This sounds interesting https://potions.io/
jam
AndyL
For apps that run on the LAN, I use Elixir releases and systemd.
This is OK for internal apps that don’t need SSH or postgres.
Here’s a repo with mix tasks for these deployments:
For production apps I use kamal.
2
Lucassifoni
andreh
I deploy to an Hetzner VPS with Mix releases, hardened systemd, Caddy, rsync and Ansible with zero downtime. I’ve been using this setup for one year in production and it’s working great!
But unfortunately I still haven’t found the time to write a blog post about it…
2
greven
I think it’s the same person behind https://elixircasts.io.
Answering to the topic, I use Hetzner VPSs with a Makefile to streamline deployment.
1
dimitarvp
andreh
Well, “hardened” might not be the right term, I’ve just tried to tweak the service configuration to limit privileges and resource consumption. Here’s an excerpt from the Ansible template:
CPUQuota={{ app_cpu_quota }}
# Paths
InaccessiblePaths=/dev/shm
# Capabilities and system calls
AmbientCapabilities=
CapabilityBoundingSet=
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@clock @mount @reboot
# Memory
MemoryDenyWriteExecute=true
MemoryAccounting=true
MemoryMin={{ app_memory_min }}
MemoryMax={{ app_memory_max }}
# Privileges
NoNewPrivileges=true
# Personality
LockPersonality=true
# Private
PrivateDevices=true
PrivateTmp=true
PrivateUsers=true
# Protect and Proc
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
ProcSubset=pid
ReadWritePaths=/var/lib/{{ app_name }}
# Restrictions
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
DeviceAllow=/dev/null rw
DevicePolicy=strict
KeyringMode=private
LimitMEMLOCK=0
LimitNOFILE=65536
RemoveIPC=true
UMask=0077
2
dimitarvp
I’ve been doing something similar for my own self-hosted services at home. Thank you, I will definitely lift some of your config options. Completely forgot about MemoryDenyWriteExecute even though I did know about it, for example.
0
andreh
You’re welcome!
Also, you can use these commands to audit your systemd services:
systemd-analyze security
systemd-analyze security <service>
3
AndyL
Speaking of tiny projects - I just (re)discovered Francis - inspired by Sinatra. Looks good for quick interactive websites and APIs. There’s also a FrancisHtmx extension.
0