search

jgm / gitit

A wiki using HAppS, pandoc, and git
GNU General Public License v2.0
2.13k stars 225 forks source link

Is it possible to listen on unix socket? #675

Open singpolyma opened 2 years ago

singpolyma commented 2 years ago

Most of my web apps listen on unix socket instead of INET port number, can gitit do that? Just gitit -l /tmp/thing.sock did not work.

jgm commented 2 years ago

Not at present.

trentbuck commented 1 year ago

Related: systemd socket activation (i.e. gitit.socket) would Just WorkTM if gitit can be made to use an already-open file descriptor 3, instead of opening its own TCP listener. This would let systemd-analyze security be used to harden the gitit namespace even to the point where TCP/IP are blocked!

Here is a janky web app being locked down heavily (and then nginx reverse-proxies it): https://github.com/trentbuck/collection4/blob/main/debian/service#L15-L44

(Of course, even gitit as-is you can do most of this lockdown -- and you would still need TCP/IP if you wanted gitit to be able to send password reset emails, because fork+exec'ing /usr/sbin/sendmail runs it in the same systemd "slice" as gitit.)