scripts: Fix systemd config (esm-dev#975)

code · Jan 3, 2025 · d07a83d · d07a83d
1 parent 7b51b59
commit d07a83d
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 5 deletions.
diff --git a/scripts/deploy-ci.sh b/scripts/deploy-ci.sh
@@ -45,7 +45,6 @@ ssh d.esm.sh << EOF
       exit 1
     fi
     mkdir /etc/esmd
-    chown esm:esm /etc/esmd
     echo "[Unit]" >> \$servicefile
     echo "Description=esm.sh service" >> \$servicefile
     echo "After=network.target" >> \$servicefile
@@ -54,7 +53,9 @@ ssh d.esm.sh << EOF
     echo "Type=simple" >> \$servicefile
     echo "ExecStart=/usr/local/bin/esmd --config=\$configfile" >> \$servicefile
     echo "WorkingDirectory=/esm" >> \$servicefile
-    echo "USER=esm" >> \$servicefile
+    echo "Group=esm" >> \$servicefile
+    echo "User=esm" >> \$servicefile
+    echo "AmbientCapabilities=CAP_NET_BIND_SERVICE" >> \$servicefile
     echo "Restart=always" >> \$servicefile
     echo "RestartSec=5" >> \$servicefile
     echo "Environment=\"ESMDIR=/esm\"" >> \$servicefile
@@ -72,7 +73,6 @@ ssh d.esm.sh << EOF
   else
     echo "{}" >> \$configfile
   fi
-  chown esm:esm \$configfile
 
   if [ "$RESET_ON_DEPLOY" == "yes" ]; then
     mkdir -p /tmp/.esm

diff --git a/scripts/deploy.sh b/scripts/deploy.sh
@@ -82,6 +82,10 @@ ssh -p $sshPort ${user}@${host} << EOF
     fi
     addgroup esm
     adduser --ingroup esm --no-create-home --disabled-login --disabled-password --gecos "" esm
+    if [ "\$?" != "0" ]; then
+      echo "Failed to add user 'esm'"
+      exit 1
+    fi
     echo "[Unit]" >> \$servicefile
     echo "Description=esm.sh service" >> \$servicefile
     echo "After=network.target" >> \$servicefile
@@ -92,13 +96,14 @@ ssh -p $sshPort ${user}@${host} << EOF
       mkdir -p /etc/esmd
       rm -f \$configfile
       echo "$config" >> \$configfile
-      chown -R esm:esm /etc/esmd
       echo "ExecStart=/usr/local/bin/esmd --config=\$configfile" >> \$servicefile
     else
       echo "ExecStart=/usr/local/bin/esmd" >> \$servicefile
     fi
     echo "WorkingDirectory=/esm" >> \$servicefile
-    echo "USER=esm" >> \$servicefile
+    echo "Group=esm" >> \$servicefile
+    echo "User=esm" >> \$servicefile
+    echo "AmbientCapabilities=CAP_NET_BIND_SERVICE" >> \$servicefile
     echo "Restart=always" >> \$servicefile
     echo "RestartSec=5" >> \$servicefile
     echo "Environment=\"ESMDIR=/esm\"" >> \$servicefile