Peertube

cat /etc/systemd/system/peertube.service
=== Вывод команды ===
[Unit]
Description=PeerTube daemon
After=network.target postgresql.service redis-server.service

[Service]
Type=simple
Environment=NODE_ENV=production
Environment=NODE_CONFIG_DIR=/var/www/peertube/config
User=peertube
Group=peertube
ExecStart=/usr/bin/npm start
WorkingDirectory=/var/www/peertube/peertube-latest
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=peertube
Restart=always

; Some security directives.
; Mount /usr, /boot, and /etc as read-only for processes invoked by this service.
ProtectSystem=full
; Sets up a new /dev mount for the process and only adds API pseudo devices
; like /dev/null, /dev/zero or /dev/random but not physical devices. Disabled
; by default because it may not work on devices like the Raspberry Pi.
PrivateDevices=false
; Ensures that the service process and all its children can never gain new
; privileges through execve().
NoNewPrivileges=true
; This makes /home, /root, and /run/user inaccessible and empty for processes invoked
; by this unit. Make sure that you do not depend on data inside these folders.
ProtectHome=true
; Drops the sys admin capability from the daemon.
CapabilityBoundingSet=~CAP_SYS_ADMIN

[Install]
WantedBy=multi-user.target

ls -la /var/www/peertube
ls -la /var/www/peertube/config
ls -la /var/www/peertube/peertube-latest

[root@localhost peertube]# ls -la /var/www/peertube
итого 20
drwx------. 6 peertube peertube 177 мар 24 21:55 .
drwxr-xr-x. 3 root     root      22 мар 24 20:46 ..
-rw-r--r--. 1 peertube peertube  18 июл 27  2021 .bash_logout
-rw-r--r--. 1 peertube peertube 141 июл 27  2021 .bash_profile
-rw-r--r--. 1 peertube peertube 376 июл 27  2021 .bashrc
drwxr-xr-x. 3 peertube peertube  18 мар 24 21:55 .cache
drwxr-x---. 2 peertube peertube  29 мар 24 21:58 config
lrwxrwxrwx. 1 peertube peertube  24 мар 24 21:55 peertube-latest -> versions/peertube-v4.1.1
drwxr-xr-x. 2 peertube peertube   6 мар 24 21:29 storage
drwxr-xr-x. 3 peertube peertube  29 мар 24 21:55 versions
-rw-r--r--. 1 peertube peertube 165 мар 24 21:48 .wget-hsts
-rw-r--r--. 1 peertube peertube 116 мар 24 21:55 .yarnrc
________________________________________________________
[root@localhost peertube]# ls -la /var/www/peertube/config
итого 24
drwxr-x---. 2 peertube peertube    29 мар 24 21:58 .
drwx------. 6 peertube peertube   177 мар 24 21:55 ..
-rw-r--r--. 1 peertube peertube 22372 мар 24 21:59 production.yaml
________________________________________________________

[root@localhost peertube]# ls -la /var/www/peertube/peertube-latest
lrwxrwxrwx. 1 peertube peertube 24 мар 24 21:55 /var/www/peertube/peertube-latest -> versions/peertube-v4.1.1

[root@localhost peertube]# systemctl status peertube.service
● peertube.service - PeerTube daemon
   Loaded: loaded (/etc/systemd/system/peertube.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Thu 2022-03-24 22:10:15 +07; 9min ago
  Process: 72360 ExecStart=/usr/bin/node dist/server (code=exited, status=200/CHDIR)
 Main PID: 72360 (code=exited, status=200/CHDIR)

мар 24 22:10:15 localhost.localdomain systemd[1]: peertube.service: Main process exited, code=exited, status=200/CHDIR
мар 24 22:10:15 localhost.localdomain systemd[1]: peertube.service: Failed with result 'exit-code'.
мар 24 22:10:15 localhost.localdomain systemd[1]: peertube.service: Service RestartSec=100ms expired, scheduling restart.
мар 24 22:10:15 localhost.localdomain systemd[1]: peertube.service: Scheduled restart job, restart counter is at 5.
мар 24 22:10:15 localhost.localdomain systemd[1]: Stopped PeerTube daemon.
мар 24 22:10:15 localhost.localdomain systemd[1]: peertube.service: Start request repeated too quickly.
мар 24 22:10:15 localhost.localdomain systemd[1]: peertube.service: Failed with result 'exit-code'.
мар 24 22:10:15 localhost.localdomain systemd[1]: Failed to start PeerTube daemon.

Mar 24 22:54:50 localhost setroubleshoot[73363]: SELinux is preventing /usr/lib/systemd/systemd from read access on the lnk_file peertube-latest.#0                                                                                          12#012*****  Plugin catchall (100. confidence) suggests   **************************#012#012If you believe that systemd should be allowed read acce                                                                                          ss on the peertube-latest lnk_file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this acc                                                                                          ess.#012Do#012allow this access for now by executing:#012# ausearch -c '(node)' --raw | audit2allow -M my-node#012# semodule -X 300 -i my-node.pp#0                                                                                          12
Mar 24 22:54:58 localhost setroubleshoot[73363]: SELinux is preventing /usr/lib/systemd/systemd from read access on the lnk_file peertube-latest. F                                                                                          or complete SELinux messages run: sealert -l 7f335316-27f0-4850-b797-4a3f74c693c7
Mar 24 22:54:58 localhost setroubleshoot[73363]: SELinux is preventing /usr/lib/systemd/systemd from read access on the lnk_file peertube-latest.#0                                                                                          12#012*****  Plugin catchall (100. confidence) suggests   **************************#012#012If you believe that systemd should be allowed read acce                                                                                          ss on the peertube-latest lnk_file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this acc                                                                                          ess.#012Do#012allow this access for now by executing:#012# ausearch -c '(node)' --raw | audit2allow -M my-node#012# semodule -X 300 -i my-node.pp#0                                                                                          12
Mar 24 22:55:23 localhost setroubleshoot[73405]: SELinux is preventing /usr/lib/systemd/systemd from read access on the lnk_file peertube-latest. F                                                                                          or complete SELinux messages run: sealert -l 7f335316-27f0-4850-b797-4a3f74c693c7
Mar 24 22:55:23 localhost setroubleshoot[73405]: SELinux is preventing /usr/lib/systemd/systemd from read access on the lnk_file peertube-latest.#0                                                                                          12#012*****  Plugin catchall (100. confidence) suggests   **************************#012#012If you believe that systemd should be allowed read acce                                                                                          ss on the peertube-latest lnk_file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this acc                                                                                          ess.#012Do#012allow this access for now by executing:#012# ausearch -c '(node)' --raw | audit2allow -M my-node#012# semodule -X 300 -i my-node.pp#0                                                                                          12

Mar 24 22:59:01 localhost systemd[73470]: peertube.service: Changing to the requested working directory failed: Permission denied
Mar 24 22:59:01 localhost systemd[73470]: peertube.service: Failed at step CHDIR spawning /usr/bin/npm: Permission denied
Mar 24 22:59:01 localhost systemd[1]: peertube.service: Main process exited, code=exited, status=200/CHDIR
Mar 24 22:59:01 localhost systemd[1]: peertube.service: Failed with result 'exit-code'.
Mar 24 22:59:02 localhost systemd[1]: peertube.service: Service RestartSec=100ms expired, scheduling restart.
Mar 24 22:59:02 localhost systemd[1]: peertube.service: Scheduled restart job, restart counter is at 1.
Mar 24 22:59:02 localhost systemd[73472]: peertube.service: Changing to the requested working directory failed: Permission denied
Mar 24 22:59:02 localhost systemd[73472]: peertube.service: Failed at step CHDIR spawning /usr/bin/npm: Permission denied
Mar 24 22:59:02 localhost systemd[1]: peertube.service: Main process exited, code=exited, status=200/CHDIR
Mar 24 22:59:02 localhost systemd[1]: peertube.service: Failed with result 'exit-code'.
Mar 24 22:59:02 localhost systemd[1]: peertube.service: Service RestartSec=100ms expired, scheduling restart.
Mar 24 22:59:02 localhost systemd[1]: peertube.service: Scheduled restart job, restart counter is at 2.
Mar 24 22:59:02 localhost systemd[73476]: peertube.service: Changing to the requested working directory failed: Permission denied
Mar 24 22:59:02 localhost systemd[73476]: peertube.service: Failed at step CHDIR spawning /usr/bin/npm: Permission denied
Mar 24 22:59:02 localhost systemd[1]: peertube.service: Main process exited, code=exited, status=200/CHDIR
Mar 24 22:59:02 localhost systemd[1]: peertube.service: Failed with result 'exit-code'.
Mar 24 22:59:02 localhost systemd[1]: peertube.service: Service RestartSec=100ms expired, scheduling restart.
Mar 24 22:59:02 localhost systemd[1]: peertube.service: Scheduled restart job, restart counter is at 3.
Mar 24 22:59:02 localhost systemd[73480]: peertube.service: Changing to the requested working directory failed: Permission denied
Mar 24 22:59:02 localhost systemd[73480]: peertube.service: Failed at step CHDIR spawning /usr/bin/npm: Permission denied
Mar 24 22:59:02 localhost systemd[1]: peertube.service: Main process exited, code=exited, status=200/CHDIR
Mar 24 22:59:02 localhost systemd[1]: peertube.service: Failed with result 'exit-code'.
Mar 24 22:59:03 localhost systemd[1]: peertube.service: Service RestartSec=100ms expired, scheduling restart.
Mar 24 22:59:03 localhost systemd[1]: peertube.service: Scheduled restart job, restart counter is at 4.
Mar 24 22:59:03 localhost systemd[73482]: peertube.service: Changing to the requested working directory failed: Permission denied
Mar 24 22:59:03 localhost systemd[73482]: peertube.service: Failed at step CHDIR spawning /usr/bin/npm: Permission denied
Mar 24 22:59:03 localhost systemd[1]: peertube.service: Main process exited, code=exited, status=200/CHDIR
Mar 24 22:59:03 localhost systemd[1]: peertube.service: Failed with result 'exit-code'.
Mar 24 22:59:03 localhost systemd[1]: peertube.service: Service RestartSec=100ms expired, scheduling restart.
Mar 24 22:59:03 localhost systemd[1]: peertube.service: Scheduled restart job, restart counter is at 5.
Mar 24 22:59:03 localhost systemd[1]: peertube.service: Start request repeated too quickly.
Mar 24 22:59:03 localhost systemd[1]: peertube.service: Failed with result 'exit-code'.
Mar 24 22:59:04 localhost setroubleshoot[73474]: SELinux is preventing /usr/lib/systemd/systemd from read access on the lnk_file peertube-latest. F                                                                                          or complete SELinux messages run: sealert -l 7f335316-27f0-4850-b797-4a3f74c693c7

Mar 24 22:59:59 localhost setroubleshoot[73580]: SELinux is preventing /usr/lib/systemd/systemd from read access on the lnk_file peertube-latest.#0                                                                                          12#012*****  Plugin catchall (100. confidence) suggests   **************************#012#012If you believe that systemd should be allowed read acce                                                                                          ss on the peertube-latest lnk_file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this acc                                                                                          ess.#012Do#012allow this access for now by executing:#012# ausearch -c '(node)' --raw | audit2allow -M my-node#012# semodule -X 300 -i my-node.pp#0                                                                                          12
Mar 24 22:59:59 localhost setroubleshoot[73580]: SELinux is preventing /usr/lib/systemd/systemd from read access on the lnk_file peertube-latest. F                                                                                          or complete SELinux messages run: sealert -l 7f335316-27f0-4850-b797-4a3f74c693c7
Mar 24 22:59:59 localhost setroubleshoot[73580]: SELinux is preventing /usr/lib/systemd/systemd from read access on the lnk_file peertube-latest.#0                                                                                          12#012*****  Plugin catchall (100. confidence) suggests   **************************#012#012If you believe that systemd should be allowed read acce                                                                                          ss on the peertube-latest lnk_file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this acc                                                                                          ess.#012Do#012allow this access for now by executing:#012# ausearch -c '(node)' --raw | audit2allow -M my-node#012# semodule -X 300 -i my-node.pp#0                                                                                          12
Mar 24 22:59:59 localhost setroubleshoot[73580]: SELinux is preventing /usr/lib/systemd/systemd from read access on the lnk_file peertube-latest. F                                                                                          or complete SELinux messages run: sealert -l 7f335316-27f0-4850-b797-4a3f74c693c7
Mar 24 22:59:59 localhost setroubleshoot[73580]: SELinux is preventing /usr/lib/systemd/systemd from read access on the lnk_file peertube-latest.#0                                                                                          12#012*****  Plugin catchall (100. confidence) suggests   **************************#012#012If you believe that systemd should be allowed read acce                                                                                          ss on the peertube-latest lnk_file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this acc                                                                                          ess.#012Do#012allow this access for now by executing:#012# ausearch -c '(node)' --raw | audit2allow -M my-node#012# semodule -X 300 -i my-node.pp#0                                                                                          12
Mar 24 23:00:01 localhost setroubleshoot[73580]: SELinux is preventing /usr/lib/systemd/systemd from read access on the lnk_file peertube-latest. F                                                                                          or complete SELinux messages run: sealert -l 7f335316-27f0-4850-b797-4a3f74c693c7
Mar 24 23:00:01 localhost setroubleshoot[73580]: SELinux is preventing /usr/lib/systemd/systemd from read access on the lnk_file peertube-latest.#0                                                                                          12#012*****  Plugin catchall (100. confidence) suggests   **************************#012#012If you believe that systemd should be allowed read acce                                                                                          ss on the peertube-latest lnk_file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this acc                                                                                          ess.#012Do#012allow this access for now by executing:#012# ausearch -c '(node)' --raw | audit2allow -M my-node#012# semodule -X 300 -i my-node.pp#0                                                                                          12
Mar 24 23:00:01 localhost setroubleshoot[73580]: SELinux is preventing /usr/lib/systemd/systemd from read access on the lnk_file peertube-latest. F                                                                                          or complete SELinux messages run: sealert -l 7f335316-27f0-4850-b797-4a3f74c693c7
Mar 24 23:00:01 localhost setroubleshoot[73580]: SELinux is preventing /usr/lib/systemd/systemd from read access on the lnk_file peertube-latest.#0                                                                                          12#012*****  Plugin catchall (100. confidence) suggests   **************************#012#012If you believe that systemd should be allowed read acce                                                                                          ss on the peertube-latest lnk_file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this acc                                                                                          ess.#012Do#012allow this access for now by executing:#012# ausearch -c '(node)' --raw | audit2allow -M my-node#012# semodule -X 300 -i my-node.pp#0                                                                                          12

drwxrwxr-x  2 peertube peertube 4096 Feb 17 10:31 config
lrwxrwxrwx  1 peertube peertube   24 Feb 17 09:44 peertube-latest -> versions/peertube-v4.0.0
drwxrwxr-x 15 peertube peertube 4096 Mar 11 01:12 storage
drwxr-xr-x  3 peertube peertube 4096 Feb 17 09:43 versions