pushpin: Initial ebuild

Signed-off-by: Stefan Knoblich <stkn@bitplumber.de>

net-misc/pushpin/files/pushpin.initd

@@ -0,0 +1,38 @@
+#!/sbin/openrc-run
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+PUSHPIN_USER="${PUSHPIN_USER:-pushpin}"
+PUSHPIN_GROUP="${PUSHPIN_GROUP:-pushpin}"
+PUSHPIN_CONFIG="${PUSHPIN_CONFIG:-/etc/pushpin/pushpin.conf}"
+PUSHPIN_DATA_DIR="${PUSHPIN_DATA_DIR:-/var/lib/pushpin}"
+PUSHPIN_LOG_DIR="${PUSHPIN_LOG_DIR:-/var/log/pushpin}"
+
+command="/usr/bin/pushpin"
+command_args="--config ${PUSHPIN_CONFIG} --logfile \"${PUSHPIN_LOG_DIR}/pushpin.log\""
+
+extra_started_commands="reload"
+description_reload="Reload the pushpin configuration"
+
+pidfile="/run/${RC_SVCNAME}.pid"
+command_background="true"
+start_stop_daemon_args="--user=\"${PUSHPIN_USER}\" --group=\"${PUSHPIN_GROUP}\""
+
+configtest() {
+	ebegin "Checking configuration file"
+	test -f "${PUSHPIN_CONFIG}"
+	eend $? "Please check configuration for errors"
+}
+
+start_pre() {
+	checkpath -d -o "${PUSHPIN_USER}:${PUSHPIN_GROUP}" -m750 "${PUSHPIN_DATA_DIR}"
+	checkpath -d -o "${PUSHPIN_USER}:${PUSHPIN_GROUP}" -m750 "${PUSHPIN_LOG_DIR}"
+	configtest || return 1
+}
+
+reload() {
+	configtest || return 1
+	ebegin "Refreshing pushpin configuration"
+	start-stop-daemon --signal SIGHUP --pidfile "${pidfile}"
+	eend $? "Failed to reload pushpin"
+}

net-misc/pushpin/files/pushpin.service

@@ -0,0 +1,51 @@
+[Unit]
+Description=Pushpin reverse proxy for realtime web services
+After=network.target
+
+[Service]
+User=pushpin
+Group=pushpin
+
+#ExecStartPre=/usr/bin/pushpin validate /etc/pushpin/pushpin.conf
+ExecStart=/usr/bin/pushpin --config /etc/pushpin/pushpin.conf
+#ExecReload=/usr/bin/pushpin validate /etc/pushpin/pushpin.conf
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=no
+
+# capabilities
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+# sandboxing
+ProtectHostname=yes
+ProtectClock=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectControlGroups=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+NoNewPrivileges=yes
+RemoveIPC=yes
+RestrictNamespaces=yes
+
+WorkingDirectory=/var/lib/pushpin
+StateDirectory=pushpin
+StateDirectoryMode=0750
+
+# syscall filtering
+SystemCallFilter=@system-service @debug
+SystemCallArchitectures=native
+
+# process properties
+UMask=077
+
+[Install]
+WantedBy=multi-user.target