lit.service

[Unit]
Description=Lit Server

[Service]
Type=simple
User=lit
Group=lit
WorkingDirectory=/srv/lit

ExecStart=/usr/bin/luvi /srv/lit/lit -- serve
Environment=LIT_CONFIG=/srv/lit/config

Restart=always
RestartSec=5s

ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ReadWritePaths=/srv/lit/litdb /srv/lit/run
ReadOnlyPaths=/srv/lit/lit /srv/lit/config
InaccessiblePaths=/boot /mnt /opt /efi /swap
NoExecPaths=/
ExecPaths=/usr/bin/luvi /usr/lib

NoNewPrivileges=yes
CapabilityBoundingSet=
AmbientCapabilities=

ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
ProtectProc=invisible
PrivateUsers=self

RestrictAddressFamilies=AF_UNIX

SystemCallFilter=@system-service
SystemCallFilter=~@debug @mount @swap @reboot @privileged @resources
SystemCallErrorNumber=EPERM
SystemCallArchitectures=native

RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
RemoveIPC=yes

[Install]
WantedBy=multi-user.target

lit.truemedian.me.conf

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen                  443 ssl;
    listen                  [::]:443 ssl;
    server_name             lit.truemedian.me;

    http2                   on;

    # SSL
    ssl_certificate         /etc/letsencrypt/live/truemedian.me/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/truemedian.me/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/truemedian.me/chain.pem;

    # logging
    access_log              /var/log/nginx/access.log combined buffer=512k flush=1m;
    error_log               /var/log/nginx/error.log warn;

    location /interface {
        alias /srv/lit/interface;
        index index.html;
    }

    location / {
        proxy_pass http://lit_socket;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}

# HTTP redirect
server {
    listen      80;
    listen      [::]:80;
    server_name lit.truemedian.me;

    location / {
        return 301 https://lit.truemedian.me$request_uri;
    }
}

upstream lit_socket {
    server unix:/srv/lit/run/lit.sock;
}