2 files changed, 68 insertions, 0 deletions
diff --git a/deploy/blind-uploader.service b/deploy/blind-uploader.service
new file mode 100644
index 0000000..aa5bc5d
--- /dev/null
+++ b/deploy/blind-uploader.service
@@ -0,0 +1,45 @@
+[Unit]
+Description=Private Drop anonymous image uploader
+Documentation=file:/opt/blind-uploader/README.md
+After=network.target
+
+[Service]
+Type=simple
+DynamicUser=yes
+WorkingDirectory=/opt/blind-uploader
+ExecStart=/usr/bin/python3 /opt/blind-uploader/server.py
+Restart=on-failure
+RestartSec=3s
+
+# These defaults can be overridden using Debian's standard environment file.
+Environment=HOST=127.0.0.1
+Environment=PORT=8000
+Environment=UPLOAD_DIR=/var/lib/blind-uploader/uploads
+Environment=PYTHONDONTWRITEBYTECODE=1
+EnvironmentFile=-/etc/default/blind-uploader
+
+# systemd creates a persistent, service-owned /var/lib/blind-uploader directory.
+StateDirectory=blind-uploader
+StateDirectoryMode=0700
+UMask=0077
+
+# Service hardening. The application only needs its state directory and TCP/IP.
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectClock=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+LockPersonality=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
diff --git a/deploy/nginx-blind-uploader.conf b/deploy/nginx-blind-uploader.conf
new file mode 100644
index 0000000..0473434
--- /dev/null
+++ b/deploy/nginx-blind-uploader.conf
@@ -0,0 +1,23 @@
+# Replace upload.example.com and add your TLS configuration before production use.
+server {
+    listen 80;
+    listen [::]:80;
+    server_name upload.example.com;
+
+    # Allows a 10 MiB image plus multipart form overhead.
+    client_max_body_size 11m;
+
+    location / {
+        proxy_pass http://127.0.0.1:8000;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_connect_timeout 5s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+    }
+}