From 1cb03c35d2a50b6b8d33849788322ebca458d746 Mon Sep 17 00:00:00 2001
From: jo <ljonas@riseup.net>
Date: Wed, 6 Jul 2022 14:21:55 +0200
Subject: [PATCH] feat(api): listen on unix socket with gunicorn

---
 api/install/systemd/libretime-api.service |  3 ++-
 api/install/systemd/libretime-api.socket  | 11 +++++++++++
 install                                   |  6 ++++--
 installer/nginx/libretime.conf            |  2 +-
 4 files changed, 18 insertions(+), 4 deletions(-)
 create mode 100644 api/install/systemd/libretime-api.socket

diff --git a/api/install/systemd/libretime-api.service b/api/install/systemd/libretime-api.service
index 6ac548408..6b3e38ad7 100644
--- a/api/install/systemd/libretime-api.service
+++ b/api/install/systemd/libretime-api.service
@@ -1,5 +1,6 @@
 [Unit]
 Description=LibreTime API Service
+Requires=libretime-api.socket
 PartOf=libretime.target
 
 [Service]
@@ -13,7 +14,7 @@ Environment=LIBRETIME_CONFIG_FILEPATH=@@CONFIG_FILEPATH@@
 ExecStart=/usr/bin/gunicorn \
         --workers 4 \
         --log-file - \
-        --bind 127.0.0.1:8081 \
+        --bind unix:/run/libretime-api.sock \
         libretime_api.wsgi
 ExecReload=/bin/kill -s HUP $MAINPID
 User=libretime
diff --git a/api/install/systemd/libretime-api.socket b/api/install/systemd/libretime-api.socket
new file mode 100644
index 000000000..c145d5bd1
--- /dev/null
+++ b/api/install/systemd/libretime-api.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=LibreTime API Socket
+PartOf=libretime-api.service
+
+[Socket]
+ListenStream=/run/libretime-api.sock
+SocketUser=@@DEFAULT_WEB_USER@@
+SocketMode=640
+
+[Install]
+WantedBy=sockets.target
diff --git a/install b/install
index 8b0d25993..f1b79fb3d 100755
--- a/install
+++ b/install
@@ -274,8 +274,9 @@ install_service() {
 
   template_file "$service_src" "$service_dest" \
     sed \
-      -e "s|User=.*|User=${LIBRETIME_USER}|" \
-      -e "s|Group=.*|Group=${LIBRETIME_USER}|" \
+      -e "s|^User=.*|User=${LIBRETIME_USER}|" \
+      -e "s|^Group=.*|Group=${LIBRETIME_USER}|" \
+      -e "s|@@DEFAULT_WEB_USER@@|${DEFAULT_WEB_USER}|g" \
       -e "s|@@CONFIG_DIR@@|${CONFIG_DIR}|g" \
       -e "s|@@CONFIG_FILEPATH@@|${CONFIG_FILEPATH}|g" \
       -e "s|@@LOG_DIR@@|${LOG_DIR}|g" \
@@ -555,6 +556,7 @@ install_packages $(list_packages "$SCRIPT_DIR/api")
 install_python_app "$SCRIPT_DIR/api[prod]"
 
 install_service "libretime-api.service" "$SCRIPT_DIR/api/install/systemd/libretime-api.service"
+install_service "libretime-api.socket" "$SCRIPT_DIR/api/install/systemd/libretime-api.socket"
 
 # Install Playout
 ########################################################################################
diff --git a/installer/nginx/libretime.conf b/installer/nginx/libretime.conf
index 2813ec480..b61e8dbb1 100644
--- a/installer/nginx/libretime.conf
+++ b/installer/nginx/libretime.conf
@@ -37,6 +37,6 @@ server {
   location ~ ^/(api/v2|api-auth) {
     include proxy_params;
     proxy_redirect off;
-    proxy_pass http://127.0.0.1:8081;
+    proxy_pass http://unix:/run/libretime-api.sock;
   }
 }