Merge remote-tracking branch 'origin/develop' into matrixmatrix

6 files changed, 114 insertions, 101 deletions

diff --git a/installation/apache-cache-purge.sh.example b/installation/apache-cache-purge.sh.example
new file mode 100755
index 000000000..7b4262875
--- /dev/null
+++ b/installation/apache-cache-purge.sh.example
@@ -0,0 +1,36 @@
+#!/bin/sh
+
+# A simple shell script to delete a media from Apache's mod_disk_cache.
+# You will likely need to setup a sudo rule like the following:
+#
+# Cmnd_Alias HTCACHECLEAN = /usr/local/sbin/htcacheclean
+# pleroma ALL=HTCACHECLEAN, NOPASSWD: HTCACHECLEAN
+#
+# Please also ensure you have enabled:
+#
+# config :pleroma, Pleroma.Web.MediaProxy.Invalidation.Script, url_format: :htcacheclean
+#
+# which will correctly format the URLs passed to this script for the htcacheclean utility.
+#
+
+SCRIPTNAME=${0##*/}
+
+# mod_disk_cache directory
+CACHE_DIRECTORY="/tmp/pleroma-media-cache"
+
+## Removes an item via the htcacheclean utility
+## $1 - the filename, can be a pattern .
+## $2 - the cache directory.
+purge_item() {
+    sudo htcacheclean -v -p "${2}" "${1}"
+} # purge_item
+
+purge() {
+  for url in $@
+  do
+    echo "$SCRIPTNAME delete \`$url\` from cache ($CACHE_DIRECTORY)"
+    purge_item "$url" $CACHE_DIRECTORY
+  done
+}
+
+purge $@
diff --git a/installation/download-mastofe-build.sh b/installation/download-mastofe-build.sh
deleted file mode 100755
index ee9e1c217..000000000
--- a/installation/download-mastofe-build.sh
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/bin/sh
-# Pleroma: A lightweight social networking server
-# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
-# SPDX-License-Identifier: AGPL-3.0-only
-project_id="74"
-project_branch="rebase/glitch-soc"
-static_dir="instance/static"
-# For bundling:
-# project_branch="pleroma"
-# static_dir="priv/static"
-
-if [[ ! -d "${static_dir}" ]]
-then
-	echo "Error: ${static_dir} directory is missing, are you sure you are running this script at the root of pleroma’s repository?"
-	exit 1
-fi
-
-last_modified="$(curl -s -I 'https://git.pleroma.social/api/v4/projects/'${project_id}'/jobs/artifacts/'${project_branch}'/download?job=build' | grep '^Last-Modified:' | cut -d: -f2-)"
-
-echo "branch:${project_branch}"
-echo "Last-Modified:${last_modified}"
-
-artifact="mastofe.zip"
-
-if [[ -e mastofe.timestamp ]] && [[ "${last_modified}" != "" ]]
-then
-	if [[ "$(cat mastofe.timestamp)" == "${last_modified}" ]]
-	then
-		echo "MastoFE is up-to-date, exiting…"
-		exit 0
-	fi
-fi
-
-curl -c - "https://git.pleroma.social/api/v4/projects/${project_id}/jobs/artifacts/${project_branch}/download?job=build" -o "${artifact}" || exit
-
-# TODO: Update the emoji as well
-rm -fr "${static_dir}/sw.js" "${static_dir}/packs" || exit
-unzip -q "${artifact}" || exit
-
-cp public/assets/sw.js "${static_dir}/sw.js" || exit
-cp -r public/packs "${static_dir}/packs" || exit
-
-echo "${last_modified}" > mastofe.timestamp
-rm -fr public
-rm -i "${artifact}"
diff --git a/installation/pleroma-apache.conf b/installation/pleroma-apache.conf
index 0d627f2d7..139abe9e1 100644
--- a/installation/pleroma-apache.conf
+++ b/installation/pleroma-apache.conf
@@ -1,73 +1,84 @@
-# default Apache site config for Pleroma
-#
-# needed modules: define headers proxy proxy_http proxy_wstunnel rewrite ssl
-# optional modules: cache cache_disk
+# Sample Apache config for Pleroma
 #
 # Simple installation instructions:
-# 1. Install your TLS certificate, possibly using Let's Encrypt.
-# 2. Replace 'example.tld' with your instance's domain wherever it appears.
-# 3. This assumes a Debian style Apache config. Copy this file to
-#    /etc/apache2/sites-available/ and then add a symlink to it in
-#    /etc/apache2/sites-enabled/ by running 'a2ensite pleroma-apache.conf', then restart Apache.
+# 1. Install your TLS certificate. We recommend using Let's Encrypt via Certbot
+# 2. Replace 'example.tld' with your instance's domain.
+# 3. This assumes a Debian-style Apache config. Copy this file to
+#    /etc/apache2/sites-available/ and then activate the site by running
+#    'a2ensite pleroma-apache.conf', then restart Apache.
 #
 # Optional: enable disk-based caching for the media proxy
 # For details, see https://git.pleroma.social/pleroma/pleroma/wikis/How%20to%20activate%20mediaproxy
 #
-# 1. Create the directory listed below as the CacheRoot, and make sure
+# 1. Create a directory as shown below for the CacheRoot and make sure
 #    the Apache user can write to it.
 # 2. Configure Apache's htcacheclean to clean the directory periodically.
-# 3. Run 'a2enmod cache cache_disk' and restart Apache.
+#    Your OS may provide a service you can enable to do this automatically.
 
 Define servername example.tld
 
+<IfModule !proxy_module>
+    LoadModule proxy_module libexec/apache24/mod_proxy.so
+</IfModule>
+<IfModule !proxy_http_module>
+    LoadModule proxy_http_module libexec/apache24/mod_proxy_http.so
+</IfModule>
+<IfModule !proxy_wstunnel_module>
+    LoadModule proxy_wstunnel_module libexec/apache24/mod_proxy_wstunnel.so
+</IfModule>
+<IfModule !rewrite_module>
+    LoadModule rewrite_module libexec/apache24/mod_rewrite.so
+</IfModule>
+<IfModule !ssl_module>
+    LoadModule ssl_module libexec/apache24/mod_ssl.so
+</IfModule>
+<IfModule !cache_module>
+    LoadModule cache_module libexec/apache24/mod_cache.so
+</IfModule>
+<IfModule !cache_disk_module>
+    LoadModule cache_disk_module libexec/apache24/mod_cache_disk.so
+</IfModule>
+
 ServerName ${servername}
 ServerTokens Prod
 
-ErrorLog ${APACHE_LOG_DIR}/error.log
-CustomLog ${APACHE_LOG_DIR}/access.log combined
+# If you want Pleroma-specific logs
+#ErrorLog /var/log/httpd-pleroma-error.log
+#CustomLog /var/log/httpd-pleroma-access.log combined
 
 <VirtualHost *:80>
-    Redirect permanent / https://${servername}
+    RewriteEngine on
+    RewriteCond %{SERVER_NAME} =${servername}
+    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
 </VirtualHost>
 
 <VirtualHost *:443>
     SSLEngine on
     SSLCertificateFile      /etc/letsencrypt/live/${servername}/fullchain.pem
     SSLCertificateKeyFile   /etc/letsencrypt/live/${servername}/privkey.pem
+    # Make sure you have the certbot-apache module installed
+    Include /etc/letsencrypt/options-ssl-apache.conf
 
-    # Mozilla modern configuration, tweak to your needs
-    SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
-    SSLCipherSuite          ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
-    SSLHonorCipherOrder     on
-    SSLCompression          off
-    SSLSessionTickets       off
-
-    # uncomment the following to enable mediaproxy caching on disk
-    # <IfModule mod_cache_disk.c>
-    #     CacheRoot /var/cache/apache2/mod_cache_disk
-    #     CacheDirLevels 1
-    #     CacheDirLength 2
-    #     CacheEnable disk /proxy
-    #     CacheLock on
-    # </IfModule>
+    # Uncomment the following to enable MediaProxy caching on disk
+    #CacheRoot /tmp/pleroma-media-cache/
+    #CacheDirLevels 1
+    #CacheDirLength 2
+    #CacheEnable disk /proxy
+    #CacheLock on
+    #CacheHeader on
+    #CacheDetailHeader on
+    ## 16MB max filesize for caching, configure as desired
+    #CacheMaxFileSize 16000000
+    #CacheDefaultExpire 86400
 
     RewriteEngine On
     RewriteCond %{HTTP:Connection} Upgrade [NC]
     RewriteCond %{HTTP:Upgrade} websocket [NC]
-    RewriteRule /(.*) ws://localhost:4000/$1 [P,L]
+    RewriteRule /(.*) ws://127.0.0.1:4000/$1 [P,L]
 
+    #ProxyRequests must be off or you open your server to abuse as an open proxy
     ProxyRequests off
-    # this is explicitly IPv4 since Pleroma.Web.Endpoint binds on IPv4 only
-    # and `localhost.` resolves to [::0] on some systems: see issue #930
     ProxyPass / http://127.0.0.1:4000/
     ProxyPassReverse / http://127.0.0.1:4000/
-
-    RequestHeader set Host ${servername}
     ProxyPreserveHost On
 </VirtualHost>
-
-# OCSP Stapling, only in httpd 2.3.3 and later
-SSLUseStapling          on
-SSLStaplingResponderTimeout 5
-SSLStaplingReturnResponderErrors off
-SSLStaplingCache        shmcb:/var/run/ocsp(128000)
diff --git a/installation/pleroma.nginx b/installation/pleroma.nginx
index d301ca615..9890cb2b1 100644
--- a/installation/pleroma.nginx
+++ b/installation/pleroma.nginx
@@ -9,6 +9,12 @@
 proxy_cache_path /tmp/pleroma-media-cache levels=1:2 keys_zone=pleroma_media_cache:10m max_size=10g
                  inactive=720m use_temp_path=off;
 
+# this is explicitly IPv4 since Pleroma.Web.Endpoint binds on IPv4 only
+# and `localhost.` resolves to [::0] on some systems: see issue #930
+upstream phoenix {
+    server 127.0.0.1:4000 max_fails=5 fail_timeout=60s;
+}
+
 server {
     server_name    example.tld;
 
@@ -63,19 +69,16 @@ server {
 
     # the nginx default is 1m, not enough for large media uploads
     client_max_body_size 16m;
+    ignore_invalid_headers off;
 
-    location / {
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $http_host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
-        # this is explicitly IPv4 since Pleroma.Web.Endpoint binds on IPv4 only
-        # and `localhost.` resolves to [::0] on some systems: see issue #930
-        proxy_pass http://127.0.0.1:4000;
-
-        client_max_body_size 16m;
+    location / {
+        proxy_pass http://phoenix;
     }
 
     location ~ ^/(media|proxy) {
@@ -83,12 +86,11 @@ server {
         slice              1m;
         proxy_cache_key    $host$uri$is_args$args$slice_range;
         proxy_set_header   Range $slice_range;
-        proxy_http_version 1.1;
         proxy_cache_valid  200 206 301 304 1h;
         proxy_cache_lock   on;
         proxy_ignore_client_abort on;
         proxy_buffering    on;
         chunked_transfer_encoding on;
-        proxy_pass         http://127.0.0.1:4000;
+        proxy_pass         http://phoenix;
     }
 }
diff --git a/installation/pleroma.service b/installation/pleroma.service
index 5dcbc1387..8338228d8 100644
--- a/installation/pleroma.service
+++ b/installation/pleroma.service
@@ -29,8 +29,6 @@ ProtectHome=true
 ProtectSystem=full
 ; Sets up a new /dev mount for the process and only adds API pseudo devices like /dev/null, /dev/zero or /dev/random but not physical devices. Disabled by default because it may not work on devices like the Raspberry Pi.
 PrivateDevices=false
-; Ensures that the service process and all its children can never gain new privileges through execve().
-NoNewPrivileges=true
 ; Drops the sysadmin capability from the daemon.
 CapabilityBoundingSet=~CAP_SYS_ADMIN
 
diff --git a/installation/pleroma.vcl b/installation/pleroma.vcl
index 154747aa6..4752510ea 100644
--- a/installation/pleroma.vcl
+++ b/installation/pleroma.vcl
@@ -1,3 +1,4 @@
+# Recommended varnishncsa logging format: '%h %l %u %t "%m %{X-Forwarded-Proto}i://%{Host}i%U%q %H" %s %b "%{Referer}i" "%{User-agent}i"'
 vcl 4.1;
 import std;
 
@@ -14,8 +15,11 @@ acl purge {
 sub vcl_recv {
     # Redirect HTTP to HTTPS
     if (std.port(server.ip) != 443) {
+      set req.http.X-Forwarded-Proto = "http";
       set req.http.x-redir = "https://" + req.http.host + req.url;
       return (synth(750, ""));
+    } else {
+      set req.http.X-Forwarded-Proto = "https";
     }
 
     # CHUNKED SUPPORT
@@ -55,6 +59,13 @@ sub vcl_backend_response {
       set beresp.http.CR = beresp.http.content-range;
     }
 
+    # Bypass cache for large files
+    # 50000000 ~ 50MB
+    if (std.integer(beresp.http.content-length, 0) > 50000000) {
+       set beresp.uncacheable = true;
+       return(deliver);
+    }
+
     # Don't cache objects that require authentication
     if (beresp.http.Authorization && !beresp.http.Cache-Control ~ "public") {
       set beresp.uncacheable = true;
@@ -105,7 +116,7 @@ sub vcl_hash {
 
 sub vcl_backend_fetch {
     # Be more lenient for slow servers on the fediverse
-    if bereq.url ~ "^/proxy/" {
+    if (bereq.url ~ "^/proxy/") {
       set bereq.first_byte_timeout = 300s;
     }