Type=oneshot
UMask=0077
UMask=0027
[Install]
WantedBy=multi-user.target

3
etc/systemd/system/rotate-session-ticket-keys.service
View file

@ -5,5 +5,6 @@ Requires=nginx.service create-session-ticket-keys.service
[Service]
ExecStart=/usr/local/bin/rotate-session-ticket-keys
Group=tls
Type=oneshot
UMask=0077
UMask=0027