Merge branch 'release/2.1.0' into 'stable'v2.1.0

Release/2.1.0

See merge request pleroma/pleroma!2927

4 files changed, 108 insertions, 18 deletions

diff --git a/installation/freebsd/rc.d/pleroma b/installation/freebsd/rc.d/pleroma
new file mode 100755
index 000000000..f62aef18d
--- /dev/null
+++ b/installation/freebsd/rc.d/pleroma
@@ -0,0 +1,27 @@
+#!/bin/sh
+# $FreeBSD$
+# PROVIDE: pleroma
+# REQUIRE: DAEMON postgresql
+# KEYWORD: shutdown
+
+# sudo -u pleroma MIX_ENV=prod elixir --erl \"-detached\" -S mix phx.server
+
+. /etc/rc.subr
+
+name=pleroma
+rcvar=pleroma_enable
+
+desc="Pleroma Social Media Platform"
+
+load_rc_config ${name}
+
+: ${pleroma_user:=pleroma}
+: ${pleroma_home:=$(getent passwd ${pleroma_user} | awk -F: '{print $6}')}
+: ${pleroma_chdir:="${pleroma_home}/pleroma"}
+: ${pleroma_env:="HOME=${pleroma_home} MIX_ENV=prod"}
+
+command=/usr/local/bin/elixir
+command_args="--erl \"-detached\" -S /usr/local/bin/mix phx.server"
+procname="*beam.smp"
+
+run_rc_command "$1"
diff --git a/installation/init.d/pleroma b/installation/init.d/pleroma
index ed50bb551..384536f7e 100755
--- a/installation/init.d/pleroma
+++ b/installation/init.d/pleroma
@@ -1,21 +1,45 @@
 #!/sbin/openrc-run
-
-# Requires OpenRC >= 0.35
-directory=/opt/pleroma
-
-command=/usr/bin/mix
-command_args="phx.server"
+supervisor=supervise-daemon
 command_user=pleroma:pleroma
 command_background=1
-
-export PORT=4000
-export MIX_ENV=prod
-
 # Ask process to terminate within 30 seconds, otherwise kill it
 retry="SIGTERM/30/SIGKILL/5"
-
 pidfile="/var/run/pleroma.pid"
+directory=/opt/pleroma
+healthcheck_delay=60
+healthcheck_timer=30
+
+: ${pleroma_port:-4000}
+
+# Needs OpenRC >= 0.42
+#respawn_max=0
+#respawn_delay=5
+
+# put pleroma_console=YES in /etc/conf.d/pleroma if you want to be able to
+# connect to pleroma via an elixir console
+if yesno "${pleroma_console}"; then
+	command=elixir
+	command_args="--name pleroma@127.0.0.1 --erl '-kernel inet_dist_listen_min 9001 inet_dist_listen_max 9001 inet_dist_use_interface {127,0,0,1}' -S mix phx.server"
+
+	start_post() {
+		einfo "You can get a console by using this command as pleroma's user:"
+		einfo "iex --name console@127.0.0.1 --remsh pleroma@127.0.0.1"
+	}
+else
+	command=/usr/bin/mix
+	command_args="phx.server"
+fi
+
+export MIX_ENV=prod
 
 depend() {
-    need nginx postgresql
+	need nginx postgresql
+}
+
+healthcheck() {
+	# put pleroma_health=YES in /etc/conf.d/pleroma if you want healthchecking
+	# and make sure you have curl installed
+	yesno "$pleroma_health" || return 0
+
+	curl -q "localhost:${pleroma_port}/api/pleroma/healthcheck"
 }
diff --git a/installation/nginx-cache-purge.sh.example b/installation/nginx-cache-purge.sh.example
new file mode 100755
index 000000000..5f6cbb128
--- /dev/null
+++ b/installation/nginx-cache-purge.sh.example
@@ -0,0 +1,40 @@
+#!/bin/sh
+
+# A simple shell script to delete a media from the Nginx cache.
+
+SCRIPTNAME=${0##*/}
+
+# NGINX cache directory
+CACHE_DIRECTORY="/tmp/pleroma-media-cache"
+
+## Return the files where the items are cached.
+## $1 - the filename, can be a pattern .
+## $2 - the cache directory.
+## $3 - (optional) the number of parallel processes to run for grep.
+get_cache_files() {
+    local max_parallel=${3-16}
+    find $2 -maxdepth 2 -type d | xargs -P $max_parallel -n 1 grep -E -Rl "^KEY:.*$1" | sort -u
+}
+
+## Removes an item from the given cache zone.
+## $1 - the filename, can be a pattern .
+## $2 - the cache directory.
+purge_item() {
+  for f in $(get_cache_files $1 $2); do
+      echo "found file: $f"
+      [ -f $f ] || continue
+      echo "Deleting $f from $2."
+      rm $f
+  done
+} # purge_item
+
+purge() {
+  for url in "$@"
+  do
+    echo "$SCRIPTNAME delete \`$url\` from cache ($CACHE_DIRECTORY)"
+    purge_item $url $CACHE_DIRECTORY
+  done
+
+}
+
+purge $@
diff --git a/installation/pleroma.nginx b/installation/pleroma.nginx
index 688be3e71..d301ca615 100644
--- a/installation/pleroma.nginx
+++ b/installation/pleroma.nginx
@@ -37,18 +37,17 @@ server {
 
     listen 443 ssl http2;
     listen [::]:443 ssl http2;
-    ssl_session_timeout 5m;
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
+    ssl_session_tickets off;
 
     ssl_trusted_certificate   /etc/letsencrypt/live/example.tld/chain.pem;
     ssl_certificate           /etc/letsencrypt/live/example.tld/fullchain.pem;
     ssl_certificate_key       /etc/letsencrypt/live/example.tld/privkey.pem;
 
-    # Add TLSv1.0 to support older devices
-    ssl_protocols TLSv1.2;
-    # Uncomment line below if you want to support older devices (Before Android 4.4.2, IE 8, etc.)
-    # ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
+    ssl_protocols TLSv1.2 TLSv1.3;
     ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
-    ssl_prefer_server_ciphers on;
+    ssl_prefer_server_ciphers off;
     # In case of an old server with an OpenSSL version of 1.0.2 or below,
     # leave only prime256v1 or comment out the following line.
     ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;