Merge pull request #4 from YunoHost-Apps/testing

Testing

README.md

@@ -5,7 +5,8 @@ It shall NOT be edited by hand.
 
 # Umami for YunoHost
 
-[![Integration level](https://dash.yunohost.org/integration/umami.svg)](https://dash.yunohost.org/appci/app/umami) ![Working status](https://ci-apps.yunohost.org/ci/badges/umami.status.svg) ![Maintenance status](https://ci-apps.yunohost.org/ci/badges/umami.maintain.svg)  
+[![Integration level](https://dash.yunohost.org/integration/umami.svg)](https://dash.yunohost.org/appci/app/umami) ![Working status](https://ci-apps.yunohost.org/ci/badges/umami.status.svg) ![Maintenance status](https://ci-apps.yunohost.org/ci/badges/umami.maintain.svg)
+
 [![Install Umami with YunoHost](https://install-app.yunohost.org/install-with-yunohost.svg)](https://install-app.yunohost.org/?app=umami)
 
 *[Lire ce readme en français.](./README_fr.md)*
@@ -28,24 +29,16 @@ Umami is a simple, easy to use, self-hosted web analytics solution. The goal is
 - Mobile-friendly
 - Data ownership
 - Privacy-focused
-- Open-source
 
 
-**Shipped version:** 1.33~ynh2
+**Shipped version:** 2.2.0~ynh1
 
 **Demo:** https://app.umami.is/share/8rmHaheU/umami.is
 
 ## Screenshots
 
-![Screenshot of Umami](./doc/screenshots/dark.gif)
-
-## Disclaimers / important information
-
-### Login
-
-Your Umami installation will create a default administrator account with the username `admin` and the password `umami`.
+![Screenshot of Umami](./doc/screenshots/dark.png)
 
-The first thing you will want to do is log in and change your password.
 ## Documentation and resources
 
 * Official app website: <https://umami.is/>

README_fr.md

@@ -5,15 +5,16 @@ It shall NOT be edited by hand.
 
 # Umami pour YunoHost
 
-[![Niveau d'intégration](https://dash.yunohost.org/integration/umami.svg)](https://dash.yunohost.org/appci/app/umami) ![Statut du fonctionnement](https://ci-apps.yunohost.org/ci/badges/umami.status.svg) ![Statut de maintenance](https://ci-apps.yunohost.org/ci/badges/umami.maintain.svg)  
+[![Niveau d’intégration](https://dash.yunohost.org/integration/umami.svg)](https://dash.yunohost.org/appci/app/umami) ![Statut du fonctionnement](https://ci-apps.yunohost.org/ci/badges/umami.status.svg) ![Statut de maintenance](https://ci-apps.yunohost.org/ci/badges/umami.maintain.svg)
+
 [![Installer Umami avec YunoHost](https://install-app.yunohost.org/install-with-yunohost.svg)](https://install-app.yunohost.org/?app=umami)
 
 *[Read this readme in english.](./README.md)*
 
-> *Ce package vous permet d'installer Umami rapidement et simplement sur un serveur YunoHost.
-Si vous n'avez pas YunoHost, regardez [ici](https://yunohost.org/#/install) pour savoir comment l'installer et en profiter.*
+> *Ce package vous permet d’installer Umami rapidement et simplement sur un serveur YunoHost.
+Si vous n’avez pas YunoHost, regardez [ici](https://yunohost.org/#/install) pour savoir comment l’installer et en profiter.*
 
-## Vue d'ensemble
+## Vue d’ensemble
 
 Umami is a simple, easy to use, self-hosted web analytics solution. The goal is to provide you with a friendlier, privacy-focused alternative to Google Analytics and a free, open-sourced alternative to paid solutions. Umami collects only the metrics you care about and everything fits on a single page. 
 
@@ -28,29 +29,21 @@ Umami is a simple, easy to use, self-hosted web analytics solution. The goal is
 - Mobile-friendly
 - Data ownership
 - Privacy-focused
-- Open-source
 
 
-**Version incluse :** 1.33~ynh2
+**Version incluse :** 2.2.0~ynh1
 
 **Démo :** https://app.umami.is/share/8rmHaheU/umami.is
 
-## Captures d'écran
-
-![Capture d'écran de Umami](./doc/screenshots/dark.gif)
-
-## Avertissements / informations importantes
-
-### Login
+## Captures d’écran
 
-Your Umami installation will create a default administrator account with the username `admin` and the password `umami`.
+![Capture d’écran de Umami](./doc/screenshots/dark.png)
 
-The first thing you will want to do is log in and change your password.
 ## Documentations et ressources
 
-* Site officiel de l'app : <https://umami.is/>
-* Documentation officielle de l'admin : <https://umami.is/docs/about>
-* Dépôt de code officiel de l'app : <https://github.com/mikecao/umami>
+* Site officiel de l’app : <https://umami.is/>
+* Documentation officielle de l’admin : <https://umami.is/docs/about>
+* Dépôt de code officiel de l’app : <https://github.com/mikecao/umami>
 * Documentation YunoHost pour cette app : <https://yunohost.org/app_umami>
 * Signaler un bug : <https://github.com/YunoHost-Apps/umami_ynh/issues>
 
@@ -66,4 +59,4 @@ ou
 sudo yunohost app upgrade umami -u https://github.com/YunoHost-Apps/umami_ynh/tree/testing --debug
 ```
 
-**Plus d'infos sur le packaging d'applications :** <https://yunohost.org/packaging_apps>
+**Plus d’infos sur le packaging d’applications :** <https://yunohost.org/packaging_apps>

conf/.env

@@ -1,2 +1,7 @@
-DATABASE_URL=postgresql://__DB_USER__:__DB_PWD__@localhost:5432/__DB_NAME__
-DISABLE_TELEMETRY = 1
+DATABASE_TYPE=postgresql 
+
+DATABASE_URL=postgresql://__DB_USER__:__DB_PWD__@127.0.0.1:5432/__DB_NAME__
+
+DISABLE_TELEMETRY=0
+
+PORT=__PORT__

conf/nginx.conf

@@ -1,7 +1,11 @@
-location / {
+#sub_path_only rewrite ^__PATH__$ __PATH__/ permanent;
+location __PATH__/ {
 
   proxy_pass       http://127.0.0.1:__PORT__;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header Host $host;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+  # Include SSOWAT user panel.
+  include conf.d/yunohost_panel.conf.inc;
 }

conf/systemd.service

@@ -6,11 +6,44 @@ After=network.target
 Type=simple
 User=__APP__
 Group=__APP__
-WorkingDirectory=__FINALPATH__/
-Environment=NODE_ENV=production
-Environment=PORT=__PORT__
+WorkingDirectory=__INSTALL_DIR__/
+#Environment=NODE_ENV=production
 Environment="__YNH_NODE_LOAD_PATH__"
-ExecStart=__YNH_NPM__ run start
+ExecStart=__YNH_NPM__ run start-env
+
+# Sandboxing options to harden security
+# Depending on specificities of your service/app, you may need to tweak these
+# .. but this should be a good baseline
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallArchitectures=native
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged
+
+# Denying access to capabilities that should not be relevant for webapps
+# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
 
 [Install]
 WantedBy=multi-user.target

doc/DESCRIPTION.md

@@ -11,4 +11,3 @@ Umami is a simple, easy to use, self-hosted web analytics solution. The goal is
 - Mobile-friendly
 - Data ownership
 - Privacy-focused
-- Open-source

doc/POST_INSTALL.md

@@ -0,0 +1,6 @@
+Umami installation will create a default administrator account:
+
+username: admin
+password: umami
+
+The first thing you will want to do is log in and change your password.