ISTI-ansible-roles
/
ansible-role-tomcat-multiple-instances
5
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix the systemd unit security section.

This commit is contained in:
Andrea Dell'Amico 2024-08-02 12:45:02 +02:00
parent 0955bf4d73
commit 8570d5ff5b
Signed by: adellam
GPG Key ID: 147ABE6CEB9E20FF
3 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
.vscode/settings.json vendored Normal file
View File

@ -0,0 +1,3 @@
{
"ansible.python.interpreterPath": "/opt/local/bin/python3.10"
}

2
defaults/main.yml
View File

@ -79,6 +79,8 @@ tomcat_m_enable_instances: True
tomcat_m_jndi_pool: False tomcat_m_jndi_pool: False
tomcat_m_direct_access: False tomcat_m_direct_access: False
tomcat_systemd_additional_rw_paths: []
# JMX and debugging # JMX and debugging
tomcat_m_enable_remote_debugging: False tomcat_m_enable_remote_debugging: False
tomcat_m_remote_debugging_host: '0.0.0.0' tomcat_m_remote_debugging_host: '0.0.0.0'

11
templates/tomcat-service.j2
View File

@ -7,7 +7,7 @@ Description=Apache Tomcat {{ tomcat_version}} Web Application Server
After=syslog.target network.target After=syslog.target network.target
StartLimitIntervalSec=500 StartLimitIntervalSec=500
StartLimitBurst=5 StartLimitBurst=5
RequiresMountsFor={{ tomcat_m_instances_logdir_base }}/{{ item.http_port }} /var/lib/tomcat{{ tomcat_version }} RequiresMountsFor={{ tomcat_m_instances_logdir_base }}/{{ item.http_port }} {{ item.instance_path }}
[Service] [Service]
Environment="CATALINA_HOME=/usr/share/tomcat{{ tomcat_version }}" Environment="CATALINA_HOME=/usr/share/tomcat{{ tomcat_version }}"
@ -18,7 +18,7 @@ ExecStartPre=+/usr/libexec/tomcat{{ tomcat_version}}/tomcat-update-policy.sh
ExecStart=/bin/sh /usr/libexec/tomcat{{ tomcat_version }}/tomcat-instance-{{ item.http_port }}-start.sh ExecStart=/bin/sh /usr/libexec/tomcat{{ tomcat_version }}/tomcat-instance-{{ item.http_port }}-start.sh
SuccessExitStatus=143 SuccessExitStatus=143
RestartSec=10 RestartSec=10
Restart=on-failure on-abort Restart=on-failure
# Logging # Logging
SyslogIdentifier=tomcat{{ tomcat_version }} SyslogIdentifier=tomcat{{ tomcat_version }}
@ -33,8 +33,12 @@ CacheDirectoryMode=750
ProtectSystem=strict ProtectSystem=strict
ReadWritePaths={{ item.instance_path }}/conf/Catalina/ ReadWritePaths={{ item.instance_path }}/conf/Catalina/
ReadWritePaths={{ item.instance_path }}/webapps ReadWritePaths={{ item.instance_path }}/webapps
ReadWritePaths={{ item.instance_path }}/lib
ReadWritePaths={{ tomcat_m_instances_logdir_base }}/{{ item.http_port }} ReadWritePaths={{ tomcat_m_instances_logdir_base }}/{{ item.http_port }}
{% endif %} {% for path in tomcat_systemd_additional_rw_paths %}
ReadWritePaths={{ path }}
{% endfor %}
{% if tomcat_systemd_security_enhanced %} {% if tomcat_systemd_security_enhanced %}
ProtectSystem=strict ProtectSystem=strict
ProtectHome=yes ProtectHome=yes
@ -46,6 +50,7 @@ RestrictAddressFamilies=AF_INET6 AF_INET
SystemCallArchitectures=native SystemCallArchitectures=native
SystemCallFilter=@system-service SystemCallFilter=@system-service
{% endif %} {% endif %}
{% endif %}
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target