Linux (without Docker)¶
Each release has a self-contained download for x64 and arm64: the server with everything it needs built in. No .NET, Node or database server to install.
Install as a service¶
On any systemd distribution (Debian, Ubuntu, Fedora, Arch, ...):
ARCH=x64 # or arm64
BASE=https://gitlab.com/killswitch10/punchlist/-/releases/permalink/latest/downloads
curl -LO "$BASE/punchlist-linux-$ARCH.tar.gz"
curl -LO "$BASE/SHA256SUMS"
sha256sum --check --ignore-missing SHA256SUMS
tar -xzf "punchlist-linux-$ARCH.tar.gz"
sudo "punchlist-linux-$ARCH/examples/install.sh"
sudo journalctl -u punchlist # the first admin password, printed once
That takes the newest release. For a particular one, download the files from its release page instead.
The install script:
| Path | What | On upgrade |
|---|---|---|
/opt/punchlist |
The program | Replaced |
/etc/punchlist/punchlist.conf |
Your settings (settings file) | Kept |
/var/lib/punchlist |
Database, snapshots, logs | Kept |
/etc/systemd/system/punchlist.service |
The service | Replaced |
It makes a punchlist system user, and the service runs as that user with systemd's sandboxing on:
it can write only /var/lib/punchlist.
# systemd unit for the native Linux download. install.sh puts it in place; by hand:
# sudo cp punchlist.service /etc/systemd/system/ && sudo systemctl daemon-reload
# sudo systemctl enable --now punchlist
# journalctl -u punchlist # the first admin password is printed here, once
# Settings: /etc/punchlist/punchlist.conf (CONFIG_FILE). Docs: docs/install/linux.md
[Unit]
Description=Punchlist tasks and calendar
Documentation=https://gitlab.com/killswitch10/punchlist/-/tree/main/docs
After=network-online.target
Wants=network-online.target
[Service]
# The server tells systemd when it is ready (and when it stops).
Type=notify
User=punchlist
Group=punchlist
WorkingDirectory=/var/lib/punchlist
ExecStart=/opt/punchlist/punchlist
Restart=on-failure
RestartSec=5
Environment=ASPNETCORE_HTTP_PORTS=8080
Environment=DB_PATH=/var/lib/punchlist/punchlist.db
Environment=CONFIG_FILE=/etc/punchlist/punchlist.conf
# Logs go to the journal; the JSON log files stay off unless you want both.
Environment=LOG_FILES=false
# Hardening: the server only writes its own data folder.
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
ReadWritePaths=/var/lib/punchlist
[Install]
WantedBy=multi-user.target
The server listens on port 8080 on all addresses. Put it behind a reverse proxy for HTTPS, or change the port with an override:
Day to day¶
sudo systemctl status punchlist
sudo journalctl -u punchlist -f # logs
sudo systemctl restart punchlist # after editing /etc/punchlist/punchlist.conf
sudo -u punchlist env DB_PATH=/var/lib/punchlist/punchlist.db CONFIG_FILE=/etc/punchlist/punchlist.conf \
/opt/punchlist/punchlist snapshot # any CLI command, as the service user
The CLI must see the same DB_PATH (and CONFIG_FILE) as the service. A small wrapper saves
typing:
sudo tee /usr/local/bin/punchlist >/dev/null <<'EOF'
#!/bin/sh
exec sudo -u punchlist env DB_PATH=/var/lib/punchlist/punchlist.db \
CONFIG_FILE=/etc/punchlist/punchlist.conf /opt/punchlist/punchlist "$@"
EOF
sudo chmod +x /usr/local/bin/punchlist
punchlist --version
Upgrade¶
Run the newer download's install.sh the same way. It stops the service, swaps the program and
starts it again; the database is upgraded on start. Read upgrading first.
Run it by hand¶
No systemd, or just trying it? The program runs from the unpacked folder:
Without DB_PATH, the data goes to ./data in the current folder.