From 48c4f88ffdc9ad4eeb998dee98b603e7b16145e8 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@FreeBSD.org>
Date: Wed, 12 Dec 2018 17:31:47 +0000
Subject: Update proxy config to improve behavior and allow compatibility with
 Safari on MacOS and iOS

---
 installation/pleroma.nginx | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'installation')

diff --git a/installation/pleroma.nginx b/installation/pleroma.nginx
index e1184fe77..cf7cb8084 100644
--- a/installation/pleroma.nginx
+++ b/installation/pleroma.nginx
@@ -72,9 +72,13 @@ server {
 
     location ~ ^/(media|proxy) {
         proxy_cache pleroma_media_cache;
+        slice              1m;
+        proxy_cache_key    $host$uri$is_args$args$slice_range;
+        proxy_set_header   Range $slice_range;
+        proxy_http_version 1.1;
+        proxy_cache_valid  200 206 301 304 1h;
         proxy_cache_lock on;
         proxy_ignore_client_abort on;
-        proxy_buffering off;
         chunked_transfer_encoding on;
         proxy_pass http://localhost:4000;
     }
-- 
cgit v1.2.3


From d56772c813c86c4eb4c4ae97782f4d6d57a98abe Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@FreeBSD.org>
Date: Wed, 12 Dec 2018 17:36:00 +0000
Subject: proxy buffering still needs to be off

---
 installation/pleroma.nginx | 1 +
 1 file changed, 1 insertion(+)

(limited to 'installation')

diff --git a/installation/pleroma.nginx b/installation/pleroma.nginx
index cf7cb8084..46b84fb50 100644
--- a/installation/pleroma.nginx
+++ b/installation/pleroma.nginx
@@ -79,6 +79,7 @@ server {
         proxy_cache_valid  200 206 301 304 1h;
         proxy_cache_lock on;
         proxy_ignore_client_abort on;
+        proxy_buffering off;
         chunked_transfer_encoding on;
         proxy_pass http://localhost:4000;
     }
-- 
cgit v1.2.3


From 04513a13e0430a72228280739dc401089c7dc8b3 Mon Sep 17 00:00:00 2001
From: nonlinear <matthew@wishek.com>
Date: Fri, 14 Dec 2018 13:13:14 -0800
Subject: Added init file for OpenBSD

---
 installation/rc.d/pleromad | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100755 installation/rc.d/pleromad

(limited to 'installation')

diff --git a/installation/rc.d/pleromad b/installation/rc.d/pleromad
new file mode 100755
index 000000000..b19ce1e74
--- /dev/null
+++ b/installation/rc.d/pleromad
@@ -0,0 +1,26 @@
+#!/bin/ksh
+#
+
+daemon="/usr/local/bin/elixir"
+daemon_flags="--detached -S /usr/local/bin/mix phx.server"
+daemon_user="_pleroma"
+
+. /etc/rc.d/rc.subr
+
+rc_reload=NO
+#pexp="/usr/local/lib/erlang19/erts-8.3/bin/beam -- -root /usr/local/lib/erlang19 -progname erl19 -- -home /home/_pleroma -- -pa /usr/local/lib/elixir/bin/../lib/eex/ebin /usr/local/lib/elixir/bin/../lib/elixir/ebin /usr/local/lib/elixir/bin/../lib/ex_unit/ebin /usr/local/lib/elixir/bin/../lib/iex/ebin /usr/local/lib/elixir/bin/../lib/logger/ebin /usr/local/lib/elixir/bin/../lib/mix/ebin -elixir ansi_enabled true -noshell -s elixir start_cli -noshell -noinput -extra --detached -S /usr/local/bin/mix phx.server"
+pexp="phx.server"
+
+rc_check() {
+	pgrep -q -U _pleroma -f "phx.server"
+}
+
+rc_start() {
+	${rcexec} "cd pleroma; ${daemon} ${daemon_flags}"
+}
+
+rc_stop() {
+	pkill -q -U _pleroma -f "phx.server"
+}
+
+rc_cmd $1
-- 
cgit v1.2.3


From 75f2177d5b68d610b859c18eddb14540d1ee92b5 Mon Sep 17 00:00:00 2001
From: nonlinear <matthew@wishek.com>
Date: Sat, 15 Dec 2018 14:00:00 -0800
Subject: Update/add OpenBSD config files

---
 installation/openbsd/httpd.conf    | 36 +++++++++++++++++++++++++++++++
 installation/openbsd/rc.d/pleromad | 34 +++++++++++++++++++++++++++++
 installation/openbsd/relayd.conf   | 44 ++++++++++++++++++++++++++++++++++++++
 installation/rc.d/pleromad         | 26 ----------------------
 4 files changed, 114 insertions(+), 26 deletions(-)
 create mode 100644 installation/openbsd/httpd.conf
 create mode 100755 installation/openbsd/rc.d/pleromad
 create mode 100644 installation/openbsd/relayd.conf
 delete mode 100755 installation/rc.d/pleromad

(limited to 'installation')

diff --git a/installation/openbsd/httpd.conf b/installation/openbsd/httpd.conf
new file mode 100644
index 000000000..82f4803fd
--- /dev/null
+++ b/installation/openbsd/httpd.conf
@@ -0,0 +1,36 @@
+#
+# Default httpd.conf file for Pleroma on OpenBSD
+# Simple installation instructions
+# 1. Place file in /etc
+# 2. Replace <IPv4 address> with your public IP address
+# 3. If using IPv6, uncomment IPv6 lines and replace <IPv6 address> with your public IPv6 address
+# 4. Check file using 'doas httpd -n'
+# 5. Enable and start httpd:
+#      # doas rcctl enable httpd
+#      # doas rcctl start httpd
+#
+
+ext_inet="<IPv4 address>"
+#ext_inet6="<IPv6 address>"
+
+server "default" {
+    listen on $ext_inet port 80 # Comment to disable listening on IPv4
+#    listen on $ext_inet6 port 80 # Comment to disable listening on IPv6
+    listen on 127.0.0.1 port 80 # Do NOT comment this line
+
+    log syslog
+    directory no index
+
+    location "/.well-known/acme-challenge/*" {
+        root "/acme"
+        request strip 2
+    }
+
+    location "/robots.txt" { root "/htdocs/local/" }
+    location "/*" { block return 302 "https://$HTTP_HOST$REQUEST_URI" }
+}
+
+types {
+    include "/usr/share/misc/mime.types"
+}
+
diff --git a/installation/openbsd/rc.d/pleromad b/installation/openbsd/rc.d/pleromad
new file mode 100755
index 000000000..19ac4bb51
--- /dev/null
+++ b/installation/openbsd/rc.d/pleromad
@@ -0,0 +1,34 @@
+#!/bin/ksh
+#
+# Default init file for Pleroma on OpenBSD
+#
+# Simple installation instructions:
+# 1. Install Pleroma per wiki instructions
+# 2. Place this pleromad file in /etc/rc.d
+# 3. Enable and start Pleroma
+#	# doas rcctl enable pleromad
+#	# doas rcctl start pleromad
+#
+
+daemon="/usr/local/bin/elixir"
+daemon_flags="--detached -S /usr/local/bin/mix phx.server"
+daemon_user="_pleroma"
+
+. /etc/rc.d/rc.subr
+
+rc_reload=NO
+pexp="phx.server"
+
+rc_check() {
+	pgrep -q -U _pleroma -f "phx.server"
+}
+
+rc_start() {
+	${rcexec} "cd pleroma; ${daemon} ${daemon_flags}"
+}
+
+rc_stop() {
+	pkill -q -U _pleroma -f "phx.server"
+}
+
+rc_cmd $1
diff --git a/installation/openbsd/relayd.conf b/installation/openbsd/relayd.conf
new file mode 100644
index 000000000..31c2c1129
--- /dev/null
+++ b/installation/openbsd/relayd.conf
@@ -0,0 +1,44 @@
+#
+# Default relayd.conf file for Pleroma on OpenBSD
+# Simple installation instructions:
+# 1. Place in /etc
+# 2. Replace <ipaddr> with your public IPv4 address
+# 3. If using IPv6i, uncomment IPv6 lines and replace <ip6addr> with your public IPv6 address
+# 4. Check file using 'doas relayd -n'
+# 5. Reload/start relayd
+#      # doas rcctl enable relayd
+#      # doas rcctl start relayd
+#
+
+ext_inet="<ipaddr>"
+#ext_inet6="<ip6addr>"
+
+table <pleroma_server> { 127.0.0.1 }
+table <httpd_server> { 127.0.0.1 }
+
+http protocol plerup { # Protocol for upstream pleroma server
+    #tcp { nodelay, sack, socket buffer 65536, backlog 128 } # Uncomment and adjust as you see fit
+    tls ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA0-POLY1305"
+    tls ecdhe secp384r1
+
+    # Forward some paths to the local server (as pleroma won't respond to them as you might want)
+    pass request quick path "/robots.txt" forward to <httpd_server>
+
+    # Append a bunch of headers
+    match request header append "X-Forwarded-For" value "$REMOTE_ADDR" # This two header and the next one are not strictl required by pleroma but adding them won't hurt
+    match request header append "X-Forwarded-By" value "$SERVER_ADDR:$SERVER_PORT"
+
+    match request header append "Connection" value "upgrade"
+
+}
+
+relay wwwtls {
+    listen on $ext_inet port https tls # Comment to disable listening on IPv4
+#    listen on $ext_inet6 port https tls # Comment to disable listening on IPv6
+
+    protocol plerup
+
+    forward to <pleroma_server> port 4000 check http "/" code 200
+    forward to <httpd_server> port 80 check http "/robots.txt" code 200
+}
+
diff --git a/installation/rc.d/pleromad b/installation/rc.d/pleromad
deleted file mode 100755
index b19ce1e74..000000000
--- a/installation/rc.d/pleromad
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/bin/ksh
-#
-
-daemon="/usr/local/bin/elixir"
-daemon_flags="--detached -S /usr/local/bin/mix phx.server"
-daemon_user="_pleroma"
-
-. /etc/rc.d/rc.subr
-
-rc_reload=NO
-#pexp="/usr/local/lib/erlang19/erts-8.3/bin/beam -- -root /usr/local/lib/erlang19 -progname erl19 -- -home /home/_pleroma -- -pa /usr/local/lib/elixir/bin/../lib/eex/ebin /usr/local/lib/elixir/bin/../lib/elixir/ebin /usr/local/lib/elixir/bin/../lib/ex_unit/ebin /usr/local/lib/elixir/bin/../lib/iex/ebin /usr/local/lib/elixir/bin/../lib/logger/ebin /usr/local/lib/elixir/bin/../lib/mix/ebin -elixir ansi_enabled true -noshell -s elixir start_cli -noshell -noinput -extra --detached -S /usr/local/bin/mix phx.server"
-pexp="phx.server"
-
-rc_check() {
-	pgrep -q -U _pleroma -f "phx.server"
-}
-
-rc_start() {
-	${rcexec} "cd pleroma; ${daemon} ${daemon_flags}"
-}
-
-rc_stop() {
-	pkill -q -U _pleroma -f "phx.server"
-}
-
-rc_cmd $1
-- 
cgit v1.2.3


From 9d3eda1959197974ad7586a720cabf93b4d4ea0d Mon Sep 17 00:00:00 2001
From: scarlett <nia@netbsd.org>
Date: Sun, 16 Dec 2018 12:33:50 +0000
Subject: Add an rc.d script for NetBSD.

---
 installation/netbsd/rc.d/pleroma | 66 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100755 installation/netbsd/rc.d/pleroma

(limited to 'installation')

diff --git a/installation/netbsd/rc.d/pleroma b/installation/netbsd/rc.d/pleroma
new file mode 100755
index 000000000..34b818270
--- /dev/null
+++ b/installation/netbsd/rc.d/pleroma
@@ -0,0 +1,66 @@
+#!/bin/sh
+# PROVIDE: pleroma
+# REQUIRE: DAEMON pgsql
+
+if [ -f /etc/rc.subr ]; then
+	. /etc/rc.subr
+fi
+
+name="pleroma"
+rcvar=${name}
+command="/usr/pkg/bin/elixir"
+command_args="/usr/pkg/bin/mix phx.server &"
+start_cmd=pleroma_start
+start_precmd="ulimit -n unlimited"
+pidfile="${pleroma_home}/pleroma/pid"
+
+pleroma_chdir="${pleroma_home}/pleroma"
+pleroma_env="HOME=${pleroma_home} MIX_ENV=prod"
+pleroma_user="pleroma"
+
+pleroma_start()
+{
+	echo "Starting ${name}."
+	${start_precmd}
+	su -m ${pleroma_user} -c "cd ${pleroma_chdir} && \
+	    ${pleroma_env} ${command} ${command_args}"
+	echo $! > ${pidfile}
+}
+
+check_pidfile()
+{
+	read _pid _junk < ${pidfile}
+	echo -n "$(ps -axo pid | grep ${_pid})"
+}
+
+if [ -f /etc/rc.subr -a -d /etc/rc.d -a -f /etc/rc.d/DAEMON ]; then	# newer NetBSD
+	load_rc_config ${name}
+	run_rc_command "$1"
+else				# ancient NetBSD, Solaris and illumos, Linux, etc...
+	cmd=${1:-start}
+
+	case ${cmd} in
+		start)
+			echo "Starting ${name}."
+			${start_cmd}
+			;;
+
+		stop)
+			echo "Stopping ${name}."
+			kill `cat ${pidfile}`
+			rm ${pidfile}
+			;;
+
+		restart)
+			( $0 stop )
+			sleep 5
+			$0 start
+			;;
+
+		*)
+			echo 1>&2 "Usage: $0 [start|stop|restart]"
+			exit 1
+			;;
+	esac
+	exit 0
+fi
-- 
cgit v1.2.3


From 4b40e4188c9d9ccbe1c5908fc4bead09ad2c08f2 Mon Sep 17 00:00:00 2001
From: scarlett <nia@netbsd.org>
Date: Sun, 16 Dec 2018 13:11:17 +0000
Subject: Simplify the NetBSD rc script.

---
 installation/netbsd/rc.d/pleroma | 29 ++++++++++-------------------
 1 file changed, 10 insertions(+), 19 deletions(-)

(limited to 'installation')

diff --git a/installation/netbsd/rc.d/pleroma b/installation/netbsd/rc.d/pleroma
index 34b818270..1114668ee 100755
--- a/installation/netbsd/rc.d/pleroma
+++ b/installation/netbsd/rc.d/pleroma
@@ -9,34 +9,25 @@ fi
 name="pleroma"
 rcvar=${name}
 command="/usr/pkg/bin/elixir"
-command_args="/usr/pkg/bin/mix phx.server &"
-start_cmd=pleroma_start
+command_args="--detached -S /usr/pkg/bin/mix phx.server"
 start_precmd="ulimit -n unlimited"
-pidfile="${pleroma_home}/pleroma/pid"
+pidfile="/dev/null"
 
 pleroma_chdir="${pleroma_home}/pleroma"
 pleroma_env="HOME=${pleroma_home} MIX_ENV=prod"
-pleroma_user="pleroma"
-
-pleroma_start()
-{
-	echo "Starting ${name}."
-	${start_precmd}
-	su -m ${pleroma_user} -c "cd ${pleroma_chdir} && \
-	    ${pleroma_env} ${command} ${command_args}"
-	echo $! > ${pidfile}
-}
 
 check_pidfile()
 {
-	read _pid _junk < ${pidfile}
-	echo -n "$(ps -axo pid | grep ${_pid})"
+	pid=$(pgrep -U "${pleroma_user}" /bin/beam.smp$)
+	echo -n "${pid}"
 }
 
-if [ -f /etc/rc.subr -a -d /etc/rc.d -a -f /etc/rc.d/DAEMON ]; then	# newer NetBSD
+if [ -f /etc/rc.subr -a -d /etc/rc.d -a -f /etc/rc.d/DAEMON ]; then
+	# newer NetBSD
 	load_rc_config ${name}
 	run_rc_command "$1"
-else				# ancient NetBSD, Solaris and illumos, Linux, etc...
+else
+	# ancient NetBSD, Solaris and illumos, Linux, etc...
 	cmd=${1:-start}
 
 	case ${cmd} in
@@ -47,8 +38,8 @@ else				# ancient NetBSD, Solaris and illumos, Linux, etc...
 
 		stop)
 			echo "Stopping ${name}."
-			kill `cat ${pidfile}`
-			rm ${pidfile}
+			check_pidfile
+			! [ -n ${pid} ] && kill ${pid}
 			;;
 
 		restart)
-- 
cgit v1.2.3


From 64035201b56ee78dc937dfa675e610c03850dcad Mon Sep 17 00:00:00 2001
From: shibayashi <shibayashi@cypherpunk.observer>
Date: Fri, 28 Dec 2018 21:09:48 +0100
Subject: Security/Drops the sysadmin privilege from the daemon

---
 installation/pleroma.service | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'installation')

diff --git a/installation/pleroma.service b/installation/pleroma.service
index 6955e5cc6..f1ed56cb3 100644
--- a/installation/pleroma.service
+++ b/installation/pleroma.service
@@ -21,6 +21,8 @@ ProtectSystem=full
 PrivateDevices=false
 ; Ensures that the service process and all its children can never gain new privileges through execve().
 NoNewPrivileges=true
+; Drops the sysadmin capability from the daemon.
+CapabilityBoundingSet=~CAP_SYS_ADMIN
 
 [Install]
 WantedBy=multi-user.target
-- 
cgit v1.2.3


From ce224ba5f07d4e699e1652f81d44521b8de19500 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@FreeBSD.org>
Date: Thu, 10 Jan 2019 18:23:22 +0000
Subject: Streaming is enabled by default Support more filetypes for caching
 static media

---
 installation/pleroma.vcl | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

(limited to 'installation')

diff --git a/installation/pleroma.vcl b/installation/pleroma.vcl
index 63c1cb74d..ca79eb7fc 100644
--- a/installation/pleroma.vcl
+++ b/installation/pleroma.vcl
@@ -42,15 +42,12 @@ sub vcl_recv {
     # Strip headers that will affect caching from all other static content
     # This also permits caching of individual toots and AP Activities
     if ((req.url ~ "^/(media|static)/") ||
-    (req.url ~ "(?i)\.(html|js|css|jpg|jpeg|png|gif|gz|tgz|bz2|tbz|mp3|ogg|svg|swf|ttf|pdf|woff|woff2)$"))
+    (req.url ~ "(?i)\.(html|js|css|jpg|jpeg|png|gif|gz|tgz|bz2|tbz|mp3|mp4|ogg|webm|svg|swf|ttf|pdf|woff|woff2)$"))
     {
       unset req.http.Cookie;
       unset req.http.Authorization;
       return (hash);
     }
-
-    # Everything else should just be piped to Pleroma
-    return (pipe);
 }
 
 sub vcl_backend_response {
@@ -59,9 +56,6 @@ sub vcl_backend_response {
       set beresp.do_gzip = true;
     }
 
-    # etags are bad
-    unset beresp.http.etag;
-
     # Don't cache objects that require authentication
     if (beresp.http.Authorization && !beresp.http.Cache-Control ~ "public") {
       set beresp.uncacheable = true;
@@ -92,14 +86,12 @@ sub vcl_backend_response {
     }
 
     # Strip cache-restricting headers from Pleroma on static content that we want to cache
-    # Also enable streaming of cached content to clients (no waiting for Varnish to complete backend fetch)
-    if (bereq.url ~ "(?i)\.(js|css|jpg|jpeg|png|gif|gz|tgz|bz2|tbz|mp3|ogg|svg|swf|ttf|pdf|woff|woff2)$")
+    if (bereq.url ~ "(?i)\.(js|css|jpg|jpeg|png|gif|gz|tgz|bz2|tbz|mp3|mp4|ogg|webm|svg|swf|ttf|pdf|woff|woff2)$")
     {
       unset beresp.http.set-cookie;
       unset beresp.http.Cache-Control;
       unset beresp.http.x-request-id;
       set beresp.http.Cache-Control = "public, max-age=86400";
-      set beresp.do_stream = true;
     }
 }
 
-- 
cgit v1.2.3


From fda942c329696fc44d3671c5ca58a28c3c38f50a Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@FreeBSD.org>
Date: Thu, 10 Jan 2019 18:28:14 +0000
Subject: Cache partial objects for 10 minutes This enables caching/streaming
 of chunked responses

---
 installation/pleroma.vcl | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

(limited to 'installation')

diff --git a/installation/pleroma.vcl b/installation/pleroma.vcl
index ca79eb7fc..30e552411 100644
--- a/installation/pleroma.vcl
+++ b/installation/pleroma.vcl
@@ -18,6 +18,11 @@ sub vcl_recv {
         return (synth(750, ""));
     }
 
+    # CHUNKED SUPPORT
+    if (req.http.Range ~ "bytes=") {
+      set req.http.x-range = req.http.Range;
+    }
+
     # Pipe if WebSockets request is coming through
     if (req.http.upgrade ~ "(?i)websocket") {
         return (pipe);
@@ -56,6 +61,12 @@ sub vcl_backend_response {
       set beresp.do_gzip = true;
     }
 
+    # CHUNKED SUPPORT
+    if (bereq.http.x-range ~ "bytes=" && beresp.status == 206) {
+      set beresp.ttl = 10m;
+      set beresp.http.CR = beresp.http.content-range;
+    }
+
     # Don't cache objects that require authentication
     if (beresp.http.Authorization && !beresp.http.Cache-Control ~ "public") {
       set beresp.uncacheable = true;
@@ -111,3 +122,26 @@ sub vcl_pipe {
         set bereq.http.connection = req.http.connection;
     }
 }
+
+sub vcl_hash {
+    # CHUNKED SUPPORT
+    if (req.http.x-range ~ "bytes=") {
+      hash_data(req.http.x-range);
+      unset req.http.Range;
+    }
+}
+
+sub vcl_backend_fetch {
+    # CHUNKED SUPPORT
+    if (bereq.http.x-range) {
+      set bereq.http.Range = bereq.http.x-range;
+    }
+}
+
+sub vcl_deliver {
+    # CHUNKED SUPPORT
+    if (resp.http.CR) {
+      set resp.http.Content-Range = resp.http.CR;
+      unset resp.http.CR;
+    }
+}
-- 
cgit v1.2.3


From efaa41fad2db59b9fd730013b0074edd8c2da29c Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@FreeBSD.org>
Date: Thu, 10 Jan 2019 18:29:36 +0000
Subject: Consistent intentation

---
 installation/pleroma.vcl | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

(limited to 'installation')

diff --git a/installation/pleroma.vcl b/installation/pleroma.vcl
index 30e552411..92153d8ef 100644
--- a/installation/pleroma.vcl
+++ b/installation/pleroma.vcl
@@ -14,8 +14,8 @@ acl purge {
 sub vcl_recv {
     # Redirect HTTP to HTTPS
     if (std.port(server.ip) != 443) {
-        set req.http.x-redir = "https://" + req.http.host + req.url;
-        return (synth(750, ""));
+      set req.http.x-redir = "https://" + req.http.host + req.url;
+      return (synth(750, ""));
     }
 
     # CHUNKED SUPPORT
@@ -25,23 +25,23 @@ sub vcl_recv {
 
     # Pipe if WebSockets request is coming through
     if (req.http.upgrade ~ "(?i)websocket") {
-        return (pipe);
+      return (pipe);
     }
 
     # Allow purging of the cache
     if (req.method == "PURGE") {
-        if (!client.ip ~ purge) {
-          return(synth(405,"Not allowed."));
-        }
-        return(purge);
+      if (!client.ip ~ purge) {
+        return(synth(405,"Not allowed."));
+      }
+      return(purge);
     }
 
     # Pleroma MediaProxy - strip headers that will affect caching
     if (req.url ~ "^/proxy/") {
-        unset req.http.Cookie;
-        unset req.http.Authorization;
-        unset req.http.Accept;
-        return (hash);
+      unset req.http.Cookie;
+      unset req.http.Authorization;
+      unset req.http.Accept;
+      return (hash);
     }
 
     # Strip headers that will affect caching from all other static content
@@ -86,9 +86,9 @@ sub vcl_backend_response {
 
     # Do not cache redirects and errors
     if ((beresp.status >= 300) && (beresp.status < 500)) {
-        set beresp.uncacheable = true;
-        set beresp.ttl = 30s;
-        return (deliver);
+      set beresp.uncacheable = true;
+      set beresp.ttl = 30s;
+      return (deliver);
     }
 
     # Pleroma MediaProxy internally sets headers properly
@@ -118,8 +118,8 @@ sub vcl_synth {
 # Ensure WebSockets through the pipe do not close prematurely
 sub vcl_pipe {
     if (req.http.upgrade) {
-        set bereq.http.upgrade = req.http.upgrade;
-        set bereq.http.connection = req.http.connection;
+      set bereq.http.upgrade = req.http.upgrade;
+      set bereq.http.connection = req.http.connection;
     }
 }
 
-- 
cgit v1.2.3


From cc3a83a7306262d9334b8cfb30ac99c024523d54 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@FreeBSD.org>
Date: Thu, 10 Jan 2019 21:29:05 +0000
Subject: Fix nginx caching issues

Nginx is currently not caching data because proxy_buffering needs to be
enabled for caching to work at all, and we are receiving a Cache-Control
header from Pleroma that states "max-age=0, private, must-revalidate"

Even disregarding the Cache-Control header that should actually be set
to "public, max-age=1209600" as defined in the reverse_proxy code, we
don't want to obey this header at all as it overrides our Nginx caching
rules.
---
 installation/pleroma.nginx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'installation')

diff --git a/installation/pleroma.nginx b/installation/pleroma.nginx
index 46b84fb50..a24bb0e61 100644
--- a/installation/pleroma.nginx
+++ b/installation/pleroma.nginx
@@ -79,8 +79,10 @@ server {
         proxy_cache_valid  200 206 301 304 1h;
         proxy_cache_lock on;
         proxy_ignore_client_abort on;
-        proxy_buffering off;
+        proxy_buffering on;
         chunked_transfer_encoding on;
+        proxy_ignore_headers Cache-Control;
+        proxy_hide_header Cache-Control;
         proxy_pass http://localhost:4000;
     }
 }
-- 
cgit v1.2.3


From 2a818a3e77ebf276eb9123cc176a5986cc9e47ed Mon Sep 17 00:00:00 2001
From: shibayashi <shibayashi@cypherpunk.observer>
Date: Thu, 17 Jan 2019 19:49:54 +0100
Subject: Add comments and change default path of the Mix binary.

---
 installation/pleroma.service | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

(limited to 'installation')

diff --git a/installation/pleroma.service b/installation/pleroma.service
index f1ed56cb3..72090bbc7 100644
--- a/installation/pleroma.service
+++ b/installation/pleroma.service
@@ -3,15 +3,23 @@ Description=Pleroma social network
 After=network.target postgresql.service
 
 [Service]
-User=pleroma
-WorkingDirectory=/home/pleroma/pleroma
-Environment="HOME=/home/pleroma"
-Environment="MIX_ENV=prod"
-ExecStart=/usr/local/bin/mix phx.server
 ExecReload=/bin/kill $MAINPID
 KillMode=process
 Restart=on-failure
 
+; Name of the user that runs the Pleroma service.
+User=pleroma
+; Declares that Pleroma runs in production mode.
+Environment="MIX_ENV=prod"
+
+; Make sure that all paths fit your installation.
+; Path to the home directory of the user running the Pleroma service.
+Environment="HOME=/home/pleroma"
+; Path to the folder containing the Pleroma installation.
+WorkingDirectory=/home/pleroma/pleroma
+; Path to the Mix binary.
+ExecStart=/usr/bin/mix phx.server
+
 ; Some security directives.
 ; Use private /tmp and /var/tmp folders inside a new file system namespace, which are discarded after the process stops.
 PrivateTmp=true
-- 
cgit v1.2.3


From 9e43a28bc36777737a56d02dccf831cf00fcddc4 Mon Sep 17 00:00:00 2001
From: vaartis <vaartis@cock.li>
Date: Mon, 28 Jan 2019 08:18:11 +0000
Subject: Update the openrc service's retry with the correct format

---
 installation/init.d/pleroma | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'installation')

diff --git a/installation/init.d/pleroma b/installation/init.d/pleroma
index 9582d65d4..2b211df65 100755
--- a/installation/init.d/pleroma
+++ b/installation/init.d/pleroma
@@ -12,7 +12,7 @@ export PORT=4000
 export MIX_ENV=prod
 
 # Ask process to terminate within 30 seconds, otherwise kill it
-retry="SIGTERM/30 SIGKILL/5"
+retry="SIGTERM/30/SIGKILL/5"
 
 pidfile="/var/run/pleroma.pid"
 
-- 
cgit v1.2.3


From e868cfe619a7e01775cc8f71a0b9e7d54c301ca3 Mon Sep 17 00:00:00 2001
From: shibayashi <shibayashi@cypherpunk.observer>
Date: Sat, 9 Feb 2019 11:39:01 +0000
Subject: Add /media to Caddy cache

---
 installation/caddyfile-pleroma.example | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'installation')

diff --git a/installation/caddyfile-pleroma.example b/installation/caddyfile-pleroma.example
index 03ff000b6..fcf76718e 100644
--- a/installation/caddyfile-pleroma.example
+++ b/installation/caddyfile-pleroma.example
@@ -23,6 +23,11 @@ example.tld  {
 
   # If you do not want to use the mediaproxy function, remove these lines.
   # To use this directive, you need the http.cache plugin for Caddy.
+  cache {
+    match_path /media
+    default_max_age 720m
+  }
+
   cache {
     match_path /proxy
     default_max_age 720m
-- 
cgit v1.2.3


From 1d8b578bb78693f4a51bb1d42701861c3c3692c2 Mon Sep 17 00:00:00 2001
From: shibayashi <shibayashi@cypherpunk.observer>
Date: Sat, 9 Feb 2019 23:08:27 +0100
Subject: Recommend the acme-challenge path that is used in the installation
 guides

---
 installation/pleroma.nginx | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

(limited to 'installation')

diff --git a/installation/pleroma.nginx b/installation/pleroma.nginx
index a24bb0e61..a3d55e4bf 100644
--- a/installation/pleroma.nginx
+++ b/installation/pleroma.nginx
@@ -15,12 +15,13 @@ server {
     return         301 https://$server_name$request_uri;
 
     # Uncomment this if you need to use the 'webroot' method with certbot. Make sure
-    # that you also create the .well-known/acme-challenge directory structure in pleroma/priv/static and
-    # that is is accessible by the webserver. You may need to load this file with the ssl
-    # server block commented out, run certbot to get the certificate, and then uncomment it.
+    # that the directory exists and that it is accessible by the webserver. If you followed
+    # the guide, you already ran 'sudo mkdir -p /var/lib/letsencrypt' to create the folder.
+    # You may need to load this file with the ssl server block commented out, run certbot
+    # to get the certificate, and then uncomment it.
     #
     # location ~ /\.well-known/acme-challenge {
-    #     root <path to install>/pleroma/priv/static/;
+    #     root /var/lib/letsencrypt/.well-known/acme-challenge;
     # }
 }
 
-- 
cgit v1.2.3


From d1752a81a8f0de5401e9fcfbee0c1242c7768d6d Mon Sep 17 00:00:00 2001
From: shibayashi <shibayashi@cypherpunk.observer>
Date: Sun, 10 Feb 2019 19:25:34 +0000
Subject: Update service files of OpenRC and systemd to new recommended paths

---
 installation/init.d/pleroma  | 4 ++--
 installation/pleroma.service | 6 ++++--
 2 files changed, 6 insertions(+), 4 deletions(-)

(limited to 'installation')

diff --git a/installation/init.d/pleroma b/installation/init.d/pleroma
index 2b211df65..ed50bb551 100755
--- a/installation/init.d/pleroma
+++ b/installation/init.d/pleroma
@@ -1,7 +1,7 @@
 #!/sbin/openrc-run
 
 # Requires OpenRC >= 0.35
-directory=~pleroma/pleroma
+directory=/opt/pleroma
 
 command=/usr/bin/mix
 command_args="phx.server"
@@ -18,4 +18,4 @@ pidfile="/var/run/pleroma.pid"
 
 depend() {
     need nginx postgresql
-}
\ No newline at end of file
+}
diff --git a/installation/pleroma.service b/installation/pleroma.service
index 72090bbc7..5dcbc1387 100644
--- a/installation/pleroma.service
+++ b/installation/pleroma.service
@@ -14,15 +14,17 @@ Environment="MIX_ENV=prod"
 
 ; Make sure that all paths fit your installation.
 ; Path to the home directory of the user running the Pleroma service.
-Environment="HOME=/home/pleroma"
+Environment="HOME=/var/lib/pleroma"
 ; Path to the folder containing the Pleroma installation.
-WorkingDirectory=/home/pleroma/pleroma
+WorkingDirectory=/opt/pleroma
 ; Path to the Mix binary.
 ExecStart=/usr/bin/mix phx.server
 
 ; Some security directives.
 ; Use private /tmp and /var/tmp folders inside a new file system namespace, which are discarded after the process stops.
 PrivateTmp=true
+; The /home, /root, and /run/user folders can not be accessed by this service anymore. If your Pleroma user has its home folder in one of the restricted places, or use one of these folders as its working directory, you have to set this to false.
+ProtectHome=true
 ; Mount /usr, /boot, and /etc as read-only for processes invoked by this service.
 ProtectSystem=full
 ; Sets up a new /dev mount for the process and only adds API pseudo devices like /dev/null, /dev/zero or /dev/random but not physical devices. Disabled by default because it may not work on devices like the Raspberry Pi.
-- 
cgit v1.2.3


From c75e643a72a3b27340877f21d7d9fe31dbfd146e Mon Sep 17 00:00:00 2001
From: faried nawaz <faried@gmail.com>
Date: Sat, 23 Feb 2019 00:18:03 +0500
Subject: apache config: add instructions for mediaproxy.

---
 installation/pleroma-apache.conf | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

(limited to 'installation')

diff --git a/installation/pleroma-apache.conf b/installation/pleroma-apache.conf
index d5e75044f..2beb7c4cc 100644
--- a/installation/pleroma-apache.conf
+++ b/installation/pleroma-apache.conf
@@ -1,6 +1,7 @@
 # default Apache site config for Pleroma
 #
 # needed modules: define headers proxy proxy_http proxy_wstunnel rewrite ssl
+# optional modules: cache cache_disk
 #
 # Simple installation instructions:
 # 1. Install your TLS certificate, possibly using Let's Encrypt.
@@ -8,6 +9,14 @@
 # 3. This assumes a Debian style Apache config. Copy this file to
 #    /etc/apache2/sites-available/ and then add a symlink to it in
 #    /etc/apache2/sites-enabled/ by running 'a2ensite pleroma-apache.conf', then restart Apache.
+#
+# Optional: enable disk-based caching for the media proxy
+# For details, see https://git.pleroma.social/pleroma/pleroma/wikis/How%20to%20activate%20mediaproxy
+#
+# 1. Create the directory listed below as the CacheRoot, and make sure
+#    the Apache user can write to it.
+# 2. Configure Apache's htcacheclean to clean the directory periodically.
+# 3. Run 'a2enmod cache cache_disk' and restart Apache.
 
 Define servername example.tld
 
@@ -34,6 +43,15 @@ CustomLog ${APACHE_LOG_DIR}/access.log combined
     SSLCompression          off
     SSLSessionTickets       off
 
+    # uncomment the following to enable mediaproxy caching on disk
+    # <IfModule mod_cache_disk.c>
+    #     CacheRoot /var/cache/apache2/mod_cache_disk
+    #     CacheDirLevels 1
+    #     CacheDirLength 2
+    #     CacheEnable disk /proxy
+    #     CacheLock on
+    # </IfModule>
+
     RewriteEngine On
     RewriteCond %{HTTP:Connection} Upgrade [NC]
     RewriteCond %{HTTP:Upgrade} websocket [NC]
-- 
cgit v1.2.3


From d3a6c065a496c3a7c4f0604af646b6fb611f585b Mon Sep 17 00:00:00 2001
From: PEA <phenethylamine@tutanota.com>
Date: Mon, 25 Feb 2019 23:37:46 -0500
Subject: Add ipv6 handling to pleroma.nginx

Replaces `listen 80` with `listen [::]:80`, same with 443
---
 installation/pleroma.nginx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'installation')

diff --git a/installation/pleroma.nginx b/installation/pleroma.nginx
index a3d55e4bf..66a0e987c 100644
--- a/installation/pleroma.nginx
+++ b/installation/pleroma.nginx
@@ -11,7 +11,7 @@ proxy_cache_path /tmp/pleroma-media-cache levels=1:2 keys_zone=pleroma_media_cac
 
 server {
     server_name    example.tld;
-    listen         80;
+    listen         [::]:80;
     return         301 https://$server_name$request_uri;
 
     # Uncomment this if you need to use the 'webroot' method with certbot. Make sure
@@ -29,7 +29,7 @@ server {
 ssl_session_cache shared:ssl_session_cache:10m;
 
 server {
-    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
     ssl_session_timeout 5m;
 
     ssl_trusted_certificate   /etc/letsencrypt/live/example.tld/fullchain.pem;
-- 
cgit v1.2.3


From e1bdaaa3fe20ad10458afa5edfb161fedcea74c0 Mon Sep 17 00:00:00 2001
From: Kenneth Zhao <ken@epenguin.com>
Date: Tue, 26 Feb 2019 08:41:37 -0800
Subject: need to put back ipv4 listen instruct

---
 installation/pleroma.nginx | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'installation')

diff --git a/installation/pleroma.nginx b/installation/pleroma.nginx
index 66a0e987c..8709f2cb7 100644
--- a/installation/pleroma.nginx
+++ b/installation/pleroma.nginx
@@ -11,6 +11,8 @@ proxy_cache_path /tmp/pleroma-media-cache levels=1:2 keys_zone=pleroma_media_cac
 
 server {
     server_name    example.tld;
+
+    listen         80;
     listen         [::]:80;
     return         301 https://$server_name$request_uri;
 
@@ -29,6 +31,9 @@ server {
 ssl_session_cache shared:ssl_session_cache:10m;
 
 server {
+    server_name example.tld;
+
+    listen 443 ssl http2;
     listen [::]:443 ssl http2;
     ssl_session_timeout 5m;
 
@@ -48,8 +53,6 @@ server {
     ssl_stapling on;
     ssl_stapling_verify on;
 
-    server_name example.tld;
-
     gzip_vary on;
     gzip_proxied any;
     gzip_comp_level 6;
-- 
cgit v1.2.3


From 10a96825960fc2d5465e9b4992c33941c8bd0c64 Mon Sep 17 00:00:00 2001
From: Horsemans <horsemans@horsemans.online>
Date: Sun, 31 Mar 2019 16:58:28 +0000
Subject: ssl_trusted_certificate should point to chain.pem if we're
 demonstrating LetsEncrypt:
 https://community.letsencrypt.org/t/howto-ocsp-stapling-for-nginx/13611/5

---
 installation/pleroma.nginx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'installation')

diff --git a/installation/pleroma.nginx b/installation/pleroma.nginx
index a24bb0e61..a0e91f464 100644
--- a/installation/pleroma.nginx
+++ b/installation/pleroma.nginx
@@ -31,7 +31,7 @@ server {
     listen 443 ssl http2;
     ssl_session_timeout 5m;
 
-    ssl_trusted_certificate   /etc/letsencrypt/live/example.tld/fullchain.pem;
+    ssl_trusted_certificate   /etc/letsencrypt/live/example.tld/chain.pem;
     ssl_certificate           /etc/letsencrypt/live/example.tld/fullchain.pem;
     ssl_certificate_key       /etc/letsencrypt/live/example.tld/privkey.pem;
 
-- 
cgit v1.2.3


From 498c96d458e383a9e8b647a6f10bdbebac116579 Mon Sep 17 00:00:00 2001
From: "Dominik V. Salonen" <155-quad@users.noreply.git.pleroma.social>
Date: Tue, 16 Apr 2019 07:14:44 +0000
Subject: Add supervisord configuration

---
 installation/pleroma.supervisord | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 installation/pleroma.supervisord

(limited to 'installation')

diff --git a/installation/pleroma.supervisord b/installation/pleroma.supervisord
new file mode 100644
index 000000000..19efffd6e
--- /dev/null
+++ b/installation/pleroma.supervisord
@@ -0,0 +1,21 @@
+; Assumes pleroma is installed in /home/pleroma/pleroma and running as the pleroma user
+; Also assumes mix is in /usr/bin, this might differ on BSDs or niche Linux distros
+; Logs into /home/pleroma/logs
+[program:pleroma]
+command=/usr/bin/mix phx.server
+directory=/home/pleroma/pleroma
+autostart=true
+autorestart=true
+user=pleroma
+environment =
+  MIX_ENV=prod,
+  HOME=/home/pleroma,
+  USER=pleroma,
+  PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/home/pleroma/bin:%(ENV_PATH)s",
+  PWD=/home/pleroma/pleroma
+stdout_logfile=/home/pleroma/logs/stdout.log
+stdout_logfile_maxbytes=50MB
+stdout_logfile_backups=10
+stderr_logfile=/home/pleroma/logs/stderr.log
+stderr_logfile_maxbytes=50MB
+stderr_logfile_backups=10
\ No newline at end of file
-- 
cgit v1.2.3