Update service & port used

files/config.json.j2

@@ -20,7 +20,7 @@
     "production": {
         "domain" : "{{ service_hedgedocs_domain }}",
         "host" : "localhost",
-        "port" : 3000,
+        "port" : 3003,
         "protocolUseSSL" : true,
         "useSSL" : false,
         "urlAddPort" : false,

files/etc/nginx/hedgedocs-nginx.conf.j2

@@ -9,7 +9,7 @@ server {
     server_name {{ service_hedgedocs_domain }};
 
     location / {
-            proxy_pass http://127.0.0.1:3000;
+            proxy_pass http://127.0.0.1:3003;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -17,7 +17,7 @@ server {
     }
 
     location /socket.io/ {
-            proxy_pass http://127.0.0.1:3000;
+            proxy_pass http://127.0.0.1:3003;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

files/hedgedocs.service

 # {{ ansible_managed }}
 
 [Unit]
-Description=HedgeDocs collaborative markdown notes
-Documentation=https://github.com/hedgedoc/hedgedoc/
+Description=HedgeDoc - The best platform to write and share markdown.
+Documentation=https://docs.hedgedoc.org/
 After=network.target
+# Uncomment if you use MariaDB/MySQL
+# After=mysql.service
+# Uncomment if you use PostgreSQL
 After=postgresql.service
 
-
 [Service]
 Type=exec
-RestartSec=2s
-User=hedgedocs
-Group=www-data
-# the location you cloned CodiMD to.
-# This is relative to the home of the hedgedocs user : https://www.freedesktop.org/software/systemd/man/systemd.exec.html
-WorkingDirectory=/home/hedgedocs/hedgedoc/
-ExecStart=npm start --production
+Environment=NODE_ENV=production
 Restart=always
-PrivateTmp=true
+RestartSec=2s
+ExecStart=/usr/bin/yarn start --production
+CapabilityBoundingSet=
+NoNewPrivileges=true
 PrivateDevices=true
+RemoveIPC=true
+LockPersonality=true
+ProtectControlGroups=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectClock=true
+ProtectHostname=true
+ProtectProc=noaccess
+RestrictRealtime=true
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+
+# You may have to adjust these settings
+User=hedgedocs
+Group=hedgedocs
+WorkingDirectory=/home/hedgedocs/hedgedoc
+
+# Example: local storage for uploads and SQLite
+# ReadWritePaths=/home/hedgedocs/hedgedoc/public/uploads /home/hedgedocs/hedgedoc/db
 
 [Install]
 WantedBy=multi-user.target