mirror of
https://github.com/lrnselfreliance/wrolpi.git
synced 2026-10-26 02:48:38 -04:00
4f66472492
The private keys of eight eMudhra intermediate CAs can be recovered from their certificates, so anyone can mint a trusted certificate for any host. * Require certifi>=2026.10.19; yt-dlp, requests and curl-cffi use its bundle, and 2026.10.19 removes the emSign ECC Root CA - G3 root they chain to. * Set DENO_TLS_CA_STORE=system for the API (systemd + Docker) and the archive container so Deno follows the apt-patched system store instead of roots that only change with a Deno upgrade. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
29 lines
1.1 KiB
Desktop File
29 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=WROLPi Python API (Development)
|
|
PartOf=wrolpi.target
|
|
Conflicts=wrolpi-api.service
|
|
|
|
[Service]
|
|
Environment=PYTHONUNBUFFERED=1
|
|
# Sanic 25.x wants 'spawn' but our code uses 'fork' for multiprocessing.
|
|
Environment=SANIC_START_METHOD_SET=1
|
|
# Deno (single-file, yt-dlp EJS) trusts the system store, which apt keeps current, instead of its
|
|
# bundled roots.
|
|
Environment=DENO_TLS_CA_STORE=system
|
|
# Required for yt-dlp to access GNOME keyring for browser cookie decryption.
|
|
Environment=DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/%U/bus
|
|
ExecStart=/opt/wrolpi/venv/bin/python -m sanic main:api_app --host 0.0.0.0 --port 8081 -w 2 --reload --debug
|
|
ExecReload=/bin/kill -HUP $MAINPID
|
|
Group=wrolpi
|
|
User=wrolpi
|
|
WorkingDirectory=/opt/wrolpi/
|
|
Restart=on-failure
|
|
# Signal only Sanic's main process on stop; it shuts its workers, the perpetual process and the multiprocessing
|
|
# Manager down itself. Signalling the whole cgroup at once kills the Manager under main's own cleanup (broken
|
|
# pipe, exit 1). Stragglers still get SIGKILL at TimeoutStopSec.
|
|
KillMode=mixed
|
|
# Higher than the App so the API can start.
|
|
Nice=4
|
|
|
|
[Install]
|
|
WantedBy=default.target
|