Modernise some older systemd services

diff --git a/cookbooks/chef/recipes/server.rb b/cookbooks/chef/recipes/server.rb
index 8edf4e5593fac583dd180862a3497e7d87c4edab..ee27718f9e508317e659675635ade63e525fb3f1 100644 (file)
--- a/cookbooks/chef/recipes/server.rb
+++ b/cookbooks/chef/recipes/server.rb
@@ -73,6 +73,7 @@ end
 
 service "chef-server" do
   action [:enable, :start]
+  subscribes :restart, "systemd_service[chef-server]"
 end
 
 apache_module "alias"

diff --git a/cookbooks/kibana/recipes/default.rb b/cookbooks/kibana/recipes/default.rb
index 788e9551387b8420b72b39f2ed63dfe89c959d4e..adc39270d253090723629e83c3af92f77dafe342 100644 (file)
--- a/cookbooks/kibana/recipes/default.rb
+++ b/cookbooks/kibana/recipes/default.rb
@@ -68,6 +68,11 @@ systemd_service "kibana@" do
   after "network.target"
   user "kibana"
   exec_start "/opt/kibana-#{version}/bin/kibana -c /etc/kibana/%i.yml"
+  private_tmp true
+  private_devices true
+  protect_system "full"
+  protect_home true
+  no_new_privileges true
   restart "on-failure"
 end
 
@@ -89,6 +94,7 @@ node[:kibana][:sites].each do |name, details|
   service "kibana@#{name}" do
     action [:enable, :start]
     supports :status => true, :restart => true, :reload => false
+    subscribes :restart, "systemd_service[kibana@]"
   end
 
   ssl_certificate details[:site] do

diff --git a/cookbooks/squid/recipes/default.rb b/cookbooks/squid/recipes/default.rb
index def3d9187f2aa642c2c90a654ad588a83cc8b3f1..731cbdd83c0f408a7e8f973528ad7a23ad6031b4 100644 (file)
--- a/cookbooks/squid/recipes/default.rb
+++ b/cookbooks/squid/recipes/default.rb
@@ -50,6 +50,11 @@ systemd_service "squid" do
   exec_start "/usr/sbin/squid -N $SQUID_ARGS"
   exec_reload "/usr/sbin/squid -k reconfigure"
   exec_stop "/usr/sbin/squid -k shutdown"
+  private_tmp true
+  private_devices true
+  protect_system "full"
+  protect_home true
+  no_new_privileges true
   restart "on-failure"
   timeout_sec 0
 end

diff --git a/cookbooks/tile/recipes/default.rb b/cookbooks/tile/recipes/default.rb
index 2e19e9b0ed25955ee947f6be9d79467c70523d28..7d75087c9552a2138462fd3b48d015963a347fd5 100644 (file)
--- a/cookbooks/tile/recipes/default.rb
+++ b/cookbooks/tile/recipes/default.rb
@@ -76,11 +76,13 @@ systemd_service "renderd" do
   private_network true
   protect_system "full"
   protect_home true
+  no_new_privileges true
   restart "on-failure"
 end
 
 service "renderd" do
   action [:enable, :start]
+  subscribes :restart, "systemd_service[renderd]"
 end
 
 directory "/srv/tile.openstreetmap.org/tiles" do
@@ -468,6 +470,7 @@ systemd_service "replicate" do
   private_devices true
   protect_system "full"
   protect_home true
+  no_new_privileges true
   restart "on-failure"
 end
 

diff --git a/cookbooks/web/recipes/cgimap.rb b/cookbooks/web/recipes/cgimap.rb
index 7fb417b388dbb99f527ace06262a9fc3bd49a1ad..0875804cd3cae4e153ae8ee08396ddd0e3502873 100644 (file)
--- a/cookbooks/web/recipes/cgimap.rb
+++ b/cookbooks/web/recipes/cgimap.rb
@@ -58,6 +58,7 @@ systemd_service "cgimap" do
   private_devices true
   protect_system "full"
   protect_home true
+  no_new_privileges true
   restart "on-failure"
   pid_file "#{node[:web][:pid_directory]}/cgimap.pid"
 end

diff --git a/cookbooks/web/recipes/rails.rb b/cookbooks/web/recipes/rails.rb
index 77017b73500880f978a0f5a88d5934f443c5d41c..725f3b746533c41f1d31757079b682e6f1fe1799 100644 (file)
--- a/cookbooks/web/recipes/rails.rb
+++ b/cookbooks/web/recipes/rails.rb
@@ -119,6 +119,7 @@ systemd_service "api-statistics" do
   private_network true
   protect_system "full"
   protect_home true
+  no_new_privileges true
   restart "on-failure"
 end