mastodon

mastodon/.env.production

@@ -0,0 +1,55 @@
+LOCAL_DOMAIN=kvist.knast.cc
+
+# Redis
+# -----
+REDIS_HOST=redis
+REDIS_PORT=6379
+
+# PostgreSQL
+# ----------
+DB_HOST=db
+DB_USER=postgres
+DB_NAME=mastodon_production
+DB_PASS=
+DB_PORT=5432
+
+# Secrets
+# -------
+# Generate each with the `RAILS_ENV=production bundle exec rake secret` task (`docker-compose run --rm web bundle exec rake secret` if you use docker compose)
+# -------
+SECRET_KEY_BASE=29e52e5bd23fdeab4676ef27eafcac36b3db9a5842ec9e50910f78c350ac4c1d3d722003ab473936d67d68bc6c5702174effda71d94e27cdaea049d4c6958eb8
+OTP_SECRET=48cb26b4254c56457e9279b877a11d9e43f9e8e4b63875f80390bfe132597bb61ea405c040a4ff1b16736290c40a9efc166986eb2502c00f77527c6ff22f5b9f
+VAPID_PRIVATE_KEY=4da48ca5d54eb6222db3971d446dc9ad5d372ae6555c85b5221ceb56a88248f10977a1c00809a101d1bfcd6cb34aedaeee6fb471deb78912327c143f108f38d2
+VAPID_PUBLIC_KEY=24923f2e2296745137e79deb1bdaecf221406278ae7ebebd1c5d583cacb2455a5713c726dbdd107ef4b4c0ab52040b0d9c08af69cc5f75391b0cac49ea313b40
+
+# Registrations
+# -------------
+# Single user mode will disable registrations and redirect frontpage to the first profile
+SINGLE_USER_MODE=true
+
+# Sending mail
+# ------------
+SMTP_SERVER=email-smtp.ca-central-1.amazonaws.com
+SMTP_PORT=587
+SMTP_LOGIN=........
+SMTP_PASSWORD=........
+SMTP_OPENSSL_VERIFY_MODE=none
+SMTP_ENABLE_STARTTLS=auto
+SMTP_FROM_ADDRESS=mastodon@kvist.knast.cc
+
+# Custom settings
+# ---------------
+MAX_TOOT_CHARS=1000
+MAX_PINNED_TOOTS=5
+MAX_BIO_CHARS=500
+MAX_PROFILE_FIELDS=4
+MAX_DISPLAY_NAME_CHARS=30
+MAX_POLL_OPTIONS=5
+MAX_POLL_OPTION_CHARS=100
+MAX_IMAGE_SIZE=536870912
+MAX_VIDEO_SIZE=1073741824
+
+# IP and session retention
+# -----------------------
+IP_RETENTION_PERIOD=31556952
+SESSION_RETENTION_PERIOD=31556952

mastodon/docker-compose copy.yml

@@ -0,0 +1,281 @@
+version: '3'
+services:
+  db:
+    restart: always
+    image: postgres:14-alpine
+    shm_size: 256mb
+    networks:
+      - internal_network
+    volumes:
+      - /srv/mastodon/postgres14:/var/lib/postgresql/data
+    # added from the default, otherwise you'll need to manually create a `mastodon` db and user/role
+    # env_file: db.env  
+    env_file:
+      - .env
+      - .env.production
+      - db.env
+    environment:
+      - 'POSTGRES_HOST_AUTH_METHOD=trust'
+      - 'POSTGRES_USER=postgres'
+
+  redis:
+    restart: always
+    image: redis:7-alpine
+    networks:
+      - internal_network
+    env_file: db.env  
+    healthcheck:
+      test: ['CMD', 'redis-cli', 'ping']
+    # environment:
+    #   - 'REDIS_URL=redis://redis:6379'
+    volumes:
+      - /srv/mastodon/redis:/data
+
+  web:
+    image: ghcr.io/mastodon/mastodon:v4.3.3
+    restart: always
+    # env_file:
+    #   - .env
+    #   - db.env
+    env_file:
+      - .env
+      - .env.production
+      - db.env
+    ports:
+      - 3344:3000
+    command: bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000"
+    networks:
+      - traefik
+      - internal_network
+    healthcheck:
+      # prettier-ignore
+      test: ['CMD-SHELL', 'wget -q --spider --proxy=off localhost:3000/health || exit 1']
+    depends_on:
+      - db
+      - redis
+    volumes:
+      - /srv/mastodon/web:/mastodon/public/system
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.mastodonweb.rule=Host(`kvist.knast.cc`)
+      - traefik.http.routers.mastodonweb.entrypoints=websecure
+      - traefik.http.routers.mastodonweb.tls.certresolver=letsencr
+      - traefik.http.services.mastodonweb.loadbalancer.server.port=3344
+
+  streaming:
+    image: ghcr.io/mastodon/mastodon-streaming:v4.3.3
+    restart: always
+    # env_file:
+    #   - .env
+    #   - db.env
+    env_file:
+      - .env
+      - .env.production
+      - db.env
+    command: node ./streaming
+    environment:
+      - 'REDIS_URL=redis://redis:6379'
+    ports:
+      - 4433:4000
+    networks:
+      - traefik
+      - internal_network
+    healthcheck:
+      # prettier-ignore
+      test: ['CMD-SHELL', 'wget -q --spider --proxy=off localhost:4000/api/v1/streaming/health || exit 1']
+    depends_on:
+      - db
+      - redis
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.mastodonstreaming.rule=(Host(`kvist.knast.cc`) && PathPrefix(`/api/v1/streaming`))
+      - traefik.http.routers.mastodonstreaming.entrypoints=websecure
+      - traefik.http.routers.mastodonstreaming.tls.certresolver=letsencr
+      - traefik.http.services.mastodonstreaming.loadbalancer.server.port=4433
+
+
+  sidekiq:
+    image: ghcr.io/mastodon/mastodon:v4.3.3
+    restart: always
+    env_file:
+      - .env
+      - .env.production
+      - db.env
+    command: bundle exec sidekiq
+    depends_on:
+      - db
+      - redis
+    networks:
+      - traefik
+      - internal_network
+    volumes:
+      - /srv/mastodon/sidekiq:/mastodon/public/system
+    healthcheck:
+      test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"]
+
+
+networks:
+  traefik:
+    external: true
+  internal_network:
+    internal: true
+
+
+
+
+
+    # This file is designed for production server deployment, not local development work
+# For a containerized local dev environment, see: https://github.com/mastodon/mastodon/blob/main/docs/DEVELOPMENT.md#docker
+
+# services:
+#   db:
+#     restart: always
+#     image: postgres:14-alpine
+#     shm_size: 256mb
+#     networks:
+#       - internal_network
+#     healthcheck:
+#       test: ['CMD', 'pg_isready', '-U', 'postgres']
+#     volumes:
+#       - ./postgres14:/var/lib/postgresql/data
+#     environment:
+#       - 'POSTGRES_HOST_AUTH_METHOD=trust'
+
+#   redis:
+#     restart: always
+#     image: redis:7-alpine
+#     networks:
+#       - internal_network
+#     healthcheck:
+#       test: ['CMD', 'redis-cli', 'ping']
+#     volumes:
+#       - ./redis:/data
+
+#   # es:
+#   #   restart: always
+#   #   image: docker.elastic.co/elasticsearch/elasticsearch:7.17.4
+#   #   environment:
+#   #     - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Des.enforce.bootstrap.checks=true"
+#   #     - "xpack.license.self_generated.type=basic"
+#   #     - "xpack.security.enabled=false"
+#   #     - "xpack.watcher.enabled=false"
+#   #     - "xpack.graph.enabled=false"
+#   #     - "xpack.ml.enabled=false"
+#   #     - "bootstrap.memory_lock=true"
+#   #     - "cluster.name=es-mastodon"
+#   #     - "discovery.type=single-node"
+#   #     - "thread_pool.write.queue_size=1000"
+#   #   networks:
+#   #      - traefik
+#   #      - internal_network
+#   #   healthcheck:
+#   #      test: ["CMD-SHELL", "curl --silent --fail localhost:9200/_cluster/health || exit 1"]
+#   #   volumes:
+#   #      - ./elasticsearch:/usr/share/elasticsearch/data
+#   #   ulimits:
+#   #     memlock:
+#   #       soft: -1
+#   #       hard: -1
+#   #     nofile:
+#   #       soft: 65536
+#   #       hard: 65536
+#   #   ports:
+#   #     - '127.0.0.1:9200:9200'
+
+#   web:
+#     # You can uncomment the following line if you want to not use the prebuilt image, for example if you have local code changes
+#     # build: .
+#     image: ghcr.io/mastodon/mastodon:v4.3.3
+#     restart: always
+#       env_file:
+      # - .env
+      # - .env.production
+      # - db.env
+#     command: bundle exec puma -C config/puma.rb
+#     networks:
+#       - traefik
+#       - internal_network
+#     healthcheck:
+#       # prettier-ignore
+#       test: ['CMD-SHELL',"curl -s --noproxy localhost localhost:3000/health | grep -q 'OK' || exit 1"]
+#     ports:
+#       - '127.0.0.1:3000:3000'
+#     depends_on:
+#       - db
+#       - redis
+#       # - es
+#     volumes:
+#       - ./public/system:/mastodon/public/system
+
+#   streaming:
+#     # You can uncomment the following lines if you want to not use the prebuilt image, for example if you have local code changes
+#     # build:
+#     #   dockerfile: ./streaming/Dockerfile
+#     #   context: .
+#     image: ghcr.io/mastodon/mastodon-streaming:v4.3.3
+#     restart: always
+# #       env_file:
+#       - .env
+#       - .env.production
+#       - db.env
+#     command: node ./streaming/index.js
+#     networks:
+#       - traefik
+#       - internal_network
+#     healthcheck:
+#       # prettier-ignore
+#       test: ['CMD-SHELL', "curl -s --noproxy localhost localhost:4000/api/v1/streaming/health | grep -q 'OK' || exit 1"]
+#     ports:
+#       - '127.0.0.1:4000:4000'
+#     depends_on:
+#       - db
+#       - redis
+
+#   sidekiq:
+#     # You can uncomment the following line if you want to not use the prebuilt image, for example if you have local code changes
+#     # build: .
+#     image: ghcr.io/mastodon/mastodon:v4.3.3
+#     restart: always
+# #       env_file:
+#       - .env
+#       - .env.production
+#       - db.env
+#     command: bundle exec sidekiq
+#     depends_on:
+#       - db
+#       - redis
+#     networks:
+#       - traefik
+#       - internal_network
+#     volumes:
+#       - ./public/system:/mastodon/public/system
+#     healthcheck:
+#       test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"]
+
+#   ## Uncomment to enable federation with tor instances along with adding the following ENV variables
+#   ## http_hidden_proxy=http://privoxy:8118
+#   ## ALLOW_ACCESS_TO_HIDDEN_SERVICE=true
+#   # tor:
+#   #   image: sirboops/tor
+#   #   networks:
+#   #      - traefik
+#   #      - internal_network
+#   #
+#   # privoxy:
+#   #   image: sirboops/privoxy
+#   #   volumes:
+#   #     - ./priv-config:/opt/config
+#   #   networks:
+#   #     - traefik
+#   #     - internal_network
+
+# networks:
+#   # traefik:
+#   traefik:
+#     external: true
+#   internal_network:
+#     internal: true
+
+# # networks:
+#   # traefik:
+#   #   external: true

mastodon/docker-compose.yml

@@ -1,4 +1,4 @@
-version: '3'
+version: '3.7'
 services:
   db:
     restart: always
@@ -6,43 +6,27 @@ services:
     shm_size: 256mb
     networks:
       - internal_network
+    healthcheck:
+      test: ['CMD', 'pg_isready', '-U', 'postgres']
     volumes:
-      - /srv/mastodon/postgres14:/var/lib/postgresql/data
+      - ./postgres14:/var/lib/postgresql/data
-    # added from the default, otherwise you'll need to manually create a `mastodon` db and user/role
-    # env_file: db.env  
-    env_file:
-      - .env
-      - .env.production
-      - db.env
     environment:
       - 'POSTGRES_HOST_AUTH_METHOD=trust'
-      - 'POSTGRES_USER=postgres'
 
   redis:
     restart: always
     image: redis:7-alpine
     networks:
       - internal_network
-    env_file: db.env  
     healthcheck:
       test: ['CMD', 'redis-cli', 'ping']
-    # environment:
-    #   - 'REDIS_URL=redis://redis:6379'
     volumes:
-      - /srv/mastodon/redis:/data
+      - ./redis:/data
 
   web:
-    image: ghcr.io/mastodon/mastodon:v4.3.3
+    image: ghcr.io/glitch-soc/mastodon
     restart: always
-    # env_file:
+    env_file: .env.production
-    #   - .env
-    #   - db.env
-    env_file:
-      - .env
-      - .env.production
-      - db.env
-    ports:
-      - 3344:3000
     command: bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000"
     networks:
       - traefik
@@ -53,30 +37,34 @@ services:
     depends_on:
       - db
       - redis
+      # - es
     volumes:
-      - /srv/mastodon/web:/mastodon/public/system
+      - ./public/system:/mastodon/public/system
     labels: 
-      - traefik.enable=true
+      - "traefik.enable=true"
-      - traefik.http.routers.mastodonweb.rule=Host(`kvist.knast.cc`)
+      # Main Web Router
-      - traefik.http.routers.mastodonweb.entrypoints=websecure
+      - "traefik.http.routers.mstdn-web-rtr.entrypoints=websecure"
-      - traefik.http.routers.mastodonweb.tls.certresolver=letsencr
+      - "traefik.http.routers.mstdn-web-rtr.rule=Host(`kvist.knast.cc`)"
-      - traefik.http.services.mastodonweb.loadbalancer.server.port=3344
+      - "traefik.http.routers.mstdn-web-rtr.tls=true"
+      - "traefik.http.routers.mstdn-web-rtr.tls.certResolver=letsencr"
+      # Media Router
+      - "traefik.http.routers.mstdn-media-rtr.entrypoints=websecure"
+      - "traefik.http.routers.mstdn-media-rtr.rule=(Host(`kvist.knast.cc`) && PathPrefix(`/system/media_attachments/`))"
+      - "traefik.http.routers.mstdn-media-rtr.tls=true"
+      - "traefik.http.routers.mstdn-media-rtr.tls.certResolver=letsencr"
+      - "traefik.http.routers.mstdn-media-rtr.middlewares=mstdn-cors-media"
+      # CORS Middleware
+      - "traefik.http.middlewares.mstdn-cors-media.headers.contentSecurityPolicy=img-src *; media-src *;"
+      - "traefik.http.middlewares.mstdn-cors-media.headers.accesscontrolallowheaders=*"
+      - "traefik.http.middlewares.mstdn-cors-media.headers.accessControlAllowOriginList=*"
+      # Service
+      - "traefik.http.services.mstdn-web-svc.loadbalancer.server.port=3000"
 
   streaming:
-    image: ghcr.io/mastodon/mastodon-streaming:v4.3.3
+    image: ghcr.io/glitch-soc/mastodon
     restart: always
-    # env_file:
+    env_file: .env.production
-    #   - .env
-    #   - db.env
-    env_file:
-      - .env
-      - .env.production
-      - db.env
     command: node ./streaming
-    environment:
-      - 'REDIS_URL=redis://redis:6379'
-    ports:
-      - 4433:4000
     networks:
       - traefik
       - internal_network
@@ -87,20 +75,17 @@ services:
       - db
       - redis
     labels: 
-      - traefik.enable=true
+      - "traefik.enable=true"
-      - traefik.http.routers.mastodonstreaming.rule=(Host(`kvist.knast.cc`) && PathPrefix(`/api/v1/streaming`))
+      - "traefik.http.routers.mstdn-streamer-rtr.entrypoints=websecure"
-      - traefik.http.routers.mastodonstreaming.entrypoints=websecure
+      - "traefik.http.routers.mstdn-streamer-rtr.rule=(Host(`kvist.knast.cc`) && PathPrefix(`/api/v1/streaming`))"
-      - traefik.http.routers.mastodonstreaming.tls.certresolver=letsencr
+      - "traefik.http.routers.mstdn-streamer-rtr.tls=true"
-      - traefik.http.services.mastodonstreaming.loadbalancer.server.port=4433
+      - "traefik.http.routers.mstdn-streamer-rtr.tls.certResolver=letsencr"
-
+      - "traefik.http.services.mstdn-streamer-svc.loadbalancer.server.port=4000"
 
   sidekiq:
-    image: ghcr.io/mastodon/mastodon:v4.3.3
+    image: ghcr.io/glitch-soc/mastodon
     restart: always
-    env_file:
+    env_file: .env.production
-      - .env
-      - .env.production
-      - db.env
     command: bundle exec sidekiq
     depends_on:
       - db
@@ -109,173 +94,13 @@ services:
       - traefik
       - internal_network
     volumes:
-      - /srv/mastodon/sidekiq:/mastodon/public/system
+      - ./public/system:/mastodon/public/system
     healthcheck:
       test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"]
 
-
 networks:
   traefik:
+    name: traefik
     external: true
   internal_network:
     internal: true
-
-
-
-
-
-    # This file is designed for production server deployment, not local development work
-# For a containerized local dev environment, see: https://github.com/mastodon/mastodon/blob/main/docs/DEVELOPMENT.md#docker
-
-# services:
-#   db:
-#     restart: always
-#     image: postgres:14-alpine
-#     shm_size: 256mb
-#     networks:
-#       - internal_network
-#     healthcheck:
-#       test: ['CMD', 'pg_isready', '-U', 'postgres']
-#     volumes:
-#       - ./postgres14:/var/lib/postgresql/data
-#     environment:
-#       - 'POSTGRES_HOST_AUTH_METHOD=trust'
-
-#   redis:
-#     restart: always
-#     image: redis:7-alpine
-#     networks:
-#       - internal_network
-#     healthcheck:
-#       test: ['CMD', 'redis-cli', 'ping']
-#     volumes:
-#       - ./redis:/data
-
-#   # es:
-#   #   restart: always
-#   #   image: docker.elastic.co/elasticsearch/elasticsearch:7.17.4
-#   #   environment:
-#   #     - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Des.enforce.bootstrap.checks=true"
-#   #     - "xpack.license.self_generated.type=basic"
-#   #     - "xpack.security.enabled=false"
-#   #     - "xpack.watcher.enabled=false"
-#   #     - "xpack.graph.enabled=false"
-#   #     - "xpack.ml.enabled=false"
-#   #     - "bootstrap.memory_lock=true"
-#   #     - "cluster.name=es-mastodon"
-#   #     - "discovery.type=single-node"
-#   #     - "thread_pool.write.queue_size=1000"
-#   #   networks:
-#   #      - traefik
-#   #      - internal_network
-#   #   healthcheck:
-#   #      test: ["CMD-SHELL", "curl --silent --fail localhost:9200/_cluster/health || exit 1"]
-#   #   volumes:
-#   #      - ./elasticsearch:/usr/share/elasticsearch/data
-#   #   ulimits:
-#   #     memlock:
-#   #       soft: -1
-#   #       hard: -1
-#   #     nofile:
-#   #       soft: 65536
-#   #       hard: 65536
-#   #   ports:
-#   #     - '127.0.0.1:9200:9200'
-
-#   web:
-#     # You can uncomment the following line if you want to not use the prebuilt image, for example if you have local code changes
-#     # build: .
-#     image: ghcr.io/mastodon/mastodon:v4.3.3
-#     restart: always
-#       env_file:
-      # - .env
-      # - .env.production
-      # - db.env
-#     command: bundle exec puma -C config/puma.rb
-#     networks:
-#       - traefik
-#       - internal_network
-#     healthcheck:
-#       # prettier-ignore
-#       test: ['CMD-SHELL',"curl -s --noproxy localhost localhost:3000/health | grep -q 'OK' || exit 1"]
-#     ports:
-#       - '127.0.0.1:3000:3000'
-#     depends_on:
-#       - db
-#       - redis
-#       # - es
-#     volumes:
-#       - ./public/system:/mastodon/public/system
-
-#   streaming:
-#     # You can uncomment the following lines if you want to not use the prebuilt image, for example if you have local code changes
-#     # build:
-#     #   dockerfile: ./streaming/Dockerfile
-#     #   context: .
-#     image: ghcr.io/mastodon/mastodon-streaming:v4.3.3
-#     restart: always
-# #       env_file:
-#       - .env
-#       - .env.production
-#       - db.env
-#     command: node ./streaming/index.js
-#     networks:
-#       - traefik
-#       - internal_network
-#     healthcheck:
-#       # prettier-ignore
-#       test: ['CMD-SHELL', "curl -s --noproxy localhost localhost:4000/api/v1/streaming/health | grep -q 'OK' || exit 1"]
-#     ports:
-#       - '127.0.0.1:4000:4000'
-#     depends_on:
-#       - db
-#       - redis
-
-#   sidekiq:
-#     # You can uncomment the following line if you want to not use the prebuilt image, for example if you have local code changes
-#     # build: .
-#     image: ghcr.io/mastodon/mastodon:v4.3.3
-#     restart: always
-# #       env_file:
-#       - .env
-#       - .env.production
-#       - db.env
-#     command: bundle exec sidekiq
-#     depends_on:
-#       - db
-#       - redis
-#     networks:
-#       - traefik
-#       - internal_network
-#     volumes:
-#       - ./public/system:/mastodon/public/system
-#     healthcheck:
-#       test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"]
-
-#   ## Uncomment to enable federation with tor instances along with adding the following ENV variables
-#   ## http_hidden_proxy=http://privoxy:8118
-#   ## ALLOW_ACCESS_TO_HIDDEN_SERVICE=true
-#   # tor:
-#   #   image: sirboops/tor
-#   #   networks:
-#   #      - traefik
-#   #      - internal_network
-#   #
-#   # privoxy:
-#   #   image: sirboops/privoxy
-#   #   volumes:
-#   #     - ./priv-config:/opt/config
-#   #   networks:
-#   #     - traefik
-#   #     - internal_network
-
-# networks:
-#   # traefik:
-#   traefik:
-#     external: true
-#   internal_network:
-#     internal: true
-
-# # networks:
-#   # traefik:
-#   #   external: true