feat: runs uwsgi as non-root user

norwoodj · Oct 6, 2021 · 8f5453a · 8f5453a
1 parent 97471d5
commit 8f5453a
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/debian/stupidchess-uwsgi.service b/debian/stupidchess-uwsgi.service
@@ -13,6 +13,7 @@ NotifyAccess=all
 Environment=JCONFIGURE_ACTIVE_PROFILES=RPI
 Environment=JCONFIGURE_CONFIG_DIRECTORIES=/opt/stupidchess/config
 Environment=SECRETS_VOLUME_PATH=/opt/stupidchess/secrets
+User=stupidchess
 
 [Install]
 WantedBy=multi-user.target
diff --git a/debian/stupidchess-uwsgi.socket b/debian/stupidchess-uwsgi.socket
@@ -5,6 +5,8 @@ PartOf=stupidchess-uwsgi.service
 [Socket]
 FileDescriptorName=stupidchess-uwsgi
 ListenStream=/opt/stupidchess/sockets/stupidchess.sock
+SocketUser=stupidchess
+SocketGroup=stupidchess
 
 [Install]
 WantedBy=sockets.target