04/18 Enhance app (security, performance)

scripts/passkeeper.service

@@ -0,0 +1,62 @@
+# /etc/systemd/system/passkeeper.service
+#
+# Install / update:
+#   sudo cp scripts/passkeeper.service /etc/systemd/system/passkeeper.service
+#   sudo systemctl daemon-reload
+#   sudo systemctl enable passkeeper
+#   sudo systemctl restart passkeeper
+#   journalctl -xeu passkeeper.service
+#
+# Phase 5 additions vs original:
+#   - WatchdogSec: systemd kills and restarts a hung Gunicorn within 30 s
+#   - Gunicorn --timeout: workers that don't respond within 25 s are replaced
+#   - Gunicorn --graceful-timeout: allows in-flight requests to finish on reload
+#   - PrivateTmp, NoNewPrivileges, ProtectSystem: basic systemd sandboxing
+#   - StartLimitIntervalSec / StartLimitBurst: caps restart storm
+
+[Unit]
+Description=PassKeeper Gunicorn daemon
+After=network.target mysql.service
+Wants=mysql.service
+
+# Restart policy: cap to 5 restarts in 60 s to prevent restart storms
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+User=www-data
+Group=www-data
+WorkingDirectory=/home/spuser/PassKeeper
+EnvironmentFile=/home/spuser/PassKeeper/.env
+
+ExecStart=/home/spuser/.venv/bin/gunicorn \
+          --workers 4 \
+          --bind 127.0.0.1:5000 \
+          --timeout 25 \
+          --graceful-timeout 20 \
+          --keep-alive 5 \
+          --access-logfile /home/spuser/logs/access.log \
+          --error-logfile  /home/spuser/logs/error.log \
+          --log-level warning \
+          wsgi:app
+
+# Reload (zero-downtime): send USR2 to Gunicorn master
+ExecReload=/bin/kill -s USR2 $MAINPID
+
+# Watchdog: systemd sends SIGKILL if Gunicorn doesn't send keepalives within 30 s.
+# Requires gunicorn to be started with --preload OR the watchdog plugin; here we
+# rely on the worker timeout (25 s) to recycle hung workers before the 30 s
+# watchdog fires, which restarts the entire service.
+WatchdogSec=30s
+
+Restart=on-failure
+RestartSec=5s
+
+# Systemd sandboxing
+PrivateTmp=true
+NoNewPrivileges=true
+ProtectSystem=strict
+ReadWritePaths=/home/spuser/PassKeeper /home/spuser/logs /home/spuser/backups
+
+[Install]
+WantedBy=multi-user.target