Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2025-11-19 14:32:27 -05:00
Code Issues Projects Releases Packages Wiki Activity

always create /var/cache/nginx for web servers

Browse source 
This avoids needing to restart nginx for ReadWritePaths to kick in after
creating it.
This commit is contained in:
Daniel Micay 2025-10-27 20:51:47 -04:00
parent fb9e4d6769
commit c4af821eda
2 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
deploy-web
View file

@ -16,7 +16,8 @@ for host in ${hosts_web[@]}; do
rsync --chmod=755 create-session-ticket-keys rotate-session-ticket-keys $remote:/usr/local/bin/ rsync --chmod=755 create-session-ticket-keys rotate-session-ticket-keys $remote:/usr/local/bin/
rsync -r --delete etc/systemd/system/nginx.service.d/ $remote:/etc/systemd/system/nginx.service.d rsync -r --delete etc/systemd/system/nginx.service.d/ $remote:/etc/systemd/system/nginx.service.d
ssh $remote "groupadd -fg 2100 tls ssh $remote "mkdir -pm755 /var/cache/nginx
groupadd -fg 2100 tls
mkdir -p -m 750 /etc/session-ticket-keys && chgrp tls /etc/session-ticket-keys mkdir -p -m 750 /etc/session-ticket-keys && chgrp tls /etc/session-ticket-keys
systemctl daemon-reload && systemctl daemon-reload &&
systemctl enable create-session-ticket-keys.service rotate-session-ticket-keys.timer nginx" systemctl enable create-session-ticket-keys.service rotate-session-ticket-keys.timer nginx"

2
etc/systemd/system/nginx.service.d/override.conf
View file

@ -14,7 +14,7 @@ ProtectKernelModules=true
ProtectKernelTunables=true ProtectKernelTunables=true
ProtectProc=invisible ProtectProc=invisible
ProtectSystem=strict ProtectSystem=strict
ReadWritePaths=/var/lib/nginx /var/log/nginx -/var/cache/nginx ReadWritePaths=/var/lib/nginx /var/log/nginx /var/cache/nginx
Restart=always Restart=always
RestartMaxDelaySec=10s RestartMaxDelaySec=10s
RestartSec=100ms RestartSec=100ms