patrickandClaude Sonnet 5
dbbbd0940b
ProtectSystem=strict blockte Schreibzugriff aufs Dokumente-Upload-Verzeichnis (Fund beim Live-Deploy: Verzeichnis existierte, aber Sandbox verweigerte Schreiben außerhalb der bisherigen ReadWritePaths=/opt/mabea/backend). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KC8HYvv6UkCVYheYiTw9DD
24 lines
599 B
Plaintext
24 lines
599 B
Plaintext
[Unit]
|
|
Description=MABEA Backend (FastAPI/Uvicorn)
|
|
After=network.target postgresql.service
|
|
Requires=postgresql.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=mabea
|
|
WorkingDirectory=/opt/mabea/backend
|
|
EnvironmentFile=/opt/mabea/backend/.env
|
|
ExecStart=/opt/mabea/backend/.venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# Sandboxing (Review-Fund owasp-top10-expert): begrenzt Blast-Radius bei App-RCE.
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
ReadWritePaths=/opt/mabea/backend /opt/mabea/uploads
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|