From 1c0a3ee8e7883e67c32b040fc02cc0affac7fc79 Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 16:50:38 +0100 Subject: [PATCH 01/16] bundles/postgresql: fix postgresql config path --- bundles/postgresql/items.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/bundles/postgresql/items.py b/bundles/postgresql/items.py index f1d2953..f48ad74 100644 --- a/bundles/postgresql/items.py +++ b/bundles/postgresql/items.py @@ -25,10 +25,10 @@ directories = { }, # This is needed so the above purge does not remove the version # currently installed. - '/etc/postgresql/{}'.format(postgresql_version): { - 'owner': None, - 'group': None, - 'mode': None, + '/etc/postgresql/{}/main'.format(postgresql_version): { + 'owner': 'postgres', + 'group': 'postgres', + 'mode': '0755', }, } From 97a1b3ae855b387b7ec63f38ad615b55c71dc581 Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 16:51:34 +0100 Subject: [PATCH 02/16] bundles/zfs: add comment to action:modprobe-zfs --- bundles/zfs/items.py | 1 + 1 file changed, 1 insertion(+) diff --git a/bundles/zfs/items.py b/bundles/zfs/items.py index ad09841..1322250 100644 --- a/bundles/zfs/items.py +++ b/bundles/zfs/items.py @@ -19,6 +19,7 @@ actions = { 'zfs_dataset:', 'zfs_pool:', }, + 'comment': 'If this fails, do a dist-upgrade, reinstall zfs-dkms, reboot', }, } From ad5c8cc0ab63851287fbe5d0f523563577892ca8 Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 17:30:38 +0100 Subject: [PATCH 03/16] bundles/postfix: only get certificate if actually needed --- bundles/letsencrypt/files/domains.txt | 2 -- bundles/postfix/metadata.py | 11 ++++------- 2 files changed, 4 insertions(+), 9 deletions(-) diff --git a/bundles/letsencrypt/files/domains.txt b/bundles/letsencrypt/files/domains.txt index d9d7824..ea7e427 100644 --- a/bundles/letsencrypt/files/domains.txt +++ b/bundles/letsencrypt/files/domains.txt @@ -1,5 +1,3 @@ -${node.metadata['hostname']} - % for domain, aliases in sorted(node.metadata.get('letsencrypt/domains', {}).items()): ${domain} ${' '.join(sorted(aliases))} % endfor diff --git a/bundles/postfix/metadata.py b/bundles/postfix/metadata.py index 4399e3b..9899988 100644 --- a/bundles/postfix/metadata.py +++ b/bundles/postfix/metadata.py @@ -49,7 +49,7 @@ else: 'letsencrypt/reload_after', ) def letsencrypt(metadata): - if not node.has_bundle('letsencrypt'): + if not node.has_bundle('letsencrypt') or not node.has_bundle('postfixadmin'): raise DoNotRunAgain result = { @@ -58,12 +58,9 @@ def letsencrypt(metadata): }, } - myhostname = metadata.get('postfix/myhostname', None) - - if myhostname and myhostname != metadata.get('hostname'): - result['domains'] = { - myhostname: set(), - } + result['domains'] = { + metadata.get('postfix/myhostname', metadata.get('hostname')): set(), + } return { 'letsencrypt': result, From e2d7d057838f304b01a95f0c3abf5cdfb9b87ea5 Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 17:35:45 +0100 Subject: [PATCH 04/16] bundles/systemd-networkd: manage apt packages via bundle:apt --- bundles/systemd-networkd/items.py | 6 ------ bundles/systemd-networkd/metadata.py | 11 +++++++++++ 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/bundles/systemd-networkd/items.py b/bundles/systemd-networkd/items.py index 6d068d4..aa2084c 100644 --- a/bundles/systemd-networkd/items.py +++ b/bundles/systemd-networkd/items.py @@ -1,11 +1,5 @@ assert node.has_bundle('systemd') -pkg_apt = { - 'resolvconf': { - 'installed': False, - }, -} - files = { '/etc/network/interfaces': { 'delete': True, diff --git a/bundles/systemd-networkd/metadata.py b/bundles/systemd-networkd/metadata.py index 54579e4..e8dff0e 100644 --- a/bundles/systemd-networkd/metadata.py +++ b/bundles/systemd-networkd/metadata.py @@ -1,3 +1,14 @@ +defaults = { + 'apt': { + 'packages': { + 'resolvconf': { + 'installed': False, + }, + }, + }, +} + + @metadata_reactor.provides( 'interfaces', ) From 5433859a86ff45a495416b3facb95107a73986c8 Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 17:38:11 +0100 Subject: [PATCH 05/16] bundles/letsencrypt: also check for chain.pem, nginx needs this --- bundles/letsencrypt/files/letsencrypt-ensure-some-certificate | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/bundles/letsencrypt/files/letsencrypt-ensure-some-certificate b/bundles/letsencrypt/files/letsencrypt-ensure-some-certificate index 45f474a..e0248cb 100644 --- a/bundles/letsencrypt/files/letsencrypt-ensure-some-certificate +++ b/bundles/letsencrypt/files/letsencrypt-ensure-some-certificate @@ -6,7 +6,7 @@ just_check=$2 cert_path="/var/lib/dehydrated/certs/$domain" already_exists=false -if [ -f "$cert_path/privkey.pem" -a -f "$cert_path/fullchain.pem" ] +if [ -f "$cert_path/privkey.pem" -a -f "$cert_path/fullchain.pem" -a -f "$cert_path/chain.pem" ] then already_exists=true fi @@ -23,6 +23,7 @@ fi if [ "$already_exists" != true ] then + rm -r "$cert_path" mkdir -p "$cert_path" openssl req -x509 -newkey rsa:4096 -nodes -days 3650 -subj "/CN=$domain" -keyout "$cert_path/privkey.pem" -out "$cert_path/fullchain.pem" chmod 0600 "$cert_path/privkey.pem" From 9b7454b57cf470f52b86c39f417b500d659ab89a Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 18:06:20 +0100 Subject: [PATCH 06/16] nodes/htz.ex42-1048908: add pkg_apt:mosh --- nodes/htz/ex42-1048908.py | 1 + 1 file changed, 1 insertion(+) diff --git a/nodes/htz/ex42-1048908.py b/nodes/htz/ex42-1048908.py index 247534c..a408cf2 100644 --- a/nodes/htz/ex42-1048908.py +++ b/nodes/htz/ex42-1048908.py @@ -49,6 +49,7 @@ nodes['htz.ex42-1048908'] = { # No need to create a bundle just to install packages, # configs will be managed by users nevertheless. + 'mosh': {}, 'weechat': {}, 'weechat-core': {}, 'weechat-curses': {}, From 1f3e7afb2c2cb7c50843cecc846ea4477b518bba Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 16:53:35 +0100 Subject: [PATCH 07/16] bundles/pleroma: initial NON-WORKING version --- .editorconfig | 3 ++ PORT_MAP.md | 6 +-- bundles/pleroma/files/pleroma.config.exs | 44 +++++++++++++++++++ bundles/pleroma/items.py | 55 ++++++++++++++++++++++++ bundles/pleroma/metadata.py | 31 +++++++++++++ 5 files changed, 134 insertions(+), 5 deletions(-) create mode 100644 bundles/pleroma/files/pleroma.config.exs create mode 100644 bundles/pleroma/items.py create mode 100644 bundles/pleroma/metadata.py diff --git a/.editorconfig b/.editorconfig index 2b2153d..e09c9dd 100644 --- a/.editorconfig +++ b/.editorconfig @@ -11,6 +11,9 @@ insert_final_newline = true [*.yaml] indent_size = 2 +[*.exs] +indent_size = 2 + # possibly sql dumps [*.sql] indent_size = unset diff --git a/PORT_MAP.md b/PORT_MAP.md index 1111ee5..fe5117b 100644 --- a/PORT_MAP.md +++ b/PORT_MAP.md @@ -6,11 +6,6 @@ easily find available ports for other bundles. ## TCP Rule of thumb: keep ports below 10000 free for stuff that reserves ports. -| Port range | reserved for | -| ----------- | ------------ | -| 200.. | Matrix | -| 220.. | Generic Web services | - | Port | bundle | usage | | ----------- | -------------------- | ----- | | 22 | | sshd | @@ -38,6 +33,7 @@ Rule of thumb: keep ports below 10000 free for stuff that reserves ports. | 20080 | matrix-synapse | client, federation | | 20081 | matrix-synapse | prometheus metrics | | 20090 | matrix-media-repo | media_repo | +| 21000 | pleroma | pleroma | | 22000 | gitea | gitea | | 22010 | jenkins-ci | Jenkins CI | | 22020 | travelynx | Travelynx Web | diff --git a/bundles/pleroma/files/pleroma.config.exs b/bundles/pleroma/files/pleroma.config.exs new file mode 100644 index 0000000..27564a8 --- /dev/null +++ b/bundles/pleroma/files/pleroma.config.exs @@ -0,0 +1,44 @@ +import Config + +config :pleroma, Pleroma.Web.Endpoint, + url: [host: "${node.metadata['pleroma']['url']}", scheme: "https", port: 443], + http: [port: 21000, ip: {127, 0, 0, 1}], + secret_key_base: "${node.metadata['pleroma']['secret_key']}", + secure_cookie_flag: true + +config :pleroma, :http_security, + enabled: false, + sts: true, + referrer_policy: "same-origin" + +config :pleroma, :instance, + name: "${node.metadata['pleroma']['title']}", + description: "${node.metadata['pleroma']['description']}", + email: "${node.metadata['pleroma']['admin_email']}", + limit: ${node.metadata['pleroma'].get('limit_chars', 500)}, + registrations_open: ${str(node.metadata['pleroma'].get('signup_enabled', False)).lower()}, + invites_enabled: ${str(node.metadata['pleroma'].get('invite_enabled', True)).lower()}, + static_dir: "/var/pleroma/static/" + +config :pleroma, Pleroma.Upload, + uploader: Pleroma.Uploaders.Local, + filters: [Pleroma.Upload.Filter.Dedupe] + +config :pleroma, Pleroma.Uploaders.Local, + uploads: "/var/pleroma/uploads/" + +config :pleroma, :media_proxy, + enabled: false, + redirect_on_failure: true + #base_url: "https://cache.pleroma.social" + +# Configure your database +config :pleroma, Pleroma.Repo, + adapter: Ecto.Adapters.Postgres, + username: "pleroma", + password: "${node.metadata['postgresql']['roles']['pleroma']['password']}", + database: "pleroma", + hostname: "localhost", + pool_size: 10, + timeout: 60000, + pool_timeout: 60000 diff --git a/bundles/pleroma/items.py b/bundles/pleroma/items.py new file mode 100644 index 0000000..dac7c34 --- /dev/null +++ b/bundles/pleroma/items.py @@ -0,0 +1,55 @@ +version = node.metadata['pleroma']['version'] + +users = { + 'pleroma': { + 'home': '/opt/pleroma', + }, +} + +directories = { + '/opt/pleroma': {}, + '/var/pleroma': { + 'owner': 'pleroma', + }, + '/var/pleroma/uploads': { + 'owner': 'pleroma', + }, + '/var/pleroma/static': { + 'owner': 'pleroma', + }, + '/var/pleroma/static/emoji': { + 'owner': 'pleroma', + }, +} + +if node.has_bundle('zfs'): + directories['/var/pleroma']['needs'] = { + 'zfs_dataset:tank/pleroma-data', + } + +actions = { + 'pleroma_download_release': { + 'command': \ + 'cd /opt/pleroma/ && '\ + f'wget -O/opt/pleroma/pleroma.zip https://git.pleroma.social/api/v4/projects/2/jobs/artifacts/stable/download?job=amd64 && '\ + 'rm -rf release && '\ + 'unzip /opt/pleroma/pleroma.zip', + 'unless': f'[ "$(cat /opt/pleroma/.bundlewrap_installed_version)" = "{version}" ]', + 'needs': { + 'directory:/opt/pleroma', + }, + }, + 'pleroma_create_schema': { + 'triggered': True, + 'command': 'sudo -u pleroma /opt/pleroma/src/rel/files/bin/pleroma_ctl create', + 'triggered_by': { + 'postgres_db:pleroma', + }, + }. +} + +files = { + '/opt/pleroma/pleroma.config.exs': { + 'content_type': 'mako', + }, +} diff --git a/bundles/pleroma/metadata.py b/bundles/pleroma/metadata.py new file mode 100644 index 0000000..d60250f --- /dev/null +++ b/bundles/pleroma/metadata.py @@ -0,0 +1,31 @@ +defaults = { + 'apt': { + 'packages': { + 'imagemagick': {}, + 'ffmpeg': {}, + 'libimage-exiftool-perl': {}, + }, + }, + 'zfs': { + 'datasets': { + 'tank/pleroma-data': { + 'mountpoint': '/var/pleroma', + }, + }, + }, + 'pleroma': { + 'admin_email': 'pleroma@{}'.format(node.hostname), + }, + 'postgresql': { + 'roles': { + 'pleroma': { + 'password': repo.vault.password_for(f'{node.name} postgresql pleroma'), + }, + }, + 'databases': { + 'pleroma': { + 'owner': 'pleroma', + }, + }, + }, +} From 33fb9fb3f52bd6322c31afa29cf93bec36b114ba Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 16:53:59 +0100 Subject: [PATCH 08/16] nodes/htz-cloud.pleroma: introduce --- .../files/bind-zones/cybert-media.net | 7 +++ nodes/htz-cloud/pleroma.py | 51 +++++++++++++++++++ 2 files changed, 58 insertions(+) create mode 100644 data/powerdns/files/bind-zones/cybert-media.net create mode 100644 nodes/htz-cloud/pleroma.py diff --git a/data/powerdns/files/bind-zones/cybert-media.net b/data/powerdns/files/bind-zones/cybert-media.net new file mode 100644 index 0000000..1e50f26 --- /dev/null +++ b/data/powerdns/files/bind-zones/cybert-media.net @@ -0,0 +1,7 @@ +${header} + +$ORIGIN cybert-media.net. + +@ IN A 159.69.11.231 + IN AAAA 2a01:4f8:c2c:c410::1 + IN TXT "v=spf1 a ~all" diff --git a/nodes/htz-cloud/pleroma.py b/nodes/htz-cloud/pleroma.py new file mode 100644 index 0000000..118b4d7 --- /dev/null +++ b/nodes/htz-cloud/pleroma.py @@ -0,0 +1,51 @@ +nodes['htz-cloud.pleroma'] = { + 'bundles': { + 'pleroma', + 'postgresql', + 'zfs', + }, + 'groups': { + 'debian-buster', + 'webserver', + }, + 'metadata': { + 'interfaces': { + 'eth0': { + 'ips': { + '159.69.11.231', + '2a01:4f8:c2c:c410::1/64', + }, + 'gateway4': '172.31.1.1', + 'gateway6': 'fe80::1', + }, + }, + 'backups': { + 'exclude_from_backups': True, + }, + 'nginx': { + 'vhosts': { + 'pleroma': { + 'domain': 'cybert-media.net', + }, + }, + }, + 'pleroma': { + 'version': '2.2.2', + 'url': 'cybert-media.net', + 'title': 'CYBERt Media', + 'description': '', + 'secret_key': vault.decrypt('encrypt$gAAAAABgMSibWavxv69eNmzAtQRSeFMtaXdkc1K2fklFMDsBJk2Rcmhak5tAVVqkemtnc96Q-Ad_FrdQM9wyuqUQnUEkIr1zScInJZsbf-QCoD02yX7Gktizmlc0aUjF1HO3rdtX9TeW'), + }, + 'vm': { + 'cpu': 1, + 'ram': 2, + }, + 'zfs': { + 'pools': { + 'tank': { + 'device': '/dev/sdb', + }, + }, + }, + }, +} From f8c157ce502f3014718978293e3f187b45978343 Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 19:37:33 +0100 Subject: [PATCH 09/16] bundles/pleroma: get it working --- bundles/pleroma/files/pleroma.config.exs | 3 +- bundles/pleroma/files/pleroma.service | 23 ++++++++++ bundles/pleroma/items.py | 45 ++++++++++++++++--- bundles/pleroma/metadata.py | 24 ++++++++++ .../files/extras/htz-cloud.pleroma/pleroma | 1 + nodes/htz-cloud/pleroma.py | 4 +- 6 files changed, 90 insertions(+), 10 deletions(-) create mode 100644 bundles/pleroma/files/pleroma.service create mode 100644 data/nginx/files/extras/htz-cloud.pleroma/pleroma diff --git a/bundles/pleroma/files/pleroma.config.exs b/bundles/pleroma/files/pleroma.config.exs index 27564a8..f58705f 100644 --- a/bundles/pleroma/files/pleroma.config.exs +++ b/bundles/pleroma/files/pleroma.config.exs @@ -40,5 +40,4 @@ config :pleroma, Pleroma.Repo, database: "pleroma", hostname: "localhost", pool_size: 10, - timeout: 60000, - pool_timeout: 60000 + timeout: 60000 diff --git a/bundles/pleroma/files/pleroma.service b/bundles/pleroma/files/pleroma.service new file mode 100644 index 0000000..1fc7c0b --- /dev/null +++ b/bundles/pleroma/files/pleroma.service @@ -0,0 +1,23 @@ +[Unit] +Description=Pleroma social network +After=network.target +Requires=postgresql.service + +[Service] +User=pleroma +WorkingDirectory=/opt/pleroma +Environment="HOME=/opt/pleroma" +Environment="PLEROMA_CONFIG_PATH=/opt/pleroma/pleroma.config.exs" +Environment="PLUG_TMPDIR=/tmp/pleroma" +ExecStart=/opt/pleroma/release/bin/pleroma start +ExecStop=/opt/pleroma/release/bin/pleroma stop +Restart=on-failure + +PrivateTmp=true +ProtectHome=true +ProtectSystem=full +NoNewPrivileges=true +CapabilityBoundingSet=~CAP_SYS_ADMIN + +[Install] +WantedBy=multi-user.target diff --git a/bundles/pleroma/items.py b/bundles/pleroma/items.py index dac7c34..a03b973 100644 --- a/bundles/pleroma/items.py +++ b/bundles/pleroma/items.py @@ -31,25 +31,58 @@ actions = { 'pleroma_download_release': { 'command': \ 'cd /opt/pleroma/ && '\ - f'wget -O/opt/pleroma/pleroma.zip https://git.pleroma.social/api/v4/projects/2/jobs/artifacts/stable/download?job=amd64 && '\ + f'wget -O/opt/pleroma/pleroma.zip https://git.pleroma.social/api/v4/projects/2/jobs/artifacts/release/{version}/download?job=amd64 && '\ 'rm -rf release && '\ - 'unzip /opt/pleroma/pleroma.zip', + 'unzip /opt/pleroma/pleroma.zip && '\ + 'chown -R pleroma:pleroma /opt/pleroma/release && '\ + f'echo -n "{version}" > /opt/pleroma/.bundlewrap_installed_version', 'unless': f'[ "$(cat /opt/pleroma/.bundlewrap_installed_version)" = "{version}" ]', 'needs': { 'directory:/opt/pleroma', }, + 'preceded_by': { + 'svc_systemd:pleroma:stop', + }, + 'triggers': { + 'action:pleroma_migrate_database', + 'svc_systemd:pleroma:restart', + }, }, - 'pleroma_create_schema': { + 'pleroma_migrate_database': { 'triggered': True, - 'command': 'sudo -u pleroma /opt/pleroma/src/rel/files/bin/pleroma_ctl create', - 'triggered_by': { + 'command': \ + 'echo "CREATE EXTENSION IF NOT EXISTS citext;" | psql pleroma && '\ + 'echo "CREATE EXTENSION IF NOT EXISTS pg_trgm;" | psql pleroma && '\ + 'echo "CREATE EXTENSION IF NOT EXISTS \\\"uuid-ossp\\\";" | psql pleroma && '\ + 'sudo -u pleroma PLEROMA_CONFIG_PATH=/opt/pleroma/pleroma.config.exs /opt/pleroma/release/bin/pleroma_ctl create', + 'needs': { 'postgres_db:pleroma', }, - }. + }, } files = { + '/etc/systemd/system/pleroma.service': { + 'triggers': { + 'action:systemd-reload', + 'svc_systemd:pleroma:restart', + }, + }, '/opt/pleroma/pleroma.config.exs': { 'content_type': 'mako', + 'triggers': { + 'svc_systemd:pleroma:restart', + }, + }, +} + +svc_systemd = { + 'pleroma': { + 'needs': { + 'action:pleroma_download_release', + 'action:pleroma_migrate_database', + 'file:/etc/systemd/system/pleroma.service', + 'file:/opt/pleroma/pleroma.config.exs', + }, }, } diff --git a/bundles/pleroma/metadata.py b/bundles/pleroma/metadata.py index d60250f..1cf5a74 100644 --- a/bundles/pleroma/metadata.py +++ b/bundles/pleroma/metadata.py @@ -29,3 +29,27 @@ defaults = { }, }, } + + +@metadata_reactor.provides( + 'nginx/vhosts/pleroma', +) +def nginx(metadata): + if not node.has_bundle('nginx'): + raise DoNotRunAgain + + return { + 'nginx': { + 'vhosts': { + 'pleroma': { + 'domain': metadata.get('pleroma/url'), + 'proxy': { + '/': { + 'target': 'http://127.0.0.1:21000', + 'websockets': True, + }, + }, + }, + }, + }, + } diff --git a/data/nginx/files/extras/htz-cloud.pleroma/pleroma b/data/nginx/files/extras/htz-cloud.pleroma/pleroma new file mode 100644 index 0000000..05771c4 --- /dev/null +++ b/data/nginx/files/extras/htz-cloud.pleroma/pleroma @@ -0,0 +1 @@ + client_max_body_size 16m; diff --git a/nodes/htz-cloud/pleroma.py b/nodes/htz-cloud/pleroma.py index 118b4d7..a4d2afc 100644 --- a/nodes/htz-cloud/pleroma.py +++ b/nodes/htz-cloud/pleroma.py @@ -25,7 +25,7 @@ nodes['htz-cloud.pleroma'] = { 'nginx': { 'vhosts': { 'pleroma': { - 'domain': 'cybert-media.net', + 'extras': True, }, }, }, @@ -34,7 +34,7 @@ nodes['htz-cloud.pleroma'] = { 'url': 'cybert-media.net', 'title': 'CYBERt Media', 'description': '', - 'secret_key': vault.decrypt('encrypt$gAAAAABgMSibWavxv69eNmzAtQRSeFMtaXdkc1K2fklFMDsBJk2Rcmhak5tAVVqkemtnc96Q-Ad_FrdQM9wyuqUQnUEkIr1zScInJZsbf-QCoD02yX7Gktizmlc0aUjF1HO3rdtX9TeW'), + 'secret_key': vault.decrypt('encrypt$gAAAAABgMVXXclfxVY022fM0Fdf94Oh3sxVlK0lYyBO_CsQFEbZcMua3w1oJY8_9d1JcrCJSSeBRTDnt-ZkRCQ6xKoALo8Rl7s9DPxa7J0vHdkggeZ3IHaOyXBcBPdx8vILyKDLHRXacaynOUBOjy6RIl6Qf2wH1ASbphCcjD-Njricg4PG6Rcixm87fF60rLBjAAkRoz5ZQnXlut1rhjLj-z-7UpA68fkeyPVJXbroWBJdmvCUt92dwjuGARsku2XI22mVvjtJJ'), }, 'vm': { 'cpu': 1, From 017c2c342139f8e2532367d670f4b5898b05ecd2 Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 20:02:26 +0100 Subject: [PATCH 10/16] bundles/pleroma: allow database configuration --- bundles/pleroma/files/pleroma.config.exs | 14 +++----------- bundles/pleroma/metadata.py | 8 +++++--- nodes/htz-cloud/pleroma.py | 3 --- 3 files changed, 8 insertions(+), 17 deletions(-) diff --git a/bundles/pleroma/files/pleroma.config.exs b/bundles/pleroma/files/pleroma.config.exs index f58705f..64c2c0b 100644 --- a/bundles/pleroma/files/pleroma.config.exs +++ b/bundles/pleroma/files/pleroma.config.exs @@ -1,23 +1,15 @@ import Config +config :pleroma, + configurable_from_database: true + config :pleroma, Pleroma.Web.Endpoint, url: [host: "${node.metadata['pleroma']['url']}", scheme: "https", port: 443], http: [port: 21000, ip: {127, 0, 0, 1}], secret_key_base: "${node.metadata['pleroma']['secret_key']}", secure_cookie_flag: true -config :pleroma, :http_security, - enabled: false, - sts: true, - referrer_policy: "same-origin" - config :pleroma, :instance, - name: "${node.metadata['pleroma']['title']}", - description: "${node.metadata['pleroma']['description']}", - email: "${node.metadata['pleroma']['admin_email']}", - limit: ${node.metadata['pleroma'].get('limit_chars', 500)}, - registrations_open: ${str(node.metadata['pleroma'].get('signup_enabled', False)).lower()}, - invites_enabled: ${str(node.metadata['pleroma'].get('invite_enabled', True)).lower()}, static_dir: "/var/pleroma/static/" config :pleroma, Pleroma.Upload, diff --git a/bundles/pleroma/metadata.py b/bundles/pleroma/metadata.py index 1cf5a74..8ba5634 100644 --- a/bundles/pleroma/metadata.py +++ b/bundles/pleroma/metadata.py @@ -6,6 +6,11 @@ defaults = { 'libimage-exiftool-perl': {}, }, }, + 'backups': { + 'paths': { + '/var/pleroma', + }, + }, 'zfs': { 'datasets': { 'tank/pleroma-data': { @@ -13,9 +18,6 @@ defaults = { }, }, }, - 'pleroma': { - 'admin_email': 'pleroma@{}'.format(node.hostname), - }, 'postgresql': { 'roles': { 'pleroma': { diff --git a/nodes/htz-cloud/pleroma.py b/nodes/htz-cloud/pleroma.py index a4d2afc..add2d60 100644 --- a/nodes/htz-cloud/pleroma.py +++ b/nodes/htz-cloud/pleroma.py @@ -31,9 +31,6 @@ nodes['htz-cloud.pleroma'] = { }, 'pleroma': { 'version': '2.2.2', - 'url': 'cybert-media.net', - 'title': 'CYBERt Media', - 'description': '', 'secret_key': vault.decrypt('encrypt$gAAAAABgMVXXclfxVY022fM0Fdf94Oh3sxVlK0lYyBO_CsQFEbZcMua3w1oJY8_9d1JcrCJSSeBRTDnt-ZkRCQ6xKoALo8Rl7s9DPxa7J0vHdkggeZ3IHaOyXBcBPdx8vILyKDLHRXacaynOUBOjy6RIl6Qf2wH1ASbphCcjD-Njricg4PG6Rcixm87fF60rLBjAAkRoz5ZQnXlut1rhjLj-z-7UpA68fkeyPVJXbroWBJdmvCUt92dwjuGARsku2XI22mVvjtJJ'), }, 'vm': { From ca857091e43ff5fce751d507be9a6bc478139315 Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 20:45:53 +0100 Subject: [PATCH 11/16] nodes/htz-cloud.pleroma: auto activate users with work email address --- nodes/htz-cloud/pleroma.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nodes/htz-cloud/pleroma.py b/nodes/htz-cloud/pleroma.py index add2d60..352d9f3 100644 --- a/nodes/htz-cloud/pleroma.py +++ b/nodes/htz-cloud/pleroma.py @@ -22,6 +22,9 @@ nodes['htz-cloud.pleroma'] = { 'backups': { 'exclude_from_backups': True, }, + 'cron': { + 'auto-authorize-sm-users': '* * * * * root echo "UPDATE users SET approval_pending=false WHERE email LIKE \'\\%@seibert-media.net\' AND approval_pending=true;" | psql pleroma >/dev/null', + }, 'nginx': { 'vhosts': { 'pleroma': { @@ -31,6 +34,7 @@ nodes['htz-cloud.pleroma'] = { }, 'pleroma': { 'version': '2.2.2', + 'url': 'cybert-media.net', 'secret_key': vault.decrypt('encrypt$gAAAAABgMVXXclfxVY022fM0Fdf94Oh3sxVlK0lYyBO_CsQFEbZcMua3w1oJY8_9d1JcrCJSSeBRTDnt-ZkRCQ6xKoALo8Rl7s9DPxa7J0vHdkggeZ3IHaOyXBcBPdx8vILyKDLHRXacaynOUBOjy6RIl6Qf2wH1ASbphCcjD-Njricg4PG6Rcixm87fF60rLBjAAkRoz5ZQnXlut1rhjLj-z-7UpA68fkeyPVJXbroWBJdmvCUt92dwjuGARsku2XI22mVvjtJJ'), }, 'vm': { From 9aeb6905899f9e2510834d5cd8ea4fb6fb729452 Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 20:49:35 +0100 Subject: [PATCH 12/16] nodes/htz-cloud.pleroma: set postfix/myhostname to correct domain --- nodes/htz-cloud/pleroma.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nodes/htz-cloud/pleroma.py b/nodes/htz-cloud/pleroma.py index 352d9f3..2431bbd 100644 --- a/nodes/htz-cloud/pleroma.py +++ b/nodes/htz-cloud/pleroma.py @@ -37,6 +37,9 @@ nodes['htz-cloud.pleroma'] = { 'url': 'cybert-media.net', 'secret_key': vault.decrypt('encrypt$gAAAAABgMVXXclfxVY022fM0Fdf94Oh3sxVlK0lYyBO_CsQFEbZcMua3w1oJY8_9d1JcrCJSSeBRTDnt-ZkRCQ6xKoALo8Rl7s9DPxa7J0vHdkggeZ3IHaOyXBcBPdx8vILyKDLHRXacaynOUBOjy6RIl6Qf2wH1ASbphCcjD-Njricg4PG6Rcixm87fF60rLBjAAkRoz5ZQnXlut1rhjLj-z-7UpA68fkeyPVJXbroWBJdmvCUt92dwjuGARsku2XI22mVvjtJJ'), }, + 'postfix': { + 'myhostname': 'cybert-media.net', + }, 'vm': { 'cpu': 1, 'ram': 2, From 8cb172a1c18321b0a3aad6eb3bc23a5c7da95e27 Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 20:57:00 +0100 Subject: [PATCH 13/16] bundles/pleroma: remove NoNewPrivileges=true, interferes with mail delivery --- bundles/pleroma/files/pleroma.service | 1 - 1 file changed, 1 deletion(-) diff --git a/bundles/pleroma/files/pleroma.service b/bundles/pleroma/files/pleroma.service index 1fc7c0b..bca89ee 100644 --- a/bundles/pleroma/files/pleroma.service +++ b/bundles/pleroma/files/pleroma.service @@ -16,7 +16,6 @@ Restart=on-failure PrivateTmp=true ProtectHome=true ProtectSystem=full -NoNewPrivileges=true CapabilityBoundingSet=~CAP_SYS_ADMIN [Install] From b470fddc1296c66c7e2cf070071ddf1bbe06af50 Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 21:11:12 +0100 Subject: [PATCH 14/16] bundles/nginx: add gdpr-compatible log format --- bundles/nginx/files/nginx.conf | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/bundles/nginx/files/nginx.conf b/bundles/nginx/files/nginx.conf index b2fcf10..5943dee 100644 --- a/bundles/nginx/files/nginx.conf +++ b/bundles/nginx/files/nginx.conf @@ -35,5 +35,24 @@ http { '' close; } + # GDPR compatible IP smashinator 5000000 + map $remote_addr $ip_anonym1 { + default 0.0.0; + "~(?P(\d+)\.(\d+))\.(\d+)\.\d+" $ip; + "~(?P[^:]+:[^:]+):" $ip; + } + map $remote_addr $ip_anonym2 { + default .0.0; + "~(?P(\d+)\.(\d+)\.(\d+))\.\d+" .0.0; + "~(?P[^:]+:[^:]+):" ::; + } + map $ip_anonym1$ip_anonym2 $ip_anonymized { + default 0.0.0.0; + "~(?P.*)" $ip; + } + log_format gdpr '$ip_anonymized - $remote_user [$time_local] ' + '"$request" $status $body_bytes_sent ' + '"" "$http_user_agent"'; + include /etc/nginx/sites/*; } From fec26ab38ff71c0ebe484fd3522ac5cb0437c293 Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 21:12:40 +0100 Subject: [PATCH 15/16] nodes/htz-cloud.pleroma: add debugging logs (gdpr-compatible) --- data/nginx/files/extras/htz-cloud.pleroma/pleroma | 3 +++ 1 file changed, 3 insertions(+) diff --git a/data/nginx/files/extras/htz-cloud.pleroma/pleroma b/data/nginx/files/extras/htz-cloud.pleroma/pleroma index 05771c4..3f9e6a0 100644 --- a/data/nginx/files/extras/htz-cloud.pleroma/pleroma +++ b/data/nginx/files/extras/htz-cloud.pleroma/pleroma @@ -1 +1,4 @@ client_max_body_size 16m; + + access_log /var/log/nginx/pleroma.log gdpr; + error_log /var/log/nginx/error.log; From b3ad49ac8da816d92f34b535811e775637653d67 Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sat, 20 Feb 2021 22:05:42 +0100 Subject: [PATCH 16/16] nodes/htz-cloud.pleroma: do backups --- data/backup/keys/htz-cloud.pleroma.key.vault | 1 + data/backup/keys/htz-cloud.pleroma.pub | 1 + nodes/htz-cloud/pleroma.py | 3 --- 3 files changed, 2 insertions(+), 3 deletions(-) create mode 100644 data/backup/keys/htz-cloud.pleroma.key.vault create mode 100644 data/backup/keys/htz-cloud.pleroma.pub diff --git a/data/backup/keys/htz-cloud.pleroma.key.vault b/data/backup/keys/htz-cloud.pleroma.key.vault new file mode 100644 index 0000000..06e6894 --- /dev/null +++ b/data/backup/keys/htz-cloud.pleroma.key.vault @@ -0,0 +1 @@ +encrypt$gAAAAABgMXllIGiB__clFctfOC6T4qRhFDrh_WJZU745-DZef2UpKCy0gz_2FlDAIqrNceL-Ahz1AXZrsdHUKPYAZ5AW4ne0b0G6uHQENYB0xv-ZqA3MZS26gzvNM7ejhyTCM1zO1j6ePgIxfZlaalNcuLIRAphuhu7KkJA8sGaoUMjdTqVWJUjj4Le8KHcS-s7PhB1XjkyHYxb0cKFgPxs1CgHWVjfCviVnl3yFAF1aLvYsbNcpzM_RGGIIA9YsO3yPQ8Mfk4B3truuNg1mdNaunpnhoTImF2cSNoI64f2mVaSNxxRXm1NG2qUJkZN8ZQlW8k7A1w_zUwHw9-JaimZejfPWrhew7krAbPQWEqOz7Km0RkQdbzFzxWECDIOQ_Z87n_yEFLSN3sAHA0eQ-a6oqj5Ybga5p9eeNNdOYAZyU_6KfSl9U6XSKT16brAXnsZevWQHk06ObdOPhJW5SMIQwk0TZXUOMZ11T0o0-2IMGBngOjoOxqt7gjZoiLFt4c8BkFcDkpTj25asyG2iF-2jWZ1cY91F5nDkIE3CSQzD7DYANyTI7ik9qACiY25bBYOwo9HS9TEcE-wDS2_jKolFFmEx5EFdxzIpSXdWB7EznbizgqAtu2eYubASKlBKILpeVZiqKZi8 \ No newline at end of file diff --git a/data/backup/keys/htz-cloud.pleroma.pub b/data/backup/keys/htz-cloud.pleroma.pub new file mode 100644 index 0000000..a699ae1 --- /dev/null +++ b/data/backup/keys/htz-cloud.pleroma.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK7vz3CMmmHmnWZs4b+Ohh4wnUgcME8PvZscjgS+91Qd kunsi@kunsi-t470.kunbox.net diff --git a/nodes/htz-cloud/pleroma.py b/nodes/htz-cloud/pleroma.py index 2431bbd..549ac5c 100644 --- a/nodes/htz-cloud/pleroma.py +++ b/nodes/htz-cloud/pleroma.py @@ -19,9 +19,6 @@ nodes['htz-cloud.pleroma'] = { 'gateway6': 'fe80::1', }, }, - 'backups': { - 'exclude_from_backups': True, - }, 'cron': { 'auto-authorize-sm-users': '* * * * * root echo "UPDATE users SET approval_pending=false WHERE email LIKE \'\\%@seibert-media.net\' AND approval_pending=true;" | psql pleroma >/dev/null', },