feat: allow disabling systemd hardening (#74)

Author: jooola

defaults/main.yml

@@ -1,6 +1,7 @@
 ---
 libretime_allow_restart: true
 libretime_migrate: true
+libretime_systemd_hardening: true
 
 # libretime_config_template:
 libretime_public_url: "http://localhost:{{ libretime_listen_port }}/"

molecule/default/molecule.yml

@@ -33,11 +33,13 @@ provisioner:
         libretime_playout_systemd_override: |
           [Service]
           Environment=LIBRETIME_LOG_LEVEL=debug
+        libretime_systemd_hardening: false
       instance2:
         libretime_public_url: http://localhost:{{ libretime_listen_port }}/
         libretime_listen_port: 9002
         libretime_api_key: hackme
         libretime_secret_key: hackme
+        libretime_systemd_hardening: false
 
 verifier:
   name: testinfra

templates/systemd/libretime-analyzer.service.j2

@@ -3,6 +3,7 @@ Description=LibreTime Media Analyzer Service
 PartOf=libretime.target
 
 [Service]
+{%- if libretime_systemd_hardening %}
 NoNewPrivileges=true
 CapabilityBoundingSet=
 PrivateDevices=true
@@ -16,6 +17,7 @@ ProtectKernelModules=true
 ProtectKernelTunables=true
 ProtectProc=invisible
 ProtectSystem=full
+{%- endif %}
 
 Environment=PATH={{ libretime_venv_dir }}/bin:/usr/local/bin:/usr/bin:/bin
 Environment=LIBRETIME_CONFIG_FILEPATH={{ libretime_config_filepath }}

templates/systemd/libretime-api.service.j2

@@ -4,6 +4,7 @@ Requires=libretime-api.socket
 PartOf=libretime.target
 
 [Service]
+{%- if libretime_systemd_hardening %}
 NoNewPrivileges=true
 CapabilityBoundingSet=
 PrivateDevices=true
@@ -17,6 +18,7 @@ ProtectKernelModules=true
 ProtectKernelTunables=true
 ProtectProc=invisible
 ProtectSystem=full
+{%- endif %}
 
 Environment=PATH={{ libretime_venv_dir }}/bin:/usr/local/bin:/usr/bin:/bin
 Environment=LIBRETIME_CONFIG_FILEPATH={{ libretime_config_filepath }}

templates/systemd/libretime-liquidsoap.service.j2

@@ -3,6 +3,7 @@ Description=LibreTime Liquidsoap Service
 PartOf=libretime.target
 
 [Service]
+{%- if libretime_systemd_hardening %}
 NoNewPrivileges=true
 CapabilityBoundingSet=
 PrivateDevices=true
@@ -16,6 +17,7 @@ ProtectKernelModules=true
 ProtectKernelTunables=true
 ProtectProc=invisible
 ProtectSystem=full
+{%- endif %}
 
 Environment=PATH={{ libretime_venv_dir }}/bin:/usr/local/bin:/usr/bin:/bin
 Environment=LIBRETIME_CONFIG_FILEPATH={{ libretime_config_filepath }}

templates/systemd/libretime-playout.service.j2

@@ -5,6 +5,7 @@ Wants=libretime-liquidsoap.service
 After=libretime-liquidsoap.service
 
 [Service]
+{%- if libretime_systemd_hardening %}
 NoNewPrivileges=true
 CapabilityBoundingSet=
 PrivateDevices=true
@@ -18,6 +19,7 @@ ProtectKernelModules=true
 ProtectKernelTunables=true
 ProtectProc=invisible
 ProtectSystem=full
+{%- endif %}
 
 Environment=PATH={{ libretime_venv_dir }}/bin:/usr/local/bin:/usr/bin:/bin
 Environment=LIBRETIME_CONFIG_FILEPATH={{ libretime_config_filepath }}

templates/systemd/libretime-worker.service.j2

@@ -3,6 +3,7 @@ Description=LibreTime Worker Service
 PartOf=libretime.target
 
 [Service]
+{%- if libretime_systemd_hardening %}
 NoNewPrivileges=true
 CapabilityBoundingSet=
 PrivateDevices=true
@@ -16,6 +17,7 @@ ProtectKernelModules=true
 ProtectKernelTunables=true
 ProtectProc=invisible
 ProtectSystem=full
+{%- endif %}
 
 Environment=PATH={{ libretime_venv_dir }}/bin:/usr/local/bin:/usr/bin:/bin
 Environment=LIBRETIME_CONFIG_FILEPATH={{ libretime_config_filepath }}