package changes

static/Trixie/nginx-raweb.service

@@ -0,0 +1,70 @@
+[Unit]
+Description=A high performance web server and a reverse proxy server (twiy)
+After=syslog.target network-online.target remote-fs.target nss-lookup.target
+Wants=network-online.target
+
+[Service]
+Type=forking
+PIDFile=/run/nginx.pid
+Environment=LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2
+ExecStartPre=/usr/bin/install -d -o nginx -g nginx -m 0755 /run/nginx/temp /run/nginx/temp/client_body /run/nginx/temp/proxy /run/nginx/temp/fastcgi /run/nginx/temp/uwsgi /run/nginx/temp/scgi /var/log/nginx
+ExecStartPre=/usr/sbin/nginx -t
+ExecStart=/usr/sbin/nginx -c /nginx/nginx.conf
+ExecReload=/bin/sh -c "/bin/kill -s HUP $(/bin/cat /run/nginx.pid)"
+ExecStop=/bin/sh -c "/bin/kill -s QUIT $(/bin/cat /run/nginx.pid)"
+TimeoutStartSec=10
+LimitNOFILE=65535
+
+# === hardening: deny-everything by default, allowlist via bind mounts ===
+# TemporaryFileSystem=/ replaces the visible filesystem with an empty tmpfs.
+# Everything not bind-mounted below is invisible to nginx workers — even
+# read access. Compromise of a worker can no longer enumerate /etc/passwd,
+# /home/*, /var/lib/*, /root, /opt, etc.
+TemporaryFileSystem=/
+
+# Read-only: nginx binary, dynamic linker, all linked libs, system config,
+# CA bundles, Let's Encrypt certs (live/ + archive/ both under /etc).
+BindReadOnlyPaths=/usr
+BindReadOnlyPaths=/lib
+BindReadOnlyPaths=/lib64
+BindReadOnlyPaths=/bin
+BindReadOnlyPaths=/sbin
+BindReadOnlyPaths=/etc
+
+# Read-write: nginx runtime state.
+#   /run               nginx.pid, nginx.lock, /run/nginx/temp/*, PHP-FPM sock
+#   /var/log/nginx     access.log, error.log
+#   /nginx             config dir (read-mostly but reload writes some state)
+BindPaths=/run
+BindPaths=/var/log/nginx
+BindPaths=/nginx
+BindPaths=/var/cache/nginx
+BindPaths=/srv
+BindPaths=/hostdata
+BindPaths=/raweb
+
+NoNewPrivileges=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
+PrivateDevices=true
+PrivateTmp=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+LockPersonality=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+# NOTE deliberately OFF:
+#   MemoryDenyWriteExecute=true       breaks LuaJIT (JIT writable+executable pages)
+#   SystemCallFilter=~@resources      breaks nginx workers' prlimit64()
+# ProtectSystem and ProtectHome are redundant under TemporaryFileSystem=/.
+
+[Install]
+WantedBy=multi-user.target

static/Trixie/nginx.service

@@ -15,56 +15,5 @@ ExecStop=/bin/sh -c "/bin/kill -s QUIT $(/bin/cat /run/nginx.pid)"
 TimeoutStartSec=10
 LimitNOFILE=65535
 
-# === hardening: deny-everything by default, allowlist via bind mounts ===
-# TemporaryFileSystem=/ replaces the visible filesystem with an empty tmpfs.
-# Everything not bind-mounted below is invisible to nginx workers — even
-# read access. Compromise of a worker can no longer enumerate /etc/passwd,
-# /home/*, /var/lib/*, /root, /opt, etc.
-TemporaryFileSystem=/
-
-# Read-only: nginx binary, dynamic linker, all linked libs, system config,
-# CA bundles, Let's Encrypt certs (live/ + archive/ both under /etc).
-BindReadOnlyPaths=/usr
-BindReadOnlyPaths=/lib
-BindReadOnlyPaths=/lib64
-BindReadOnlyPaths=/bin
-BindReadOnlyPaths=/sbin
-BindReadOnlyPaths=/etc
-
-# Read-write: nginx runtime state.
-#   /run               nginx.pid, nginx.lock, /run/nginx/temp/*, PHP-FPM sock
-#   /var/log/nginx     access.log, error.log
-#   /nginx             config dir (read-mostly but reload writes some state)
-BindPaths=/run
-BindPaths=/var/log/nginx
-BindPaths=/nginx
-BindPaths=/var/cache/nginx
-BindPaths=/srv
-BindPaths=/hostdata
-BindPaths=/raweb
-
-NoNewPrivileges=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectKernelLogs=true
-ProtectControlGroups=true
-ProtectClock=true
-ProtectHostname=true
-PrivateDevices=true
-PrivateTmp=true
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-RestrictNamespaces=true
-RestrictRealtime=true
-RestrictSUIDSGID=true
-LockPersonality=true
-SystemCallArchitectures=native
-SystemCallFilter=@system-service
-SystemCallErrorNumber=EPERM
-
-# NOTE deliberately OFF:
-#   MemoryDenyWriteExecute=true       breaks LuaJIT (JIT writable+executable pages)
-#   SystemCallFilter=~@resources      breaks nginx workers' prlimit64()
-# ProtectSystem and ProtectHome are redundant under TemporaryFileSystem=/.
-
 [Install]
 WantedBy=multi-user.target