Add stryfry policy option

attributes/default.rb

@@ -8,3 +8,4 @@ node.default["strfry"]["db_path"] = "/var/lib/strfry"
 node.default["strfry"]["bind_ip"] = "0.0.0.0"
 node.default["strfry"]["real_ip_header"] = ""
 node.default["strfry"]["info"] = {}
+node.default["strfry"]["policy_path"] = ""

recipes/default.rb

@@ -40,7 +40,7 @@ else
   execute "compile" do
     cwd "/usr/local/src/strfry"
     command "make setup-golpe && make -j$(nproc)"
-    # action :nothing
+    action :nothing
     notifies :create, "link[/usr/local/bin/strfry]", :immediately
     notifies :restart, "service[strfry]", :delayed
   end
@@ -55,8 +55,8 @@ group node["strfry"]["group"]
 
 user node["strfry"]["user"] do
   gid node["strfry"]["group"]
-  manage_home false
-  shell "/usr/sbin/nologin"
+  manage_home true
+  shell "/bin/bash"
 end
 
 directory node["strfry"]["db_path"] do
@@ -75,7 +75,9 @@ template "/etc/strfry.conf" do
     bind: node["strfry"]["bind_ip"],
     real_ip_header: node["strfry"]["real_ip_header"],
     port: node["strfry"]["port"],
-    info: node["strfry"]["info"]
+    nofiles: node["strfry"]["nofiles"],
+    info: node["strfry"]["info"],
+    policy_path: node["strfry"]["policy_path"]
   }
   notifies :restart, "service[strfry]", :delayed
 end
@@ -96,7 +98,7 @@ systemd_unit "strfry.service" do
       ExecStart: "/usr/local/bin/strfry relay",
       Restart: "on-failure",
       RestartSec: "5",
-      ProtectHome: "yes",
+      ProtectHome: "no",
       NoNewPrivileges: "yes",
       ProtectSystem: "full",
       LimitCORE: "1000000000"

templates/default/strfry.conf.erb

@@ -43,7 +43,7 @@ relay {
     port = <%= @config[:port] || "7777" %>
 
     # Set OS-limit on maximum number of open files/sockets (if 0, don't attempt to set) (restart required)
-    nofiles = 1000000
+    nofiles = <%= @config[:nofiles] || "524288" %>
 
     # HTTP header that contains the client's real IP, before reverse proxying (ie x-real-ip) (MUST be all lower-case)
     realIpHeader = "<%= @config[:real_ip_header] %>"
@@ -82,7 +82,7 @@ relay {
 
     writePolicy {
         # If non-empty, path to an executable script that implements the writePolicy plugin logic
-        plugin = ""
+        plugin = "<%= @config[:policy_path] %>"
     }
 
     compression {