actual syslogize path

https://security.alpinelinux.org/vuln/CVE-2022-28391

.woodpecker.yml

@@ -1,7 +1,9 @@
 pipeline:
   publish:
     image: plugins/docker
+    settings:
       registry: registry.nulo.in
+      username: sutty
       repo: registry.nulo.in/sutty/syncthing
       tags:
       - ${ALPINE_VERSION}
@@ -9,14 +11,14 @@ pipeline:
       build_args:
       - ALPINE_VERSION=${ALPINE_VERSION}
       - BASE_IMAGE=registry.nulo.in/sutty/monit
-    username: sutty
     secrets:
     - docker_password
     when:
       branch: antifascista
       event: push
-
 matrix:
   ALPINE_VERSION:
-  - 3.13.6
-  - 3.14.2
+  - 3.16.2
+  - 3.15.6
+  - 3.14.8
+  - 3.13.12

Dockerfile

@@ -3,21 +3,15 @@ ARG BASE_IMAGE=sutty/monit
 FROM ${BASE_IMAGE}:${ALPINE_VERSION}
 MAINTAINER "f <f@sutty.nl>"
 
-COPY ./syncthing_start.sh /usr/local/bin/syncthing_start
-RUN chmod 755 /usr/local/bin/syncthing_start
-
-FROM ${BASE_IMAGE}:${ALPINE_VERSION}
-ARG ALPINE_VERSION
-
 # Syncthing runs with Sutty's uid and gid so ownership is kept, because
 # they are not synced.
-RUN addgroup -g 82 -S syncthing
-RUN adduser -s /bin/sh -G syncthing -D -u 1000 -h /home/syncthing syncthing
+RUN getent group 82 || addgroup -g 82 -S www-data
+RUN adduser -s /bin/sh -G www-data -D -u 1000 -h /home/syncthing syncthing
 
 RUN apk add --no-cache ca-certificates daemonize syncthing
 
 COPY ./monit.conf /etc/monit.d/syncthing.conf
-COPY --from=build /usr/local/bin/syncthing_start /usr/local/bin/syncthing_start
+COPY ./syncthingd.sh /usr/local/bin/syncthingd
 
 EXPOSE 22000
 EXPOSE 22000/udp

monit.conf

@@ -1,3 +1,6 @@
 check process syncthing with pidfile /tmp/syncthing.pid
-  start program = "/usr/local/bin/syncthing_start"
-  stop program = "/bin/sh -c 'cat /tmp/syncthing.pid | xargs kill'"
+  start program = "/usr/local/bin/syncthingd start"
+  stop program = "/usr/local/bin/syncthingd stop"
+
+check filesystem root with path /home/syncthing/Sync
+  if space usage < 2% then alert

syncthing_start.sh

@@ -1,13 +0,0 @@
-#!/bin/sh
-
-pid=/tmp/syncthing.pid
-dir=/home/syncthing
-log=${dir}/syncthing.log
-
-rm -f ${pid}
-
-install -dm 2750 -o syncthing -g syncthing ${dir}/Sync/.stfolder
-
-daemonize -p ${pid} -l ${pid} -u syncthing -c ${dir} \
-  -o ${log} -a -e ${log} \
-  /usr/bin/syncthing -no-browser -gui-address='http://0.0.0.0:8443'

syncthingd.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+pid=/tmp/syncthing.pid
+dir=/home/syncthing
+
+case $1 in
+  start)
+    install -dm 2750 -o syncthing -g syncthing ${dir}/Sync/.stfolder
+
+    daemonize -p ${pid} -l ${pid} -u syncthing -c ${dir} \
+      /usr/local/bin/syslogize \
+      /usr/bin/syncthing serve \
+        --gui-address=http://[::]:8384 \
+        --no-browser \
+        --no-restart \
+        --no-upgrade \
+        --unpaused
+    ;;
+  stop)
+    test ! -f $pid || cat ${pid} | xargs -r kill
+    rm -f ${pid}
+    ;;
+esac