From f66d91036212d7284f82022d7620b01f737a8f86 Mon Sep 17 00:00:00 2001 From: msnie Date: Fri, 31 Jan 2025 20:06:26 +0100 Subject: [PATCH] mastodon --- mastodon/.env.production | 55 ++++++ mastodon/docker-compose copy.yml | 281 +++++++++++++++++++++++++++++++ mastodon/docker-compose.yml | 257 +++++----------------------- 3 files changed, 377 insertions(+), 216 deletions(-) create mode 100644 mastodon/docker-compose copy.yml diff --git a/mastodon/.env.production b/mastodon/.env.production index e69de29..0a9ab3e 100644 --- a/mastodon/.env.production +++ b/mastodon/.env.production @@ -0,0 +1,55 @@ +LOCAL_DOMAIN=kvist.knast.cc + +# Redis +# ----- +REDIS_HOST=redis +REDIS_PORT=6379 + +# PostgreSQL +# ---------- +DB_HOST=db +DB_USER=postgres +DB_NAME=mastodon_production +DB_PASS= +DB_PORT=5432 + +# Secrets +# ------- +# Generate each with the `RAILS_ENV=production bundle exec rake secret` task (`docker-compose run --rm web bundle exec rake secret` if you use docker compose) +# ------- +SECRET_KEY_BASE=29e52e5bd23fdeab4676ef27eafcac36b3db9a5842ec9e50910f78c350ac4c1d3d722003ab473936d67d68bc6c5702174effda71d94e27cdaea049d4c6958eb8 +OTP_SECRET=48cb26b4254c56457e9279b877a11d9e43f9e8e4b63875f80390bfe132597bb61ea405c040a4ff1b16736290c40a9efc166986eb2502c00f77527c6ff22f5b9f +VAPID_PRIVATE_KEY=4da48ca5d54eb6222db3971d446dc9ad5d372ae6555c85b5221ceb56a88248f10977a1c00809a101d1bfcd6cb34aedaeee6fb471deb78912327c143f108f38d2 +VAPID_PUBLIC_KEY=24923f2e2296745137e79deb1bdaecf221406278ae7ebebd1c5d583cacb2455a5713c726dbdd107ef4b4c0ab52040b0d9c08af69cc5f75391b0cac49ea313b40 + +# Registrations +# ------------- +# Single user mode will disable registrations and redirect frontpage to the first profile +SINGLE_USER_MODE=true + +# Sending mail +# ------------ +SMTP_SERVER=email-smtp.ca-central-1.amazonaws.com +SMTP_PORT=587 +SMTP_LOGIN=........ +SMTP_PASSWORD=........ +SMTP_OPENSSL_VERIFY_MODE=none +SMTP_ENABLE_STARTTLS=auto +SMTP_FROM_ADDRESS=mastodon@kvist.knast.cc + +# Custom settings +# --------------- +MAX_TOOT_CHARS=1000 +MAX_PINNED_TOOTS=5 +MAX_BIO_CHARS=500 +MAX_PROFILE_FIELDS=4 +MAX_DISPLAY_NAME_CHARS=30 +MAX_POLL_OPTIONS=5 +MAX_POLL_OPTION_CHARS=100 +MAX_IMAGE_SIZE=536870912 +MAX_VIDEO_SIZE=1073741824 + +# IP and session retention +# ----------------------- +IP_RETENTION_PERIOD=31556952 +SESSION_RETENTION_PERIOD=31556952 diff --git a/mastodon/docker-compose copy.yml b/mastodon/docker-compose copy.yml new file mode 100644 index 0000000..798476e --- /dev/null +++ b/mastodon/docker-compose copy.yml @@ -0,0 +1,281 @@ +version: '3' +services: + db: + restart: always + image: postgres:14-alpine + shm_size: 256mb + networks: + - internal_network + volumes: + - /srv/mastodon/postgres14:/var/lib/postgresql/data + # added from the default, otherwise you'll need to manually create a `mastodon` db and user/role + # env_file: db.env + env_file: + - .env + - .env.production + - db.env + environment: + - 'POSTGRES_HOST_AUTH_METHOD=trust' + - 'POSTGRES_USER=postgres' + + redis: + restart: always + image: redis:7-alpine + networks: + - internal_network + env_file: db.env + healthcheck: + test: ['CMD', 'redis-cli', 'ping'] + # environment: + # - 'REDIS_URL=redis://redis:6379' + volumes: + - /srv/mastodon/redis:/data + + web: + image: ghcr.io/mastodon/mastodon:v4.3.3 + restart: always + # env_file: + # - .env + # - db.env + env_file: + - .env + - .env.production + - db.env + ports: + - 3344:3000 + command: bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000" + networks: + - traefik + - internal_network + healthcheck: + # prettier-ignore + test: ['CMD-SHELL', 'wget -q --spider --proxy=off localhost:3000/health || exit 1'] + depends_on: + - db + - redis + volumes: + - /srv/mastodon/web:/mastodon/public/system + labels: + - traefik.enable=true + - traefik.http.routers.mastodonweb.rule=Host(`kvist.knast.cc`) + - traefik.http.routers.mastodonweb.entrypoints=websecure + - traefik.http.routers.mastodonweb.tls.certresolver=letsencr + - traefik.http.services.mastodonweb.loadbalancer.server.port=3344 + + streaming: + image: ghcr.io/mastodon/mastodon-streaming:v4.3.3 + restart: always + # env_file: + # - .env + # - db.env + env_file: + - .env + - .env.production + - db.env + command: node ./streaming + environment: + - 'REDIS_URL=redis://redis:6379' + ports: + - 4433:4000 + networks: + - traefik + - internal_network + healthcheck: + # prettier-ignore + test: ['CMD-SHELL', 'wget -q --spider --proxy=off localhost:4000/api/v1/streaming/health || exit 1'] + depends_on: + - db + - redis + labels: + - traefik.enable=true + - traefik.http.routers.mastodonstreaming.rule=(Host(`kvist.knast.cc`) && PathPrefix(`/api/v1/streaming`)) + - traefik.http.routers.mastodonstreaming.entrypoints=websecure + - traefik.http.routers.mastodonstreaming.tls.certresolver=letsencr + - traefik.http.services.mastodonstreaming.loadbalancer.server.port=4433 + + + sidekiq: + image: ghcr.io/mastodon/mastodon:v4.3.3 + restart: always + env_file: + - .env + - .env.production + - db.env + command: bundle exec sidekiq + depends_on: + - db + - redis + networks: + - traefik + - internal_network + volumes: + - /srv/mastodon/sidekiq:/mastodon/public/system + healthcheck: + test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"] + + +networks: + traefik: + external: true + internal_network: + internal: true + + + + + + # This file is designed for production server deployment, not local development work +# For a containerized local dev environment, see: https://github.com/mastodon/mastodon/blob/main/docs/DEVELOPMENT.md#docker + +# services: +# db: +# restart: always +# image: postgres:14-alpine +# shm_size: 256mb +# networks: +# - internal_network +# healthcheck: +# test: ['CMD', 'pg_isready', '-U', 'postgres'] +# volumes: +# - ./postgres14:/var/lib/postgresql/data +# environment: +# - 'POSTGRES_HOST_AUTH_METHOD=trust' + +# redis: +# restart: always +# image: redis:7-alpine +# networks: +# - internal_network +# healthcheck: +# test: ['CMD', 'redis-cli', 'ping'] +# volumes: +# - ./redis:/data + +# # es: +# # restart: always +# # image: docker.elastic.co/elasticsearch/elasticsearch:7.17.4 +# # environment: +# # - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Des.enforce.bootstrap.checks=true" +# # - "xpack.license.self_generated.type=basic" +# # - "xpack.security.enabled=false" +# # - "xpack.watcher.enabled=false" +# # - "xpack.graph.enabled=false" +# # - "xpack.ml.enabled=false" +# # - "bootstrap.memory_lock=true" +# # - "cluster.name=es-mastodon" +# # - "discovery.type=single-node" +# # - "thread_pool.write.queue_size=1000" +# # networks: +# # - traefik +# # - internal_network +# # healthcheck: +# # test: ["CMD-SHELL", "curl --silent --fail localhost:9200/_cluster/health || exit 1"] +# # volumes: +# # - ./elasticsearch:/usr/share/elasticsearch/data +# # ulimits: +# # memlock: +# # soft: -1 +# # hard: -1 +# # nofile: +# # soft: 65536 +# # hard: 65536 +# # ports: +# # - '127.0.0.1:9200:9200' + +# web: +# # You can uncomment the following line if you want to not use the prebuilt image, for example if you have local code changes +# # build: . +# image: ghcr.io/mastodon/mastodon:v4.3.3 +# restart: always +# env_file: + # - .env + # - .env.production + # - db.env +# command: bundle exec puma -C config/puma.rb +# networks: +# - traefik +# - internal_network +# healthcheck: +# # prettier-ignore +# test: ['CMD-SHELL',"curl -s --noproxy localhost localhost:3000/health | grep -q 'OK' || exit 1"] +# ports: +# - '127.0.0.1:3000:3000' +# depends_on: +# - db +# - redis +# # - es +# volumes: +# - ./public/system:/mastodon/public/system + +# streaming: +# # You can uncomment the following lines if you want to not use the prebuilt image, for example if you have local code changes +# # build: +# # dockerfile: ./streaming/Dockerfile +# # context: . +# image: ghcr.io/mastodon/mastodon-streaming:v4.3.3 +# restart: always +# # env_file: +# - .env +# - .env.production +# - db.env +# command: node ./streaming/index.js +# networks: +# - traefik +# - internal_network +# healthcheck: +# # prettier-ignore +# test: ['CMD-SHELL', "curl -s --noproxy localhost localhost:4000/api/v1/streaming/health | grep -q 'OK' || exit 1"] +# ports: +# - '127.0.0.1:4000:4000' +# depends_on: +# - db +# - redis + +# sidekiq: +# # You can uncomment the following line if you want to not use the prebuilt image, for example if you have local code changes +# # build: . +# image: ghcr.io/mastodon/mastodon:v4.3.3 +# restart: always +# # env_file: +# - .env +# - .env.production +# - db.env +# command: bundle exec sidekiq +# depends_on: +# - db +# - redis +# networks: +# - traefik +# - internal_network +# volumes: +# - ./public/system:/mastodon/public/system +# healthcheck: +# test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"] + +# ## Uncomment to enable federation with tor instances along with adding the following ENV variables +# ## http_hidden_proxy=http://privoxy:8118 +# ## ALLOW_ACCESS_TO_HIDDEN_SERVICE=true +# # tor: +# # image: sirboops/tor +# # networks: +# # - traefik +# # - internal_network +# # +# # privoxy: +# # image: sirboops/privoxy +# # volumes: +# # - ./priv-config:/opt/config +# # networks: +# # - traefik +# # - internal_network + +# networks: +# # traefik: +# traefik: +# external: true +# internal_network: +# internal: true + +# # networks: +# # traefik: +# # external: true diff --git a/mastodon/docker-compose.yml b/mastodon/docker-compose.yml index 798476e..3208883 100644 --- a/mastodon/docker-compose.yml +++ b/mastodon/docker-compose.yml @@ -1,4 +1,4 @@ -version: '3' +version: '3.7' services: db: restart: always @@ -6,43 +6,27 @@ services: shm_size: 256mb networks: - internal_network + healthcheck: + test: ['CMD', 'pg_isready', '-U', 'postgres'] volumes: - - /srv/mastodon/postgres14:/var/lib/postgresql/data - # added from the default, otherwise you'll need to manually create a `mastodon` db and user/role - # env_file: db.env - env_file: - - .env - - .env.production - - db.env + - ./postgres14:/var/lib/postgresql/data environment: - 'POSTGRES_HOST_AUTH_METHOD=trust' - - 'POSTGRES_USER=postgres' redis: restart: always image: redis:7-alpine networks: - internal_network - env_file: db.env healthcheck: test: ['CMD', 'redis-cli', 'ping'] - # environment: - # - 'REDIS_URL=redis://redis:6379' volumes: - - /srv/mastodon/redis:/data + - ./redis:/data web: - image: ghcr.io/mastodon/mastodon:v4.3.3 + image: ghcr.io/glitch-soc/mastodon restart: always - # env_file: - # - .env - # - db.env - env_file: - - .env - - .env.production - - db.env - ports: - - 3344:3000 + env_file: .env.production command: bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000" networks: - traefik @@ -53,30 +37,34 @@ services: depends_on: - db - redis + # - es volumes: - - /srv/mastodon/web:/mastodon/public/system - labels: - - traefik.enable=true - - traefik.http.routers.mastodonweb.rule=Host(`kvist.knast.cc`) - - traefik.http.routers.mastodonweb.entrypoints=websecure - - traefik.http.routers.mastodonweb.tls.certresolver=letsencr - - traefik.http.services.mastodonweb.loadbalancer.server.port=3344 + - ./public/system:/mastodon/public/system + labels: + - "traefik.enable=true" + # Main Web Router + - "traefik.http.routers.mstdn-web-rtr.entrypoints=websecure" + - "traefik.http.routers.mstdn-web-rtr.rule=Host(`kvist.knast.cc`)" + - "traefik.http.routers.mstdn-web-rtr.tls=true" + - "traefik.http.routers.mstdn-web-rtr.tls.certResolver=letsencr" + # Media Router + - "traefik.http.routers.mstdn-media-rtr.entrypoints=websecure" + - "traefik.http.routers.mstdn-media-rtr.rule=(Host(`kvist.knast.cc`) && PathPrefix(`/system/media_attachments/`))" + - "traefik.http.routers.mstdn-media-rtr.tls=true" + - "traefik.http.routers.mstdn-media-rtr.tls.certResolver=letsencr" + - "traefik.http.routers.mstdn-media-rtr.middlewares=mstdn-cors-media" + # CORS Middleware + - "traefik.http.middlewares.mstdn-cors-media.headers.contentSecurityPolicy=img-src *; media-src *;" + - "traefik.http.middlewares.mstdn-cors-media.headers.accesscontrolallowheaders=*" + - "traefik.http.middlewares.mstdn-cors-media.headers.accessControlAllowOriginList=*" + # Service + - "traefik.http.services.mstdn-web-svc.loadbalancer.server.port=3000" streaming: - image: ghcr.io/mastodon/mastodon-streaming:v4.3.3 + image: ghcr.io/glitch-soc/mastodon restart: always - # env_file: - # - .env - # - db.env - env_file: - - .env - - .env.production - - db.env + env_file: .env.production command: node ./streaming - environment: - - 'REDIS_URL=redis://redis:6379' - ports: - - 4433:4000 networks: - traefik - internal_network @@ -86,21 +74,18 @@ services: depends_on: - db - redis - labels: - - traefik.enable=true - - traefik.http.routers.mastodonstreaming.rule=(Host(`kvist.knast.cc`) && PathPrefix(`/api/v1/streaming`)) - - traefik.http.routers.mastodonstreaming.entrypoints=websecure - - traefik.http.routers.mastodonstreaming.tls.certresolver=letsencr - - traefik.http.services.mastodonstreaming.loadbalancer.server.port=4433 - + labels: + - "traefik.enable=true" + - "traefik.http.routers.mstdn-streamer-rtr.entrypoints=websecure" + - "traefik.http.routers.mstdn-streamer-rtr.rule=(Host(`kvist.knast.cc`) && PathPrefix(`/api/v1/streaming`))" + - "traefik.http.routers.mstdn-streamer-rtr.tls=true" + - "traefik.http.routers.mstdn-streamer-rtr.tls.certResolver=letsencr" + - "traefik.http.services.mstdn-streamer-svc.loadbalancer.server.port=4000" sidekiq: - image: ghcr.io/mastodon/mastodon:v4.3.3 + image: ghcr.io/glitch-soc/mastodon restart: always - env_file: - - .env - - .env.production - - db.env + env_file: .env.production command: bundle exec sidekiq depends_on: - db @@ -109,173 +94,13 @@ services: - traefik - internal_network volumes: - - /srv/mastodon/sidekiq:/mastodon/public/system + - ./public/system:/mastodon/public/system healthcheck: test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"] - networks: traefik: + name: traefik external: true internal_network: internal: true - - - - - - # This file is designed for production server deployment, not local development work -# For a containerized local dev environment, see: https://github.com/mastodon/mastodon/blob/main/docs/DEVELOPMENT.md#docker - -# services: -# db: -# restart: always -# image: postgres:14-alpine -# shm_size: 256mb -# networks: -# - internal_network -# healthcheck: -# test: ['CMD', 'pg_isready', '-U', 'postgres'] -# volumes: -# - ./postgres14:/var/lib/postgresql/data -# environment: -# - 'POSTGRES_HOST_AUTH_METHOD=trust' - -# redis: -# restart: always -# image: redis:7-alpine -# networks: -# - internal_network -# healthcheck: -# test: ['CMD', 'redis-cli', 'ping'] -# volumes: -# - ./redis:/data - -# # es: -# # restart: always -# # image: docker.elastic.co/elasticsearch/elasticsearch:7.17.4 -# # environment: -# # - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Des.enforce.bootstrap.checks=true" -# # - "xpack.license.self_generated.type=basic" -# # - "xpack.security.enabled=false" -# # - "xpack.watcher.enabled=false" -# # - "xpack.graph.enabled=false" -# # - "xpack.ml.enabled=false" -# # - "bootstrap.memory_lock=true" -# # - "cluster.name=es-mastodon" -# # - "discovery.type=single-node" -# # - "thread_pool.write.queue_size=1000" -# # networks: -# # - traefik -# # - internal_network -# # healthcheck: -# # test: ["CMD-SHELL", "curl --silent --fail localhost:9200/_cluster/health || exit 1"] -# # volumes: -# # - ./elasticsearch:/usr/share/elasticsearch/data -# # ulimits: -# # memlock: -# # soft: -1 -# # hard: -1 -# # nofile: -# # soft: 65536 -# # hard: 65536 -# # ports: -# # - '127.0.0.1:9200:9200' - -# web: -# # You can uncomment the following line if you want to not use the prebuilt image, for example if you have local code changes -# # build: . -# image: ghcr.io/mastodon/mastodon:v4.3.3 -# restart: always -# env_file: - # - .env - # - .env.production - # - db.env -# command: bundle exec puma -C config/puma.rb -# networks: -# - traefik -# - internal_network -# healthcheck: -# # prettier-ignore -# test: ['CMD-SHELL',"curl -s --noproxy localhost localhost:3000/health | grep -q 'OK' || exit 1"] -# ports: -# - '127.0.0.1:3000:3000' -# depends_on: -# - db -# - redis -# # - es -# volumes: -# - ./public/system:/mastodon/public/system - -# streaming: -# # You can uncomment the following lines if you want to not use the prebuilt image, for example if you have local code changes -# # build: -# # dockerfile: ./streaming/Dockerfile -# # context: . -# image: ghcr.io/mastodon/mastodon-streaming:v4.3.3 -# restart: always -# # env_file: -# - .env -# - .env.production -# - db.env -# command: node ./streaming/index.js -# networks: -# - traefik -# - internal_network -# healthcheck: -# # prettier-ignore -# test: ['CMD-SHELL', "curl -s --noproxy localhost localhost:4000/api/v1/streaming/health | grep -q 'OK' || exit 1"] -# ports: -# - '127.0.0.1:4000:4000' -# depends_on: -# - db -# - redis - -# sidekiq: -# # You can uncomment the following line if you want to not use the prebuilt image, for example if you have local code changes -# # build: . -# image: ghcr.io/mastodon/mastodon:v4.3.3 -# restart: always -# # env_file: -# - .env -# - .env.production -# - db.env -# command: bundle exec sidekiq -# depends_on: -# - db -# - redis -# networks: -# - traefik -# - internal_network -# volumes: -# - ./public/system:/mastodon/public/system -# healthcheck: -# test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"] - -# ## Uncomment to enable federation with tor instances along with adding the following ENV variables -# ## http_hidden_proxy=http://privoxy:8118 -# ## ALLOW_ACCESS_TO_HIDDEN_SERVICE=true -# # tor: -# # image: sirboops/tor -# # networks: -# # - traefik -# # - internal_network -# # -# # privoxy: -# # image: sirboops/privoxy -# # volumes: -# # - ./priv-config:/opt/config -# # networks: -# # - traefik -# # - internal_network - -# networks: -# # traefik: -# traefik: -# external: true -# internal_network: -# internal: true - -# # networks: -# # traefik: -# # external: true