From 0a7df0f86c6ca8330b354458d5359d1d971a02ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Manuel=20V=C3=B6gele?= <develop@manuel-voegele.de>
Date: Wed, 28 Jul 2021 12:31:46 +0200
Subject: [PATCH] Add telegram amplifier bot

---
 telegram-bot-amplifier/PKGBUILD               | 34 +++++++++++++++
 telegram-bot-amplifier/sysusers.d             |  1 +
 .../telegram-bot-amplifier.service            | 41 +++++++++++++++++++
 3 files changed, 76 insertions(+)
 create mode 100644 telegram-bot-amplifier/PKGBUILD
 create mode 100644 telegram-bot-amplifier/sysusers.d
 create mode 100644 telegram-bot-amplifier/telegram-bot-amplifier.service

diff --git a/telegram-bot-amplifier/PKGBUILD b/telegram-bot-amplifier/PKGBUILD
new file mode 100644
index 0000000..9bf007f
--- /dev/null
+++ b/telegram-bot-amplifier/PKGBUILD
@@ -0,0 +1,34 @@
+# Maintainer: Manuel Vögele <aur@manuel-voegele.de>
+pkgname=telegram-amplifier-bot-git
+pkgver=r2.5285eac
+pkgrel=1
+
+arch=('any')
+makedepends=(
+	'git'
+	'cargo'
+)
+source=(
+	'git+ssh://gitea@git.ccn.li/manuel/telegram-bot-amplifier.git'
+	'telegram-bot-amplifier.service'
+	'sysusers.d'
+)
+sha256sums=('SKIP'
+            '0338604f8d793e209d7744d96c4c07dcbd90e06218a7d1d17a6e5611bf48fd07'
+            '128feac33a68097960d3690827c816777482a2ec5b5947a0bcd7a25bdbb93b54')
+
+pkgver() {
+	cd "${srcdir}/telegram-bot-amplifier"
+	printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
+}
+
+build() {
+	cd "${srcdir}/telegram-bot-amplifier"
+	cargo build --release
+}
+
+package() {
+	install -Dm755 "${srcdir}/telegram-bot-amplifier/target/release/amplifier-bot" "${pkgdir}/usr/bin/amplifier-bot"
+	install -Dm644 "${srcdir}/telegram-bot-amplifier.service" "${pkgdir}/usr/lib/systemd/system/telegram-bot-amplifier.service"
+	install -Dm644 "${srcdir}/sysusers.d" "${pkgdir}/usr/lib/sysusers.d/telegram-bot-amplifier.conf"
+}
diff --git a/telegram-bot-amplifier/sysusers.d b/telegram-bot-amplifier/sysusers.d
new file mode 100644
index 0000000..3638881
--- /dev/null
+++ b/telegram-bot-amplifier/sysusers.d
@@ -0,0 +1 @@
+u telegram-bots - "Unprivileged user for running telegram bots"
diff --git a/telegram-bot-amplifier/telegram-bot-amplifier.service b/telegram-bot-amplifier/telegram-bot-amplifier.service
new file mode 100644
index 0000000..2064c0e
--- /dev/null
+++ b/telegram-bot-amplifier/telegram-bot-amplifier.service
@@ -0,0 +1,41 @@
+[Unit]
+After=network-online.target
+
+[Service]
+User=telegram-bots
+Environment=RUST_LOG=info
+Environment=AMPLIFIER_BOT_CONFIG_FILE=/etc/telegram-bot-amplifier.json
+ExecStart=/usr/bin/amplifier-bot
+
+Restart=on-failure
+RestartSec=5s
+
+ReadOnlyPaths=/etc/telegram-bot-amplifier.json
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+PrivateUsers=yes
+PrivateMounts=yes
+DevicePolicy=closed
+ProtectSystem=strict
+ProtectHome=yes
+ProtectClock=yes
+ProtectHostname=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK
+CapabilityBoundingSet=
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+ProtectKernelLogs=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+MemoryDenyWriteExecute=yes
+LockPersonality=yes
+RemoveIPC=yes
+
+
+[Install]
+WantedBy=multi-user.target