diff options
Diffstat (limited to 'roles/pleroma-otp/templates')
| -rw-r--r-- | roles/pleroma-otp/templates/config.exs.j2 | 43 | ||||
| -rw-r--r-- | roles/pleroma-otp/templates/pleroma.cloudflare.nginx.conf.j2 | 74 | ||||
| -rw-r--r-- | roles/pleroma-otp/templates/pleroma.nginx.conf.j2 | 95 | ||||
| -rw-r--r-- | roles/pleroma-otp/templates/setup_db.psql.j2 | 7 |
4 files changed, 219 insertions, 0 deletions
diff --git a/roles/pleroma-otp/templates/config.exs.j2 b/roles/pleroma-otp/templates/config.exs.j2 new file mode 100644 index 0000000..06d1fb8 --- /dev/null +++ b/roles/pleroma-otp/templates/config.exs.j2 @@ -0,0 +1,43 @@ +use Mix.Config + +config :pleroma, Pleroma.Web.Endpoint, + url: [host: "{{pleroma_link_host}}", scheme: "{{pleroma_link_scheme}}", port: {{pleroma_link_port}}], + http: [port: {{pleroma_port}}, ip: {127, 0, 0, 1}], + secret_key_base: "{{pleroma_secret_key}}", + secure_cookie_flag: true + +config :pleroma, :http_security, + enabled: true, + sts: true, + referrer_policy: "same-origin" + +config :pleroma, :instance, + name: "{{pleroma_instance_name}}", + description: "{{pleroma_desc}}", + email: "{{pleroma_admin_email}}", + limit: {{pleroma_char_limit}}, + registrations_open: {{pleroma_signup_open}}, + invites_enabled: {{pleroma_invites_enabled}} + +config :pleroma, Pleroma.Upload, + uploader: Pleroma.Uploaders.Local, + filters: [Pleroma.Upload.Filter.Dedupe] + +config :pleroma, Pleroma.Uploaders.Local, + uploads: "{{pleroma_data_dir}}/{{pleroma_instance}}/" + +config :pleroma, :media_proxy, + enabled: false, + redirect_on_failure: true + #base_url: "https://cache.pleroma.social" + +# Configure your database +config :pleroma, Pleroma.Repo, + adapter: Ecto.Adapters.Postgres, + username: "{{pleroma_db_user}}", + password: "{{pleroma_db_passwd}}", + database: "{{pleroma_db}}", + hostname: "{{pleroma_db_host}}", + pool_size: 10, + timeout: 60000, + pool_timeout: 60000 diff --git a/roles/pleroma-otp/templates/pleroma.cloudflare.nginx.conf.j2 b/roles/pleroma-otp/templates/pleroma.cloudflare.nginx.conf.j2 new file mode 100644 index 0000000..4363b88 --- /dev/null +++ b/roles/pleroma-otp/templates/pleroma.cloudflare.nginx.conf.j2 @@ -0,0 +1,74 @@ +# default nginx site config for Pleroma +# +# Simple installation instructions: +# 1. Install your TLS certificate, possibly using Let's Encrypt. +# 2. Replace 'example.tld' with your instance's domain wherever it appears. +# 3. Copy this file to /etc/nginx/sites-available/ and then add a symlink to it +# in /etc/nginx/sites-enabled/ and run 'nginx -s reload' or restart nginx. + +proxy_cache_path /tmp/{{pleroma_instance}}-pleroma-media-cache levels=1:2 keys_zone={{pleroma_instance}}-pleroma_media_cache:10m max_size=10g + inactive=720m use_temp_path=off; + +server { + listen {{nginx_port}}; + # listen [::]:{{nginx_port}}; + server_name _; + return 301 https://$host$request_uri; +} + +# Enable SSL session caching for improved performance +ssl_session_cache shared:ssl_session_cache:10m; + +server { + listen {{nginx_ssl_port}} ssl http2; + # listen [::]:{{nginx_ssl_port}} ssl ipv6only=on; + server_name _; + + ssl_certificate {{nginx_ssl_cert}}; + ssl_certificate_key {{nginx_ssl_privkey}}; + include /etc/letsencrypt/options-ssl-nginx.conf; + # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; + + ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1; + ssl_stapling on; + ssl_stapling_verify on; + + add_header Strict-Transport-Security "max-age=31536000" always; + + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_buffers 16 8k; + gzip_http_version 1.1; + gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml; + + # the nginx default is 1m, not enough for large media uploads + client_max_body_size 16m; + + location / { + add_header X-XSS-Protection "1; mode=block"; + add_header X-Permitted-Cross-Domain-Policies none; + add_header X-Frame-Options DENY; + add_header X-Content-Type-Options nosniff; + add_header Referrer-Policy same-origin; + add_header X-Download-Options noopen; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $http_host; + + proxy_pass {{pleroma_proxy_pass}}; + + client_max_body_size 16m; + } + + location /proxy { + proxy_cache {{pleroma_instance}}-pleroma_media_cache; + proxy_cache_lock on; + proxy_ignore_client_abort on; + proxy_pass {{pleroma_proxy_pass}}; + } +} diff --git a/roles/pleroma-otp/templates/pleroma.nginx.conf.j2 b/roles/pleroma-otp/templates/pleroma.nginx.conf.j2 new file mode 100644 index 0000000..27c9165 --- /dev/null +++ b/roles/pleroma-otp/templates/pleroma.nginx.conf.j2 @@ -0,0 +1,95 @@ +# default nginx site config for Pleroma +# +# Simple installation instructions: +# 1. Install your TLS certificate, possibly using Let's Encrypt. +# 2. Replace 'example.tld' with your instance's domain wherever it appears. +# 3. Copy this file to /etc/nginx/sites-available/ and then add a symlink to it +# in /etc/nginx/sites-enabled/ and run 'nginx -s reload' or restart nginx. + +proxy_cache_path /tmp/{{pleroma_instance}}-pleroma-media-cache levels=1:2 keys_zone={{pleroma_instance}}-pleroma_media_cache:10m max_size=10g + inactive=720m use_temp_path=off; + +server { + listen {{nginx_port}}; + # listen [::]:{{nginx_port}}; + server_name {{nginx_server_name}}; + return 301 https://$server_name$request_uri; + + # Uncomment this if you need to use the 'webroot' method with certbot. Make sure + # that you also create the .well-known/acme-challenge directory structure in pleroma/priv/static and + # that is is accessible by the webserver. You may need to load this file with the ssl + # server block commented out, run certbot to get the certificate, and then uncomment it. + # + # location ~ /\.well-known/acme-challenge { + # root <path to install>/pleroma/priv/static/; + # } +} + +# Enable SSL session caching for improved performance +ssl_session_cache shared:ssl_session_cache:10m; + +server { + listen {{nginx_ssl_port}} ssl http2; + # listen [::]:{{nginx_ssl_port}} ssl ipv6only=on; + server_name {{nginx_server_name}}; + + ssl_certificate {{nginx_ssl_cert}}; + ssl_certificate_key {{nginx_ssl_privkey}}; + include /etc/letsencrypt/options-ssl-nginx.conf; + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; + + ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1; + ssl_stapling on; + ssl_stapling_verify on; + + add_header Strict-Transport-Security "max-age=31536000" always; + + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_buffers 16 8k; + gzip_http_version 1.1; + gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml; + + # the nginx default is 1m, not enough for large media uploads + client_max_body_size 16m; + + location / { + # if you do not want remote frontends to be able to access your Pleroma backend + # server, remove these lines. + # add_header 'Access-Control-Allow-Origin' '*' always; + # add_header 'Access-Control-Allow-Methods' 'POST, PUT, DELETE, GET, PATCH, OPTIONS' always; + # add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, Idempotency-Key' always; + # add_header 'Access-Control-Expose-Headers' 'Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id' always; + # if ($request_method = OPTIONS) { + # return 204; + # } + # stop removing lines here. + + add_header X-XSS-Protection "1; mode=block"; + add_header X-Permitted-Cross-Domain-Policies none; + add_header X-Frame-Options DENY; + add_header X-Content-Type-Options nosniff; + add_header Referrer-Policy same-origin; + add_header X-Download-Options noopen; + + # Uncomment this only after you get HTTPS working. + # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $http_host; + + proxy_pass {{pleroma_proxy_pass}}; + + client_max_body_size 16m; + } + + location /proxy { + proxy_cache {{pleroma_instance}}-pleroma_media_cache; + proxy_cache_lock on; + proxy_ignore_client_abort on; + proxy_pass {{pleroma_proxy_pass}}; + } +} diff --git a/roles/pleroma-otp/templates/setup_db.psql.j2 b/roles/pleroma-otp/templates/setup_db.psql.j2 new file mode 100644 index 0000000..1b27174 --- /dev/null +++ b/roles/pleroma-otp/templates/setup_db.psql.j2 @@ -0,0 +1,7 @@ +CREATE USER {{pleroma_db_user}} WITH ENCRYPTED PASSWORD '{{pleroma_db_passwd}}'; +CREATE DATABASE {{pleroma_db}} WITH OWNER {{pleroma_db_user}}; +\c {{pleroma_db}}; +--Extensions made by ecto.migrate that need superuser access +CREATE EXTENSION IF NOT EXISTS citext; +CREATE EXTENSION IF NOT EXISTS pg_trgm; +CREATE EXTENSION IF NOT EXISTS "uuid-ossp"; |