Apply systemd restrictions to echobot

These options are suggested by
`systemd-analyze security echobot.service`

CHANGELOG.md

@@ -2,9 +2,6 @@
 
 ## untagged 
 
-- Run chatmail-metadata and doveauth as vmail
-  ([#261](https://github.com/deltachat/chatmail/pull/261))
-
 - Apply systemd restrictions to echobot
   ([#259](https://github.com/deltachat/chatmail/pull/259))
 

cmdeploy/src/cmdeploy/__init__.py

@@ -478,11 +478,6 @@ def deploy_chatmail(config_path: Path) -> None:
         system=True,
     )
 
-    server.shell(
-        name="Fix file owner in /home/vmail",
-        commands=["test -d /home/vmail && chown -R vmail:vmail /home/vmail"],
-    )
-
     apt.update(name="apt update", cache_time=24 * 3600)
 
     apt.packages(

cmdeploy/src/cmdeploy/service/chatmail-metadata.service.f

@@ -5,43 +5,6 @@ Description=Chatmail dict proxy for IMAP METADATA
 ExecStart={execpath} /run/dovecot/metadata.socket vmail /home/vmail/mail/{mail_domain}
 Restart=always
 RestartSec=30
-User=vmail
-
-# Make `systemd-analyze security` happy.
-CapabilityBoundingSet=
-LockPersonality=true
-MemoryDenyWriteExecute=true
-NoNewPrivileges=true
-PrivateDevices=true
-PrivateMounts=true
-PrivateTmp=true
-PrivateUsers=true
-ProtectClock=true
-ProtectControlGroups=true
-ProtectHostname=true
-ProtectKernelLogs=true
-ProtectKernelModules=true
-ProtectKernelTunables=true
-ProtectProc=noaccess
-ProtectSystem=strict
-RemoveIPC=true
-RestrictAddressFamilies=AF_UNIX
-RestrictNamespaces=true
-RestrictRealtime=true
-RestrictSUIDSGID=true
-SystemCallArchitectures=native
-SystemCallFilter=~@clock
-SystemCallFilter=~@cpu-emulation
-SystemCallFilter=~@debug
-SystemCallFilter=~@module
-SystemCallFilter=~@mount
-SystemCallFilter=~@obsolete
-SystemCallFilter=~@privileged
-SystemCallFilter=~@raw-io
-SystemCallFilter=~@reboot
-SystemCallFilter=~@resources
-SystemCallFilter=~@swap
-UMask=0077
 
 [Install]
 WantedBy=multi-user.target

cmdeploy/src/cmdeploy/service/doveauth.service.f

@@ -5,7 +5,6 @@ Description=Chatmail dict authentication proxy for dovecot
 ExecStart={execpath} /run/dovecot/doveauth.socket vmail /home/vmail/passdb.sqlite {config_path}
 Restart=always
 RestartSec=30
-User=vmail
 
 [Install]
 WantedBy=multi-user.target