wenil/busbar-designer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

systemd: redirect HOME / XDG dirs into project so ProtectHome stays on

Browse Source 
ezdxf, matplotlib, and other Python libs try to write into $HOME/.config
and $HOME/.cache. With ProtectHome=true the real /home/busbar is invisible
to the service and pathlib.Path.exists() throws PermissionError.

Fix: set HOME, XDG_CONFIG_HOME, XDG_CACHE_HOME to /opt/busbar-designer/data/*
which is already in ReadWritePaths. Hardening (ProtectHome) stays intact.

install.sh also pre-creates the .config / .cache subdirs.
This commit is contained in:
wenil
2026-05-25 09:38:39 +03:00
parent a16952f7c5
commit 1fadef0b3f
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/busbar-designer.service
+5
View File
@@ -23,6 +23,11 @@ Environment=HOST=0.0.0.0
Environment=PORT=5000
Environment=FLASK_DEBUG=0
Environment=PATH=/opt/busbar-designer/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
; HOME points inside the project so ezdxf / matplotlib / build123d can write
; their config + cache while ProtectHome=true still hides the real /home.
Environment=HOME=/opt/busbar-designer/data
Environment=XDG_CONFIG_HOME=/opt/busbar-designer/data/.config
Environment=XDG_CACHE_HOME=/opt/busbar-designer/data/.cache
ExecStart=/opt/busbar-designer/.venv/bin/gunicorn --bind=0.0.0.0:5000 --workers=2 --threads=2 --timeout=120 app:app
Restart=on-failure
RestartSec=5