From f269354ff2e3b7ec0096bc304a2215ee51565d9a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= <tim@siosm.fr>
Date: Sat, 7 Jan 2017 00:06:16 +0100
Subject: [PATCH] 1.6.0.r1.gd7bd0cf-1: various fixes (service unit, postgresql)

---
 .SRCINFO                                | 11 ++++++++---
 PKGBUILD                                | 13 ++++++++-----
 ffsync.service                          | 19 +++++++++++++++++--
 mozilla-firefox-sync-server-git.install |  2 +-
 4 files changed, 34 insertions(+), 11 deletions(-)

diff --git a/.SRCINFO b/.SRCINFO
index e1c3048..04d7a91 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,6 +1,8 @@
+# Generated by mksrcinfo v8
+# Fri Jan  6 23:27:02 UTC 2017
 pkgbase = mozilla-firefox-sync-server-git
-	pkgdesc = Mozilla Sync Server for built-in Firefox Sync - 1.5 version for Firefox 29+
-	pkgver = 1.5.2.r0.g3d216e9
+	pkgdesc = Mozilla Sync Server for built-in Firefox Sync - 1.5+ version for Firefox 29+
+	pkgver = 1.6.0.r1.gd7bd0cf
 	pkgrel = 1
 	url = http://docs.services.mozilla.com/howtos/run-sync-1.5.html
 	install = mozilla-firefox-sync-server-git.install
@@ -17,8 +19,11 @@ pkgbase = mozilla-firefox-sync-server-git
 	source = ffsync.service
 	source = ffsync.tmpfiles
 	sha256sums = SKIP
-	sha256sums = f2e69486825f43f6a288adced31a6c2e51b0dbd84483aa427b2d85699c942446
+	sha256sums = 8664ad8361d6751aad47e86900270d2efd8b65d520248cd1c164432baba42212
 	sha256sums = 462bfdccc672339a03622dbe0a76a2df1b4293de8b240e82fe127a6befaa1a89
+	sha384sums = SKIP
+	sha384sums = a7384b5b55b2377ee4445e45bfd0545435c2a6a19730ff4219340e3c6e8a3b51fcb46e4215093df860f9fa99a0b471ab
+	sha384sums = 236b285f7e390d31cd13a0ac78c524acfbc8a7325d7b0b114b39f69a5963535d5f1f73bdef575728b2f6e81860c4ea16
 
 pkgname = mozilla-firefox-sync-server-git
 
diff --git a/PKGBUILD b/PKGBUILD
index c2fb548..bf27501 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,9 +1,9 @@
 # Maintainer: Timothée Ravier <tim@siosm.fr>
 
 pkgname=mozilla-firefox-sync-server-git
-pkgver=1.5.2.r0.g3d216e9
+pkgver=1.6.0.r1.gd7bd0cf
 pkgrel=1
-pkgdesc="Mozilla Sync Server for built-in Firefox Sync - 1.5 version for Firefox 29+"
+pkgdesc="Mozilla Sync Server for built-in Firefox Sync - 1.5+ version for Firefox 29+"
 arch=('i686' 'x86_64')
 url='http://docs.services.mozilla.com/howtos/run-sync-1.5.html'
 license=('GPL')
@@ -16,8 +16,11 @@ source=("${pkgname}::git+https://github.com/mozilla-services/syncserver"
         'ffsync.service'
         'ffsync.tmpfiles')
 sha256sums=('SKIP'
-            'f2e69486825f43f6a288adced31a6c2e51b0dbd84483aa427b2d85699c942446'
+            '8664ad8361d6751aad47e86900270d2efd8b65d520248cd1c164432baba42212'
             '462bfdccc672339a03622dbe0a76a2df1b4293de8b240e82fe127a6befaa1a89')
+sha384sums=('SKIP'
+            'a7384b5b55b2377ee4445e45bfd0545435c2a6a19730ff4219340e3c6e8a3b51fcb46e4215093df860f9fa99a0b471ab'
+            '236b285f7e390d31cd13a0ac78c524acfbc8a7325d7b0b114b39f69a5963535d5f1f73bdef575728b2f6e81860c4ea16')
 backup=('opt/mozilla-firefox-sync-server/syncserver.ini')
 
 pkgver() {
@@ -36,8 +39,8 @@ build() {
   cd ${pkgname}
   make build
 
-  # Install gunicorn to use with nginx
-  local/bin/pip install gunicorn
+  # PostgreSQL support
+  # local/bin/pip install psycopg2
 
   # There is no install target in the Makefile, so let's do some cleaning
   rm -rf .git .gitignore Dockerfile Makefile MANIFEST.in README.rst setup.py \
diff --git a/ffsync.service b/ffsync.service
index e813263..39d2acc 100644
--- a/ffsync.service
+++ b/ffsync.service
@@ -4,11 +4,26 @@ After=network.target
 
 [Service]
 Type=simple
+ExecStart=/opt/mozilla-firefox-sync-server/local/bin/gunicorn --paste /opt/mozilla-firefox-sync-server/syncserver.ini
+Restart=on-abort
+
 User=ffsync
 Group=http
 UMask=007
-Restart=on-abort
-ExecStart=/opt/mozilla-firefox-sync-server/local/bin/gunicorn --paste /opt/mozilla-firefox-sync-server/syncserver.ini
+
+NoNewPrivileges=yes
+
+PrivateTmp=yes
+PrivateDevices=yes
+
+ProtectSystem=full
+ProtectHome=yes
+
+SystemCallArchitectures=native
+SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
+
+CapabilityBoundingSet=
+AmbientCapabilities=
 
 [Install]
 WantedBy=multi-user.target
diff --git a/mozilla-firefox-sync-server-git.install b/mozilla-firefox-sync-server-git.install
index 437dd22..03e415d 100644
--- a/mozilla-firefox-sync-server-git.install
+++ b/mozilla-firefox-sync-server-git.install
@@ -1,5 +1,5 @@
 post_install() {
-	getent group ffsync &>/dev/null || groupadd ffsync >/dev/null
+	getent group ffsync &>/dev/null || groupadd -r ffsync >/dev/null
 	getent passwd ffsync &>/dev/null || useradd -r -s /usr/bin/false \
 		-g ffsync -G ffsync,http -d /var/lib/ffsync ffsync >/dev/null