Configuration and cli example

config/nginx.txt

@@ -1,5 +1,11 @@
 server {
+    listen 443 http2;
     server_name paste.plabble.org;
+    access_log /var/log/nginx/access.log;
+    
+	ssl_early_data on;
+    include certs/plabble.org/config.conf;
+
     location / {
         proxy_pass  http://127.0.0.1:8080;
     }

config/openrc.sh

@@ -1,11 +1,19 @@
 #!/sbin/openrc-run
-# Copyright 2022 Plabble
+
+depend() { need sysfs cgroups; }
 
 start() {
-    podman rm pastabble-c || true
-    podman run --name pastabble-c -p 8080:8080 -v pastabble-v:/data -dt pastabble
+    su podman -c 'podman rm pastabble-c' || true
+	su podman -c 'podman run \
+	--name pastabble-c -d \
+	--read-only \
+    --cap-drop ALL \
+	--security-opt=no-new-privileges \
+	-p 127.0.0.1:8080:8080 \
+	-v pastabble-v:/app/data \
+	pastabble'
 }
 
 stop() {
-    podman stop pastabble-c
+    su podman -c 'podman stop pastabble' || true
 }