Prototype Arch PKGBUILD and supporting files

The package will be created, but the result itself has yet to be tested.

.gitignore

@@ -6,6 +6,8 @@
 /documentation/
 /manual/
 /tests/coverage/
+/dist/arch/src
+/dist/arch/pkg
 /arsse.db*
 /config.php
 /.php_cs.cache
@@ -36,6 +38,7 @@ $RECYCLE.BIN/
 *.zip
 *.7z
 *.tar.gz
+*.tar.xz
 *.tgz
 *.deb
 *.rpm

dist/arch/PKGBUILD

@@ -0,0 +1,56 @@
+pkgname="arsse"
+pkgver="0.9.1"
+pkgrel=1
+epoch=
+pkgdesc="RSS/Atom newsfeed synchronization server"
+arch=("any")
+url="https://thearsse.com/"
+license=("MIT")
+groups=()
+depends=("php>=7.1" "php-intl" "php-sqlite" "uwsgi" "uwsgi-plugin-php")
+makedepends=("composer")
+checkdepends=()
+optdepends=("php-pgsql: PostgreSQL database support")
+provides=()
+conflicts=()
+replaces=()
+backup=("etc/webapps/arsse/config.php" "etc/webapps/arsse/uwsgi.ini")
+options=()
+install=
+changelog=
+source=("https://code.mensbeam.com/attachments/229880aa-3fcc-499f-b747-6932a661dc0e"
+        "arsse.service"
+        "arsse-web.service"
+        "arsse-fetch.service"
+        "sysuser.conf"
+        "config.php"
+        "uwsgi.ini"
+        "arsse.sh")
+noextract=()
+
+package() {
+    cd "$pkgdir"
+    mkdir -p "usr/bin" "usr/share/webapps/arsse" "usr/share/doc/arsse" "usr/share/licenses/arsse" "usr/lib/systemd/system" "usr/lib/sysusers.d" "etc/webapps/arsse"
+    cd "$srcdir/arsse"
+    cp ../arsse.sh "$pkgdir/usr/bin/arsse"
+    cp -r lib locale sql vendor www CHANGELOG UPGRADING README.md arsse.php "$pkgdir/usr/share/webapps/arsse"
+    cp -r manual/* "$pkgdir/usr/share/doc/arsse"
+    cp LICENSE AUTHORS "$pkgdir/usr/share/licenses/arsse"
+    cp ../*.service "$pkgdir/usr/lib/systemd/system"
+    cp ../sysuser.conf "$pkgdir/usr/lib/sysusers.d/arsse.conf"
+    cp ../config.php config.defaults.php ../uwsgi.ini "$pkgdir/etc/webapps/arsse"
+    cd "$pkgdir"
+    chmod -R a=rX *
+    chmod a=rx usr/bin/arsse
+    chmod u=r etc/webapps/arsse/*
+    ln -sT "/etc/webapps/arsse/config.php" "usr/share/webapps/arsse/config.php"
+}
+
+md5sums=('c7c9526f02fe34bf6f8399eff95c819d'
+         '53f150081dc9097790166ac22575fb1d'
+         '9ed9119aff93e0099c15cd12a3f71655'
+         '71a5975aed6b2da581262441f14bc929'
+         'b6ef9ab7e9062df1d5ba060066b6d734'
+         '33e7a5b290ef20339952f1d904b33f8f'
+         'ff8fc77353d8e06f5c74ad577880a19d'
+         '4fb46ec290e497279c3dd7c8c528abf6')

dist/arch/arsse-fetch.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=The Arsse newsfeed fetching service
+Documentation=https://thearsse.com/manual/
+
+[Service]
+User=arsse
+Group=arsse
+Type=simple
+WorkingDirectory=/usr/share/webapps/arsse
+ExecStart=/usr/bin/env php /usr/share/webapps/arsse/arsse.php daemon
+
+ProtectProc=invisible
+NoNewPrivileges=true
+ProtectSystem=full
+ProtectHome=true
+StateDirectory=arsse
+ConfigurationDirectory=webapps/arsse
+ReadOnlyPaths=/
+ReadWriePaths=/usr/lib/arsse
+NoExecPaths=/
+ExecPaths=/usr/bin/php /usr/bin/php7
+PrivateTmp=true
+PrivateDevices=true
+RestrictSUIDSGID=true
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=arsse
+Restart=on-failure
+RestartPreventStatus=
+
+[Install]
+WantedBy=multi-user.target

dist/arch/arsse-web.service

@@ -0,0 +1,33 @@
+[Unit]
+Description=The Arsse newsfeed client service
+Documentation=https://thearsse.com/manual/
+
+[Service]
+User=arsse
+Group=arsse
+Type=simple
+WorkingDirectory=/usr/share/webapps/arsse
+ExecStart=/usr/bin/uwsgi /etc/webapps/arsse/uwsgi.ini
+
+ProtectProc=invisible
+NoNewPrivileges=true
+ProtectSystem=full
+ProtectHome=true
+RuntimeDirectory=arsse
+StateDirectory=arsse
+ConfigurationDirectory=webapps/arsse
+ReadOnlyPaths=/
+ReadWriePaths=/usr/lib/arsse
+NoExecPaths=/
+ExecPaths=/usr/bin/uwsgi
+PrivateTmp=true
+PrivateDevices=true
+RestrictSUIDSGID=true
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=arsse
+Restart=on-failure
+RestartPreventStatus=
+
+[Install]
+WantedBy=multi-user.target

dist/arch/arsse.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=The Arsse newsfeed management service
+Documentation=https://thearsse.com/manual/
+Requires=arsse-fetch.service
+BindsTo=arsse-web.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=true
+
+[Install]
+WantedBy=multi-user.target

dist/arch/arsse.sh

@@ -0,0 +1,10 @@
+#! /usr/bin/bash
+
+if [ `id -u` -eq 0 ]; then
+    setpriv --clear-groups --inh-caps -all --egid=arsse --euid=arsse php /usr/share/webapps/arsse/arsse.php $@
+elif [ `id -un` == "arsse" ]; then
+    php /usr/share/webapps/arsse/arsse.php $@
+else
+    echo "Not authorized." >&2
+    exit 1
+fi

dist/arch/config.php

@@ -0,0 +1,8 @@
+<?php
+
+# Please refer to config.defaults.php or the manual at /usr/share/doc/arsse/
+# for possible configuration parameters
+
+return [
+    'dbSQLiteFile' => "/usr/lib/arsse/arsse.db",
+];

dist/arch/sysuser.conf

@@ -0,0 +1 @@
+u arsse - "The Arsse" /usr/lib/arsse -

dist/arch/uwsgi.ini

@@ -0,0 +1,15 @@
+[uwsgi]
+
+strict=true
+uwsgi-socket=/run/arsse/uwsgi.socket
+master=true
+processes=4
+workers=2
+vacuum=true
+plugin=php
+php-sapi-name=apache
+php-set=extension=curl
+php-set=extension=iconv
+php-set=extension=intl
+php-set=extension=sqlite3
+php-app=/usr/share/webapps/arsse/arsse.php