Add systemd service, adjust nginx config

4 files changed, 64 insertions, 7 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 32f143352edd..f14ca14683a1 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,7 +1,7 @@
 pkgbase = snapdrop
 	pkgdesc = A Progressive Web App for local file sharing
 	pkgver = 2021.03.10
-	pkgrel = 2
+	pkgrel = 3
 	url = https://github.com/RobinLinus/snapdrop
 	arch = any
 	license = GPL3
@@ -9,11 +9,13 @@ pkgbase = snapdrop
 	makedepends = npm
 	depends = nodejs
 	source = https://github.com/RobinLinus/snapdrop/archive/fad4632eb903ea6de9ecbec90df0ac6bd7410e68.tar.gz
-	source = example-nginx.conf
 	source = customise-server-host-addr.patch
+	source = example-nginx.conf
+	source = snapdrop.service
 	sha256sums = 8886ae45aa5910606c8125e27cc589ae26fe162eedc11a396ca864f4788f2c2a
-	sha256sums = 869a3b728ff81f0b29177279e344684f554e5670787b0401312b4f51142c33bc
 	sha256sums = c91545d65af2bfd6f09e05c7263b00340a98870ee9f3ded7447891e56b296fb6
+	sha256sums = 9bd2e544a4c3ac7e3d865881c02bb5c829aef5f34302f7a082c9724d85145930
+	sha256sums = 5d7f5efe54122221785ceeaa0b92873ce618a7d4160abf14b41c196bed2953db
 
 pkgname = snapdrop
 
diff --git a/PKGBUILD b/PKGBUILD
index 35a3ebdddade..e9d490d6987b 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -2,7 +2,7 @@
 
 pkgname="snapdrop"
 pkgver=2021.03.10
-pkgrel=2
+pkgrel=3
 _githash="fad4632eb903ea6de9ecbec90df0ac6bd7410e68"
 pkgdesc="A Progressive Web App for local file sharing"
 url="https://github.com/RobinLinus/snapdrop"
@@ -12,13 +12,15 @@ depends=("nodejs")
 makedepends=("npm")
 source=(
     "https://github.com/RobinLinus/snapdrop/archive/${_githash}.tar.gz"
-    "example-nginx.conf"
     "customise-server-host-addr.patch"
+    "example-nginx.conf"
+    "snapdrop.service"
 )
 sha256sums=(
     "8886ae45aa5910606c8125e27cc589ae26fe162eedc11a396ca864f4788f2c2a"
-    "869a3b728ff81f0b29177279e344684f554e5670787b0401312b4f51142c33bc"
     "c91545d65af2bfd6f09e05c7263b00340a98870ee9f3ded7447891e56b296fb6"
+    "9bd2e544a4c3ac7e3d865881c02bb5c829aef5f34302f7a082c9724d85145930"
+    "5d7f5efe54122221785ceeaa0b92873ce618a7d4160abf14b41c196bed2953db"
 )
 
 prepare() {
@@ -42,4 +44,6 @@ package() {
 
     chmod -R 0000 "${pkgdir}/usr/share"
     chmod -R u+rwX,g+rX,o+rX "${pkgdir}/usr/share"
+
+    install -Dm644 "${srcdir}/snapdrop.service" "${pkgdir}/usr/lib/systemd/system/snapdrop.service"
 }
diff --git a/example-nginx.conf b/example-nginx.conf
index 7e36056b0a25..cab7d8dfb47e 100644
--- a/example-nginx.conf
+++ b/example-nginx.conf
@@ -17,6 +17,13 @@ server {
         proxy_pass http://127.0.0.1:3000;
         proxy_set_header Connection "upgrade";
         proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header X-Forwarded-for $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        # If you intend to run the Snapdrop server on the same network as where your users are,
+        # you should uncomment this and delete the previous line. You may want to choose a different
+        # value to "0.0.0.0", but ultimately as long as it's a valid IP address it doesn't matter what it is.
+        # References:
+        # https://github.com/RobinLinus/snapdrop/issues/266
+        # https://github.com/RobinLinus/snapdrop/issues/159
+        #proxy_set_header X-Forwarded-For "0.0.0.0";
     }
 }
diff --git a/snapdrop.service b/snapdrop.service
new file mode 100644
index 000000000000..7e7f37e31cc0
--- /dev/null
+++ b/snapdrop.service
@@ -0,0 +1,44 @@
+[Unit]
+Description=Snapdrop Server
+After=network.target
+
+[Service]
+Type=simple
+DynamicUser=true
+Environment="HOST=127.0.0.1"
+# Uncomment this if you're not going to run Snapdrop behind a reverse-proxy (ie. nginx)
+#Environment="HOST=0.0.0.0"
+Environment="PORT=3000"
+ExecStart=/usr/bin/node index.js
+WorkingDirectory=/usr/share/snapdrop/server
+
+Restart=always
+RestartSec=10s
+
+LimitNOFILE=1024
+LimitNPROC=32
+
+ProtectHome=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+
+RestrictNamespaces=true
+
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+RestrictAddressFamilies=AF_INET AF_INET6
+
+LockPersonality=true
+RestrictRealtime=true
+
+# Node/Snapdrop doesn't seem to work with this enabled
+#MemoryDenyWriteExecute=true
+
+[Install]
+WantedBy=multi-user.target