Renamed dwelling-upload-clear to a more suitable name dwelling-upload-clean.

Makefile

@@ -13,23 +13,23 @@ all: ${TARGET}
 
 ${TARGET}:
 	go build -o bin/$@ ${LDFLAGS} cmd/$@/main.go
-	go build -o bin/$@-clear ${LDFLAGS} cmd/$@-clear/main.go
+	go build -o bin/$@-clean ${LDFLAGS} cmd/$@-clean/main.go
 
 run:
 	bin/${TARGET} -conf configs/config.yaml
 
-run-clear:
-	bin/${TARGET}-clear -conf configs/config.yaml
+run-clean:
+	bin/${TARGET}-clean -conf configs/config.yaml
 
 install:
 	install -Dm 0755 bin/${TARGET} ${DESTDIR}usr/bin/${TARGET}
-	install -Dm 0755 bin/${TARGET}-clear ${DESTDIR}usr/bin/${TARGET}-clear
+	install -Dm 0755 bin/${TARGET}-clean ${DESTDIR}usr/bin/${TARGET}-clean
 	install -Dm 0644 configs/config.yaml ${DESTDIR}etc/dwelling/upload.yaml
 	install -Dm 0644 LICENSE ${DESTDIR}usr/share/licenses/${TARGET}/LICENSE
 
 	install -Dm 0644 init/systemd/${TARGET}.service ${DESTDIR}${SYSDDIR}/${TARGET}.service
-	install -Dm 0644 init/systemd/${TARGET}-clear.timer ${DESTDIR}${SYSDDIR}/${TARGET}-clear.timer
-	install -Dm 0644 init/systemd/${TARGET}-clear.service ${DESTDIR}${SYSDDIR}/${TARGET}-clear.service
+	install -Dm 0644 init/systemd/${TARGET}-clean.timer ${DESTDIR}${SYSDDIR}/${TARGET}-clean.timer
+	install -Dm 0644 init/systemd/${TARGET}-clean.service ${DESTDIR}${SYSDDIR}/${TARGET}-clean.service
 
 	install -Dm 0644 build/dwelling-upload.conf ${DESTDIR}usr/lib/sysusers.d/dwelling-upload.conf
 
@@ -37,18 +37,18 @@ install:
 
 stop-service:
 	${SYSCTL} stop ${TARGET}.service
-	${SYSCTL} stop ${TARGET}-clear.timer
+	${SYSCTL} stop ${TARGET}-clean.timer
 	${SYSCTL} disable ${TARGET}.service
-	${SYSCTL} disable ${TARGET}-clear.timer
+	${SYSCTL} disable ${TARGET}-clean.timer
 
 uninstall:
 	rm ${DESTDIR}usr/bin/${TARGET}
-	rm ${DESTDIR}usr/bin/${TARGET}-clear
+	rm ${DESTDIR}usr/bin/${TARGET}-clean
 	rm ${DESTDIR}usr/share/licenses/${TARGET}/LICENSE
 
 	rm ${DESTDIR}${SYSDDIR}/${TARGET}.service
-	rm ${DESTDIR}${SYSDDIR}/${TARGET}-clear.timer
-	rm ${DESTDIR}${SYSDDIR}/${TARGET}-clear.service
+	rm ${DESTDIR}${SYSDDIR}/${TARGET}-clean.timer
+	rm ${DESTDIR}${SYSDDIR}/${TARGET}-clean.service
 
 clean:
 	go clean

cmd/dwelling-upload-clean/main.go

@@ -60,17 +60,17 @@ func main() {
 		config.Log.ToStdout = true
 	}
 
-	logErr, err := logging.NewLogger(config.Log.ClearError, config.Log.ToStdout)
+	logErr, err := logging.NewLogger(config.Log.CleanError, config.Log.ToStdout)
 	if err != nil {
 		log.Fatalln("failed to open error logger:", err)
 	}
 	defer logErr.Close()
 
-	logClear, err := logging.NewLogger(config.Log.Clear, config.Log.ToStdout)
+	logClean, err := logging.NewLogger(config.Log.Clean, config.Log.ToStdout)
 	if err != nil {
 		log.Fatalln("failed to open error logger:", err)
 	}
-	defer logClear.Close()
+	defer logClean.Close()
 
 	uploadsDir, err := ioutil.ReadDir(config.Uploads.Directory)
 	if err != nil {
@@ -94,6 +94,6 @@ func main() {
 	_, _, cFSz := utils.ConvertFileSize(deletedSize)
 
 	if deletedCount > 0 {
-		logClear.Printf("%d %s", deletedCount, cFSz)
+		logClean.Printf("%d %s", deletedCount, cFSz)
 	}
 }

configs/config.yaml

@@ -21,9 +21,9 @@ log:
   error: "/var/log/dwelling-upload/error.log"
   upload: "/var/log/dwelling-upload/upload.log"
   download: "/var/log/dwelling-upload/download.log"
-  # dwelling-upload-clear logs.
-  clear: "/var/log/dwelling-upload/clear.log"
-  clear_error: "/var/log/dwelling-upload/clear_error.log"
+  # dwelling-upload-clean logs.
+  clean: "/var/log/dwelling-upload/clean.log"
+  clean_error: "/var/log/dwelling-upload/clean_error.log"
 uploads:
   # Path where to put uploaded files.
   directory: "/srv/uploads"

init/systemd/dwelling-upload-clean.service

@@ -0,0 +1,37 @@
+[Unit]
+Description=dwelling-upload-clean
+
+[Service]
+Type=oneshot
+User=dwupload
+Group=dwupload
+ExecStart=/usr/bin/dwelling-upload-clean -conf /etc/dwelling/upload.yaml
+ReadOnlyPaths=/
+# Set here path to directory where uploads are stored.
+ReadWritePaths=/srv/upload
+NoExecPaths=/
+
+LogsDirectory=dwelling-upload
+
+AmbientCapabilities=
+CapabilityBoundingSet=
+
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+RestrictAddressFamilies=
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=multi-user.target

init/systemd/dwelling-upload-clean.timer

@@ -1,5 +1,5 @@
 [Unit]
-Description=dwelling-upload-clear
+Description=dwelling-upload-clean
 
 [Timer]
 OnCalendar=hourly

init/systemd/dwelling-upload-clear.service

@@ -1,10 +0,0 @@
-[Unit]
-Description=dwelling-upload-clear
-
-[Service]
-Type=oneshot
-User=dwupload
-ExecStart=/usr/bin/dwelling-upload-clear -conf /etc/dwelling/upload.yaml
-
-[Install]
-WantedBy=multi-user.target

init/systemd/dwelling-upload.service

@@ -6,7 +6,35 @@ After=network.target
 Type=simple
 Restart=on-failure
 User=dwupload
+Group=dwupload
 ExecStart=/usr/bin/dwelling-upload -conf /etc/dwelling/upload.yaml
 
+ReadOnlyPaths=/
+# Set here path to directory where uploads are stored.
+ReadWritePaths=/srv/upload
+NoExecPaths=/
+
+LogsDirectory=dwelling-upload
+
+AmbientCapabilities=
+CapabilityBoundingSet=
+
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+
 [Install]
 WantedBy=multi-user.target

internal/configuration/configuration.go

@@ -19,8 +19,8 @@ type Configuration struct {
 		Error      string `yaml:"error"`
 		Upload     string `yaml:"upload"`
 		Download   string `yaml:"download"`
-		Clear      string `yaml:"clear"`
-		ClearError string `yaml:"clear_error"`
+		Clean      string `yaml:"clean"`
+		CleanError string `yaml:"clean_error"`
 	} `yaml:"log"`
 	Uploads struct {
 		Directory string `yaml:"directory"`