Improve sandboxing of matomo archiver

[chef.git] / cookbooks / matomo / recipes / default.rb

diff --git a/cookbooks/matomo/recipes/default.rb b/cookbooks/matomo/recipes/default.rb
index 453afc4882d0fa76c933f0dd96ec2d9d8f6d94ab..9cea5099d67a24f8cdda8462b682f505bdb79cf1 100644 (file)
--- a/cookbooks/matomo/recipes/default.rb
+++ b/cookbooks/matomo/recipes/default.rb
@@ -60,8 +60,11 @@ node[:matomo][:plugins].each do |plugin_name, plugin_version|
   end
 
   archive_file "#{Chef::Config[:file_cache_path]}/matomo-#{plugin_name}-#{plugin_version}.zip" do
-    destination "/opt/matomo-#{version}/matomo/plugins"
-    overwrite :auto
+    destination "/opt/matomo-#{plugin_name}-#{plugin_version}"
+  end
+
+  link "/opt/matomo-#{version}/matomo/plugins/#{plugin_name}" do
+    to "/opt/matomo-#{plugin_name}-#{plugin_version}/#{plugin_name}"
     notifies :run, "notify_group[matomo-updated]"
   end
 end
@@ -142,7 +145,7 @@ if File.symlink?("/srv/matomo.openstreetmap.org")
 
   execute "/opt/matomo-#{version}/matomo/matomo.br" do
     action :nothing
-    command "brotli --keep --best /opt/matomo-#{version}/matomo/matomo.js"
+    command "brotli --keep --force --best /opt/matomo-#{version}/matomo/matomo.js"
     cwd "/opt/matomo-#{version}"
     user "root"
     group "root"
@@ -151,7 +154,7 @@ if File.symlink?("/srv/matomo.openstreetmap.org")
 
   execute "/opt/matomo-#{version}/matomo/matomo.js" do
     action :nothing
-    command "gzip --keep --best /opt/matomo-#{version}/matomo/matomo.js"
+    command "gzip --keep --force --best /opt/matomo-#{version}/matomo/matomo.js"
     cwd "/opt/matomo-#{version}"
     user "root"
     group "root"
@@ -160,7 +163,7 @@ if File.symlink?("/srv/matomo.openstreetmap.org")
 
   execute "/opt/matomo-#{version}/matomo/piwik.br" do
     action :nothing
-    command "brotli --keep --best /opt/matomo-#{version}/matomo/piwik.js"
+    command "brotli --keep --force --best /opt/matomo-#{version}/matomo/piwik.js"
     cwd "/opt/matomo-#{version}"
     user "root"
     group "root"
@@ -169,7 +172,7 @@ if File.symlink?("/srv/matomo.openstreetmap.org")
 
   execute "/opt/matomo-#{version}/matomo/piwik.js" do
     action :nothing
-    command "gzip --keep --best /opt/matomo-#{version}/matomo/piwik.js"
+    command "gzip --keep --force --best /opt/matomo-#{version}/matomo/piwik.js"
     cwd "/opt/matomo-#{version}"
     user "root"
     group "root"
@@ -196,8 +199,22 @@ apache_site "matomo.openstreetmap.org" do
   template "apache.erb"
 end
 
-cron_d "matomo" do
-  minute "5"
+systemd_service "matomo-archive" do
+  description "Matomo report archiving"
+  exec_start "/usr/bin/php /srv/matomo.openstreetmap.org/console core:archive --url=https://matomo.openstreetmap.org/"
   user "www-data"
-  command "/usr/bin/php /srv/matomo.openstreetmap.org/console core:archive --quiet --url=https://matomo.openstreetmap.org/"
+  sandbox true
+  proc_subset "all"
+  memory_deny_write_execute false
+  restrict_address_families "AF_UNIX"
+  read_write_paths "/opt/matomo-#{version}/matomo/tmp"
+end
+
+systemd_timer "matomo-archive" do
+  description "Matomo report archiving"
+  on_calendar "*:05"
+end
+
+service "matomo-archive.timer" do
+  action [:enable, :start]
 end