WIP

.gitignore

@@ -22,3 +22,5 @@ plakken
 # Go workspace file
 go.work
 .idea/discord.xml
+
+dist/

.goreleaser.yaml

@@ -0,0 +1,68 @@
+gitea_urls:
+  api: https://git.gnous.eu/api/v1
+  download: https://git.gnous.eu
+  skip_tls_verify: false
+
+before:
+  hooks:
+    # You may remove this if you don't use go modules.
+    - go mod tidy
+
+builds:
+  -
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - windows
+      - darwin
+    goarch:
+      - amd64
+      - arm
+      - arm64
+
+archives:
+  - format: tar.gz
+    format_overrides:
+      -
+        goos: windows
+        format: zip
+
+nfpms:
+  -
+    id: plakken
+    package_name: plakken
+    file_name_template: "{{ .ConventionalFileName }}"
+    vendor: GnousEU
+    homepage: https://git.gnous.eu/plakken/
+    maintainer: GnousEU <contact@gnous.eu>
+    description: A light paste server
+    license: AGPLv3
+    formats:
+      - deb
+      - rpm
+      - archlinux
+    umask: 0o002
+    provides:
+      - plakken
+    suggests:
+      - redis
+    contents:
+      - src: .env
+        dst: /etc/plakken/env
+      - src: plakken.service
+        dst: /usr/lib/systemd/system/plakken.service
+    scripts:
+      preinstall: "deployement/goreleaser/preinstall.sh"
+      preremove: "deployement/goreleaser/preremove.sh"
+      postremove: "deployement/goreleaser/postremove.sh"
+
+checksum:
+  algorithm: sha256
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"

.woodpecker/build.yaml

@@ -11,22 +11,7 @@ steps:
           from_secret: docker_username
       password:
         from_secret: docker_password
+      debug: true
     when:
       branch: ${CI_REPO_DEFAULT_BRANCH}
       event: push
-  - name: publish_image_tag
-    image: woodpeckerci/plugin-docker-buildx
-    settings:
-      repo: git.gnous.eu/${CI_REPO_OWNER}/plakken
-      dockerfile: docker/Dockerfile
-      platforms: linux/amd64,linux/arm64/v8,linux/arm
-      registry: https://git.gnous.eu
-      tags:
-        - ${CI_COMMIT_TAG##v} # Remove v from tag
-        - stable
-      username:
-        from_secret: docker_username
-      password:
-        from_secret: docker_password
-    when:
-      event: tag

.woodpecker/release.yaml

@@ -1,24 +1,25 @@
 steps:
-  - name: Build
+  - name: Release
     image: golang:1.22
     commands:
-      - go mod download
-      - CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "-w -s" -o plakken-linux-amd64 # Enable static binary, target Linux, remove debug information and strip binary
-      - CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags "-w -s" -o plakken-linux-arm64
-      - CGO_ENABLED=0 GOOS=linux GOARCH=arm go build -ldflags "-w -s" -o plakken-linux-arm
-      - CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "-w -s" -o plakken-windows-amd64.exe
-      - CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags "-w -s" -o plakken-windows-arm64.exe
-      - CGO_ENABLED=0 GOOS=linux GOARCH=arm go build -ldflags "-w -s" -o plakken-windows-arm.exe
+      - go install github.com/goreleaser/goreleaser@latest
+      - goreleaser release
+    secrets: [ gitea_token ]
     when:
       event: tag
-  - name: Release
-    image: woodpeckerci/plugin-gitea-release
+  - name: publish_image_tag
+    image: woodpeckerci/plugin-docker-buildx
     settings:
-      base_url: https://git.gnous.eu
-      files:
-        - "plakken*"
-      api_key:
-        from_secret: release_token
-      target: main
+      repo: git.gnous.eu/${CI_REPO_OWNER}/plakken
+      dockerfile: docker/Dockerfile
+      platforms: linux/amd64,linux/arm64/v8,linux/arm
+      registry: https://git.gnous.eu
+      tags:
+        - ${CI_COMMIT_TAG##v} # Remove v from tag
+        - stable
+      username:
+        from_secret: docker_username
+      password:
+        from_secret: docker_password
     when:
       event: tag

deployement/goreleaser/postremove.sh

@@ -0,0 +1 @@
+userdel -r plakken

deployement/goreleaser/preinstall.sh

@@ -0,0 +1,8 @@
+if ! getent passwd plakken > /dev/null; then
+    useradd -r -d /var/lib/plakken -s /sbin/nologin -U plakken
+fi
+if ! test -d /var/lib/plakken; then
+    mkdir -p /var/lib/plakken
+    chmod 0750 /var/lib/plakken
+    chown -R plakken:plakken /var/lib/plakken
+fi

deployement/goreleaser/preremove.sh

@@ -0,0 +1 @@
+systemctl stop plakken

docker/docker-compose.yaml

@@ -20,7 +20,6 @@ services:
       - "3000:3000"
     environment:
       - PLAKKEN_REDIS_ADDRESS=redis:6379
-      - POSTGRES_PASSWORD=gitea
       - PLAKKEN_REDIS_DB=0
       - PLAKKEN_URL_LENGTH=5
     depends_on:

plakken.service

@@ -0,0 +1,54 @@
+# /usr/lib/systemd/system/plakken.service
+[Unit]
+Description=A paste server
+After=network.target
+
+[Service]
+Type=simple
+User=plakken
+
+ExecStart=/usr/bin/plakken
+
+
+EnvironmentFile=/etc/plakken/env
+
+ProtectSystem=strict
+ProtectHome=true
+NoNewPrivileges=yes
+RestrictNamespaces=true
+PrivateTmp=true
+PrivateDevices=true
+PrivateUsers=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectKernelTunables=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RemoveIPC=true
+RestrictRealtime=true
+SystemCallArchitectures=native
+MemoryDenyWriteExecute=true
+UMask=177 
+ProtectProc=invisible
+CapabilityBoundingSet=
+ProtectHostname=true
+RestrictAddressFamilies=~AF_(INET|INET6)
+RestrictAddressFamilies=~…
+RestrictAddressFamilies=~AF_UNIX
+RestrictAddressFamilies=~AF_NETLINK
+RestrictAddressFamilies=~AF_PACKET
+SystemCallFilter=~@reboot
+SystemCallFilter=~@obsolete
+SystemCallFilter=~@mount
+SystemCallFilter=~@module
+SystemCallFilter=~@debug
+SystemCallFilter=~@cpu-emulation
+SystemCallFilter=~@clock
+SystemCallFilter=~@swap
+SystemCallFilter=~@privileged
+ProcSubset=pid
+
+[Install]
+WantedBy=multi-user.target