Split out aws s3 and otp roles.

5 files changed, 265 insertions, 0 deletions

diff --git a/pleroma/otp/templates/config.exs.j2 b/pleroma/otp/templates/config.exs.j2
new file mode 100644
index 0000000..d94be00
--- /dev/null
+++ b/pleroma/otp/templates/config.exs.j2
@@ -0,0 +1,44 @@
+import Config
+
+config :pleroma, Pleroma.Web.Endpoint,
+  url: [host: "{{pleroma_link_host}}", scheme: "{{pleroma_link_scheme}}", port: {{pleroma_link_port}}],
+  http: [port: {{pleroma_port}}, ip: {127, 0, 0, 1}],
+  secret_key_base: "{{pleroma_secret_key}}",
+  secure_cookie_flag: true
+
+config :pleroma, :http_security,
+  enabled: true,
+  sts: true,
+  referrer_policy: "same-origin"
+
+config :pleroma, :instance,
+  name: "{{pleroma_instance_name}}",
+  description: "{{pleroma_desc}}",
+  email: "{{pleroma_admin_email}}",
+  limit: {{pleroma_char_limit}},
+  registrations_open: {{pleroma_signup_open}},
+  invites_enabled: {{pleroma_invites_enabled}},
+  static_dir: "{{pleroma_data_dir}}/{{pleroma_instance}}/static/"
+
+config :pleroma, Pleroma.Upload,
+  uploader: Pleroma.Uploaders.Local,
+  filters: [Pleroma.Upload.Filter.Dedupe]
+
+config :pleroma, Pleroma.Uploaders.Local,
+  uploads: "{{pleroma_data_dir}}/{{pleroma_instance}}/uploads/"
+
+config :pleroma, :media_proxy,
+  enabled: false,
+  redirect_on_failure: true
+  #base_url: "https://cache.pleroma.social"
+
+# Configure your database
+config :pleroma, Pleroma.Repo,
+  adapter: Ecto.Adapters.Postgres,
+  username: "{{pleroma_db_user}}",
+  password: "{{pleroma_db_passwd}}",
+  database: "{{pleroma_db}}",
+  hostname: "{{pleroma_db_host}}",
+  pool_size: 10,
+  timeout: 60000,
+  pool_timeout: 60000
diff --git a/pleroma/otp/templates/pleroma.cloudflare.index.nginx.conf.j2 b/pleroma/otp/templates/pleroma.cloudflare.index.nginx.conf.j2
new file mode 100644
index 0000000..20ccc78
--- /dev/null
+++ b/pleroma/otp/templates/pleroma.cloudflare.index.nginx.conf.j2
@@ -0,0 +1,75 @@
+# default nginx site config for Pleroma
+#
+# Simple installation instructions:
+# 1. Install your TLS certificate, possibly using Let's Encrypt.
+# 2. Replace 'example.tld' with your instance's domain wherever it appears.
+# 3. Copy this file to /etc/nginx/sites-available/ and then add a symlink to it
+#    in /etc/nginx/sites-enabled/ and run 'nginx -s reload' or restart nginx.
+
+proxy_cache_path /tmp/{{pleroma_instance}}-pleroma-media-cache levels=1:2 keys_zone={{pleroma_instance}}-pleroma_media_cache:10m max_size=10g
+                 inactive=720m use_temp_path=off;
+
+server {
+    listen 80;
+    server_name {{nginx_server_name}};
+    return 301 https://$host$request_uri;
+}
+
+# Enable SSL session caching for improved performance
+ssl_session_cache shared:ssl_session_cache:10m;
+
+server {
+    listen 443 ssl http2;
+    server_name {{nginx_server_name}};
+
+    ssl_certificate {{nginx_ssl_cert}};
+    ssl_certificate_key {{nginx_ssl_privkey}};
+    ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
+
+    add_header Strict-Transport-Security "max-age=31536000" always;
+
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_buffers 16 8k;
+    gzip_http_version 1.1;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml;
+
+    # the nginx default is 1m, not enough for large media uploads
+    client_max_body_size 16m;
+
+    location = / {
+        return 301 http://www.$host$request_uri;
+    }
+
+    location / {
+        try_files $uri @pleroma;
+    }
+
+    location @pleroma {
+        add_header X-XSS-Protection "1; mode=block";
+        add_header X-Permitted-Cross-Domain-Policies none;
+        add_header X-Frame-Options DENY;
+        add_header X-Content-Type-Options nosniff;
+        add_header Referrer-Policy same-origin;
+        add_header X-Download-Options noopen;
+
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
+
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $http_host;
+
+        proxy_pass {{pleroma_proxy_pass}};
+
+        client_max_body_size 16m;
+    }
+
+    location /proxy {
+        proxy_cache {{pleroma_instance}}-pleroma_media_cache;
+        proxy_cache_lock on;
+        proxy_ignore_client_abort on;
+        proxy_pass {{pleroma_proxy_pass}};
+    }
+}
diff --git a/pleroma/otp/templates/pleroma.cloudflare.nginx.conf.j2 b/pleroma/otp/templates/pleroma.cloudflare.nginx.conf.j2
new file mode 100644
index 0000000..e64b00c
--- /dev/null
+++ b/pleroma/otp/templates/pleroma.cloudflare.nginx.conf.j2
@@ -0,0 +1,67 @@
+# default nginx site config for Pleroma
+#
+# Simple installation instructions:
+# 1. Install your TLS certificate, possibly using Let's Encrypt.
+# 2. Replace 'example.tld' with your instance's domain wherever it appears.
+# 3. Copy this file to /etc/nginx/sites-available/ and then add a symlink to it
+#    in /etc/nginx/sites-enabled/ and run 'nginx -s reload' or restart nginx.
+
+proxy_cache_path /tmp/{{pleroma_instance}}-pleroma-media-cache levels=1:2 keys_zone={{pleroma_instance}}-pleroma_media_cache:10m max_size=10g
+                 inactive=720m use_temp_path=off;
+
+server {
+    listen 80;
+    server_name {{nginx_server_name}};
+    return 301 https://$host$request_uri;
+}
+
+# Enable SSL session caching for improved performance
+ssl_session_cache shared:ssl_session_cache:10m;
+
+server {
+    listen 443 ssl http2;
+    server_name {{nginx_server_name}};
+
+    ssl_certificate {{nginx_ssl_cert}};
+    ssl_certificate_key {{nginx_ssl_privkey}};
+    ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
+
+    add_header Strict-Transport-Security "max-age=31536000" always;
+
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_buffers 16 8k;
+    gzip_http_version 1.1;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml;
+
+    # the nginx default is 1m, not enough for large media uploads
+    client_max_body_size 16m;
+
+    location / {
+        add_header X-XSS-Protection "1; mode=block";
+        add_header X-Permitted-Cross-Domain-Policies none;
+        add_header X-Frame-Options DENY;
+        add_header X-Content-Type-Options nosniff;
+        add_header Referrer-Policy same-origin;
+        add_header X-Download-Options noopen;
+
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
+
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $http_host;
+
+        proxy_pass {{pleroma_proxy_pass}};
+
+        client_max_body_size 16m;
+    }
+
+    location /proxy {
+        proxy_cache {{pleroma_instance}}-pleroma_media_cache;
+        proxy_cache_lock on;
+        proxy_ignore_client_abort on;
+        proxy_pass {{pleroma_proxy_pass}};
+    }
+}
diff --git a/pleroma/otp/templates/pleroma.letsencrypt.nginx.conf.j2 b/pleroma/otp/templates/pleroma.letsencrypt.nginx.conf.j2
new file mode 100644
index 0000000..5a43748
--- /dev/null
+++ b/pleroma/otp/templates/pleroma.letsencrypt.nginx.conf.j2
@@ -0,0 +1,72 @@
+# default nginx site config for Pleroma
+#
+# Simple installation instructions:
+# 1. Install your TLS certificate, possibly using Let's Encrypt.
+# 2. Replace 'example.tld' with your instance's domain wherever it appears.
+# 3. Copy this file to /etc/nginx/sites-available/ and then add a symlink to it
+#    in /etc/nginx/sites-enabled/ and run 'nginx -s reload' or restart nginx.
+
+proxy_cache_path /tmp/{{pleroma_instance}}-pleroma-media-cache levels=1:2 keys_zone={{pleroma_instance}}-pleroma_media_cache:10m max_size=10g
+                 inactive=720m use_temp_path=off;
+
+server {
+    listen 80;
+    server_name {{nginx_server_name}};
+    return 301 https://$host$request_uri;
+}
+
+# Enable SSL session caching for improved performance
+ssl_session_cache shared:ssl_session_cache:10m;
+
+server {
+    listen 443 ssl http2;
+    server_name {{nginx_server_name}};
+
+    ssl_certificate {{nginx_ssl_cert}};
+    ssl_certificate_key {{nginx_ssl_privkey}};
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+
+    add_header Strict-Transport-Security "max-age=31536000" always;
+
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_buffers 16 8k;
+    gzip_http_version 1.1;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml;
+
+    # the nginx default is 1m, not enough for large media uploads
+    client_max_body_size 16m;
+
+    location / {
+        add_header X-XSS-Protection "1; mode=block";
+        add_header X-Permitted-Cross-Domain-Policies none;
+        add_header X-Frame-Options DENY;
+        add_header X-Content-Type-Options nosniff;
+        add_header Referrer-Policy same-origin;
+        add_header X-Download-Options noopen;
+
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
+
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $http_host;
+
+        proxy_pass {{pleroma_proxy_pass}};
+
+        client_max_body_size 16m;
+    }
+
+    location /proxy {
+        proxy_cache {{pleroma_instance}}-pleroma_media_cache;
+        proxy_cache_lock on;
+        proxy_ignore_client_abort on;
+        proxy_pass {{pleroma_proxy_pass}};
+    }
+}
diff --git a/pleroma/otp/templates/setup_db.psql.j2 b/pleroma/otp/templates/setup_db.psql.j2
new file mode 100644
index 0000000..1b27174
--- /dev/null
+++ b/pleroma/otp/templates/setup_db.psql.j2
@@ -0,0 +1,7 @@
+CREATE USER {{pleroma_db_user}} WITH ENCRYPTED PASSWORD '{{pleroma_db_passwd}}';
+CREATE DATABASE {{pleroma_db}} WITH OWNER {{pleroma_db_user}};
+\c {{pleroma_db}};
+--Extensions made by ecto.migrate that need superuser access
+CREATE EXTENSION IF NOT EXISTS citext;
+CREATE EXTENSION IF NOT EXISTS pg_trgm;
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";