Restricted permissions for service files

roles/server/firefox-sync/tasks/main.yml

@@ -47,6 +47,9 @@
   template:
     src: "firefox.socket"
     dest: "{{ global_systemd_configuration_directory }}/{{ socket_name }}"
+    owner: root
+    group: root
+    mode: "u=rw,g=r,o="
   notify:
     - reload systemd
     - restart firefox-sync
@@ -55,6 +58,9 @@
   template:
     src: "firefox.service"
     dest: "{{ global_systemd_configuration_directory }}/{{ service_name }}"
+    owner: root
+    group: root
+    mode: "u=rw,g=r,o="
   notify:
     - reload systemd
     - restart firefox-sync

roles/server/gitea/tasks/main.yml

@@ -76,6 +76,9 @@
   template:
     src: "gitea.service"
     dest: "{{ global_systemd_configuration_directory }}/{{ gitea_service_name }}"
+    owner: root
+    group: root
+    mode: "u=rw,g=r,o="
   notify:
     - reload systemd
     - restart gitea

roles/server/node/tasks/main.yml

@@ -11,4 +11,7 @@
   template:
     src: node.service
     dest: "{{ global_systemd_configuration_directory }}/{{ service_name }}"
+    owner: root
+    group: root
+    mode: "u=rw,g=r,o="
   notify: "restart {{ domain }}"

roles/server/spotme/tasks/main.yml

@@ -92,4 +92,7 @@
   template:
     src: spotme.service
     dest: "{{ global_systemd_configuration_directory }}/{{ spotme_service_name }}"
+    owner: root
+    group: root
+    mode: "u=rw,g=r,o="
   notify: restart spotme