WoodSmellParticle/ansible-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(deluge): added role to install deluge and deluge web

Browse source
This commit is contained in:
NaeiKinDus 2025-03-24 00:00:00 +00:00
parent bef258cfec
commit 1c625d2d84
Signed by: WoodSmellParticle
GPG key ID: 8E52ADFF7CA8AE56
19 changed files with 553 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

53
ansible_collections/nullified/infrastructure/roles/deluge/templates/systemd/deluge-web.service.j2 Normal file
View file

@ -0,0 +1,53 @@
[Unit]
Description=Deluge Bittorrent Client Web Interface
Documentation=man:deluge-web
After=deluged.service
Wants=deluged.service
[Service]
User=deluge
Group=deluge
Type=simple
UMask=027
ExecStart={{ deluge_git_dir }}/.venv/bin/deluge-web -d
Restart=on-failure
RestartSec=3
# Security Hardening
PrivateTmp=true
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
{% if systemd_version | int >= 187 %}
NoNewPrivileges=true
SystemCallFilter=@system-service
{% endif %}
{%+ if systemd_version | int >= 209 %}SystemCallArchitectures=native{%- endif +%}
{% if systemd_version | int >= 214 %}
ProtectHome=true
ProtectSystem=true
{% endif %}
{% if systemd_version | int >= 231 %}
ReadOnlyPaths=/
ReadWritePaths={{ deluge_git_dir }} {{ deluge_install_dir }}
RestrictRealtime=true
{% endif %}
{% if systemd_version | int >= 232 %}
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
RemoveIPC=true
{% endif %}
{% if systemd_version | int >= 233 %}
MountAPIVFS=true
RestrictNamespaces=ipc net mnt pid
{% endif %}
{%+ if systemd_version | int >= 235 %}LockPersonality=true{%- endif +%}
{% if systemd_version | int >= 242 %}
ProtectHostname=true
RestrictSUIDSGID=true
{% endif %}
{%+ if systemd_version | int >= 244 %}ProtectKernelLogs=true{%- endif +%}
{%+ if systemd_version | int >= 245 %}ProtectClock=true{%- endif +%}
{%+ if systemd_version | int >= 247 %}ProtectProc=invisible{%- endif +%}
[Install]
WantedBy=multi-user.target

54
ansible_collections/nullified/infrastructure/roles/deluge/templates/systemd/deluged.service.j2 Normal file
View file

@ -0,0 +1,54 @@
[Unit]
Description=Deluge Bittorrent Client Daemon
Documentation=man:deluged
After=network-online.target
[Service]
User=deluge
Group=deluge
Type=simple
UMask=007
ExecStart={{ deluge_git_dir }}/.venv/bin/deluged -d -L warning
Restart=on-failure
RestartSec=3
TimeoutStopSec=300
WorkingDirectory=~
# Security Hardening
PrivateTmp=true
CapabilityBoundingSet=CAP_SYS_RESOURCE
{% if systemd_version | int >= 187 %}
NoNewPrivileges=true
SystemCallFilter=@system-service
{% endif %}
{%+ if systemd_version | int >= 209 %}SystemCallArchitectures=native{%- endif +%}
{% if systemd_version | int >= 214 %}
ProtectHome=true
ProtectSystem=true
{% endif %}
{% if systemd_version | int >= 231 %}
ReadOnlyPaths=/
ReadWritePaths={{ deluge_git_dir }} {{ deluge_install_dir }}
RestrictRealtime=true
{% endif %}
{% if systemd_version | int >= 232 %}
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
RemoveIPC=true
{% endif %}
{% if systemd_version | int >= 233 %}
MountAPIVFS=true
RestrictNamespaces=ipc net mnt pid
{% endif %}
{%+ if systemd_version | int >= 235 %}LockPersonality=true{%- endif +%}
{% if systemd_version | int >= 242 %}
ProtectHostname=true
RestrictSUIDSGID=true
{% endif %}
{%+ if systemd_version | int >= 244 %}ProtectKernelLogs=true{%- endif +%}
{%+ if systemd_version | int >= 245 %}ProtectClock=true{%- endif +%}
{%+ if systemd_version | int >= 247 %}ProtectProc=invisible{%- endif +%}
[Install]
WantedBy=multi-user.target