Реализован production-hardening по fix1: env/reconfigure, IPv4-only, TLS, secrets, firewall, docs

package/systemd/hy2xs-admin.service

@@ -5,13 +5,23 @@ Wants=network-online.target
 
 [Service]
 Type=simple
-WorkingDirectory=/opt/hy2xs-admin
-Environment=HUI_DATA=/var/lib/hy2xs-admin/
+User=hy2xs-admin
+Group=hy2xs-admin
+WorkingDirectory={{INSTALL_DIR}}
+Environment=HUI_DATA={{DATA_DIR}}/
 Environment=HY2XS_UI_BIND_HOST={{UI_BIND_HOST}}
-ExecStart=/opt/hy2xs-admin/hy2xs-admin -p {{UI_PORT}}
+Environment=HY2XS_UI_PORT={{UI_PORT}}
+ExecStart={{INSTALL_DIR}}/hy2xs-admin -p {{UI_PORT}}
 Restart=on-failure
 RestartSec=5s
 NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadWritePaths={{DATA_DIR}} {{LOG_DIR}}
+RestrictAddressFamilies=AF_INET AF_UNIX
+CapabilityBoundingSet=
+AmbientCapabilities=
 
 [Install]
 WantedBy=multi-user.target