Replace TCP sockets for our services with Unix sockets

a commented

2022-01-04 22:53:40 +00:00

Owner

Since everything is on one machine, we can use Unix sockets which are faster and more secure. I know that Mastodon supports Unix sockets but I'm not sure how to get it set up.

a added the

security

enhancement

labels 2022-01-04 22:53:40 +00:00

a added this to the (deleted) project 2022-01-04 22:53:40 +00:00

a added a new dependency 2022-01-04 22:53:50 +00:00

#82 Many services use regular HTTP behind nginx and exozyme users may be able to view that traffic

a commented

2022-01-04 23:45:57 +00:00

Author

Owner

I configured Mastodon and nginx to use Unix sockets with 39753357f5 but I don't think I have the permissions tight enough.

I configured Mastodon and nginx to use Unix sockets with https://git.exozy.me/exozyme/nginx/commit/39753357f5d9f65a3f59549237efaa26ce5dc23d but I don't think I have the permissions tight enough.

a commented

2022-01-05 04:31:24 +00:00

Author

Owner

I made Redis and PostgreSQL only listen on Unix sockets and it took forever to fix all our configs to make that work out. The good thing is that we don't need to use password authentication anymore!

I made Redis and PostgreSQL only listen on Unix sockets and it took *forever* to fix all our configs to make that work out. The good thing is that we don't need to use password authentication anymore!

a commented

2022-01-05 16:32:43 +00:00

Author

Owner

I tightened permissions on the Unix sockets' directories using systemd's RuntimeDirectoryMode.

I tightened permissions on the Unix sockets' directories using systemd's `RuntimeDirectoryMode`.

a commented

2022-01-05 17:55:31 +00:00

Author

Owner

Jellyfin supports Unix sockets but can't configure permissions for them: https://github.com/jellyfin/jellyfin/issues/5311

a referenced this issue

2022-01-05 17:55:54 +00:00

Many services use regular HTTP behind nginx and exozyme users may be able to view that traffic #82

a removed a dependency 2022-01-05 22:15:47 +00:00

#82 Many services use regular HTTP behind nginx and exozyme users may be able to view that traffic

a commented

2022-01-22 03:52:09 +00:00

Author

Owner

This is the corresponding issue for PeerTube: https://github.com/Chocobozzz/PeerTube/issues/1951

a commented

2022-01-22 04:03:28 +00:00

Author

Owner

Jellyfin supports Unix sockets but can't configure permissions for them: https://github.com/jellyfin/jellyfin/issues/5311

Patching Jellyfin right now...

> Jellyfin supports Unix sockets but can't configure permissions for them: https://github.com/jellyfin/jellyfin/issues/5311 Patching Jellyfin right now...

a closed this issue

2022-01-22 04:17:46 +00:00

a commented

2022-01-22 04:38:44 +00:00

Author

Owner

See this upstream issue: https://github.com/jellyfin/jellyfin/pull/7202

a commented

2022-01-23 00:05:18 +00:00

Author

Owner

Upstream is now fixed and Jellyfin is confirmed working with a Unix socket! 🎉

Replace TCP sockets for our services with Unix sockets #87