From 98119d8fb55e1633d7bdd79db30fd5caea9ee641 Mon Sep 17 00:00:00 2001
From: Jason McCormick <jason@mfamily.org>
Date: Fri, 16 Oct 2026 16:57:47 -0400
Subject: feat: add private image upload service

---
 deploy/blind-uploader.service | 45 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 deploy/blind-uploader.service

(limited to 'deploy/blind-uploader.service')

diff --git a/deploy/blind-uploader.service b/deploy/blind-uploader.service
new file mode 100644
index 0000000..aa5bc5d
--- /dev/null
+++ b/deploy/blind-uploader.service
@@ -0,0 +1,45 @@
+[Unit]
+Description=Private Drop anonymous image uploader
+Documentation=file:/opt/blind-uploader/README.md
+After=network.target
+
+[Service]
+Type=simple
+DynamicUser=yes
+WorkingDirectory=/opt/blind-uploader
+ExecStart=/usr/bin/python3 /opt/blind-uploader/server.py
+Restart=on-failure
+RestartSec=3s
+
+# These defaults can be overridden using Debian's standard environment file.
+Environment=HOST=127.0.0.1
+Environment=PORT=8000
+Environment=UPLOAD_DIR=/var/lib/blind-uploader/uploads
+Environment=PYTHONDONTWRITEBYTECODE=1
+EnvironmentFile=-/etc/default/blind-uploader
+
+# systemd creates a persistent, service-owned /var/lib/blind-uploader directory.
+StateDirectory=blind-uploader
+StateDirectoryMode=0700
+UMask=0077
+
+# Service hardening. The application only needs its state directory and TCP/IP.
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectClock=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+LockPersonality=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
-- 
cgit v1.2.3