]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/mermet/pleroma.nix
mermet: set memory limits
[sourcephile-nix.git] / hosts / mermet / pleroma.nix
1 { pkgs, lib, config, ... }:
2 let
3 domain = "autogeree.net";
4 srv = "pleroma";
5 owner = "${srv}-${domain}";
6 db = "${srv}-${domain}";
7 port = 4000;
8 inherit (config.services) postgresql;
9 inherit (config.users) groups;
10
11 # pleroma_ctl instance gen
12 # https://git.pleroma.social/pleroma/pleroma/blob/develop/config/config.exs
13 pleroma-conf = ''
14 import Config
15
16 config :pleroma, Pleroma.Web.Endpoint,
17 url: [host: "${srv}.${domain}", scheme: "https", port: 443],
18 http: [ip: {127, 0, 0, 1}, port: ${toString port}]
19
20 config :pleroma, :http_security,
21 sts: true
22
23 config :pleroma, Pleroma.Web.WebFinger, domain: "${domain}"
24
25 # RELEASE_COOKIE="/var/lib/pleroma/.cookie" \
26 # pleroma_ctl user new $user $user+pleroma@autogeree.net --password "$password" --moderator --admin -y
27 config :pleroma, :instance,
28 name: "${domain}",
29 email: "root+${srv}@${domain}",
30 notify_email: "root+${srv}@${domain}",
31 limit: 5000,
32 registrations_open: false,
33 invites_enabled: true,
34 description: "Pleroma: An efficient and flexible fediverse server",
35 short_description: "",
36 background_image: "/images/city.jpg",
37 instance_thumbnail: "/instance/thumbnail.jpeg",
38 max_pinned_statuses: 4
39
40 config :pleroma, :media_proxy,
41 enabled: false,
42 redirect_on_failure: true
43 #base_url: "https://cache.pleroma.social"
44
45 config :pleroma, :markup,
46 allow_inline_images: true,
47 allow_headings: true,
48 allow_tables: true
49
50 # pleroma_ctl email test --to julm+pleroma@autogeree.net
51 config :pleroma, Pleroma.Emails.Mailer, [
52 adapter: Swoosh.Adapters.Sendmail,
53 enabled: true,
54 cmd_path: "/run/wrappers/bin/sendmail",
55 cmd_args: ""
56 ]
57
58 config :pleroma, :dangerzone,
59 override_repo_pool_size: true
60
61 config :pleroma, Pleroma.Repo,
62 adapter: Ecto.Adapters.Postgres,
63 username: "${owner}",
64 socket_dir: "/run/postgresql",
65 database: "${db}",
66 pool_size: 5,
67 prepare: :named,
68 # https://docs-develop.pleroma.social/backend/configuration/postgresql/#disable-generic-query-plans
69 parameters: [
70 plan_cache_mode: "force_custom_plan"
71 ]
72
73 config :pleroma, :database, rum_enabled: false
74 config :pleroma, :instance, static_dir: "/var/lib/${srv}/static"
75 config :pleroma, Pleroma.Uploaders.Local, uploads: "/var/lib/${srv}/uploads"
76 config :pleroma, configurable_from_database: false
77 config :pleroma, Pleroma.Upload, filters: [
78 Pleroma.Upload.Filter.Exiftool.StripLocation,
79 Pleroma.Upload.Filter.Exiftool.ReadDescription
80 ]
81
82 # https://docs-develop.pleroma.social/backend/configuration/howto_proxy/
83 #config :pleroma, :http, proxy_url: {:socks5, :localhost, 9050}
84 config :pleroma, :mrf,
85 policies: [
86 Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy,
87 Pleroma.Web.ActivityPub.MRF.TagPolicy,
88 Pleroma.Web.ActivityPub.MRF.SimplePolicy
89 ]
90
91 config :pleroma, :media_proxy,
92 enabled: true,
93 proxy_opts: [
94 redirect_on_failure: true
95 ];
96 '';
97 in
98 {
99 services = {
100 pleroma = {
101 enable = true;
102 configs = [ pleroma-conf ];
103 secretConfigFile = "/run/credentials/${srv}.service/config.exs";
104 };
105 nginx = {
106 enable = true;
107 upstreams.${srv} = {
108 servers."127.0.0.1:${toString port}" = {
109 max_fails = 5;
110 fail_timeout = "60s";
111 };
112 extraConfig = ''
113 '';
114 };
115 proxyCachePath."${domain}/${srv}/proxy" = {
116 enable = true;
117 inactive = "720m";
118 keysZoneName = "${domain}/${srv}/proxy";
119 keysZoneSize = "10m";
120 levels = "1:2";
121 maxSize = "10g";
122 useTempPath = false;
123 };
124
125 virtualHosts.${domain} = {
126 locations."/.well-known/host-meta" = {
127 return = "301 https://${srv}.${domain}$request_uri";
128 };
129 };
130 virtualHosts."${srv}.${domain}" = {
131 forceSSL = true;
132 useACMEHost = domain;
133 extraConfig = ''
134 access_log /var/log/nginx/${domain}/${srv}/access.log json buffer=32k;
135 error_log /var/log/nginx/${domain}/${srv}/error.log;
136 '';
137 locations."/" = {
138 proxyPass = "http://${srv}";
139 extraConfig = ''
140 add_header 'Access-Control-Allow-Origin' '*' always;
141 add_header 'Access-Control-Allow-Methods' 'POST, PUT, DELETE, GET, PATCH, OPTIONS' always;
142 add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, Idempotency-Key' always;
143 add_header 'Access-Control-Expose-Headers' 'Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id' always;
144 if ($request_method = OPTIONS) {
145 return 204;
146 }
147 add_header Referrer-Policy same-origin;
148 add_header X-Content-Type-Options nosniff;
149 add_header X-Download-Options noopen;
150 add_header X-Frame-Options DENY;
151 add_header X-Permitted-Cross-Domain-Policies none;
152 add_header X-XSS-Protection "1; mode=block";
153 client_max_body_size 16m;
154 proxy_connect_timeout 90;
155 proxy_http_version 1.1;
156 proxy_read_timeout 90;
157 proxy_redirect off;
158 proxy_send_timeout 90;
159 proxy_set_header Connection "upgrade";
160 proxy_set_header Upgrade $http_upgrade;
161 '';
162 };
163 locations."/proxy" = {
164 proxyPass = "http://${srv}";
165 extraConfig = ''
166 proxy_cache ${domain}/${srv}/proxy;
167 proxy_cache_lock on;
168 proxy_ignore_client_abort on;
169 '';
170 };
171 };
172 };
173 postgresql = {
174 identMap = ''
175 # MAPNAME SYSTEM-USERNAME PG-USERNAME
176 user root ${owner}
177 user ${srv} ${owner}
178 '';
179 };
180 sanoid.datasets."rpool/var/lib/${srv}" = {
181 use_template = [ "snap" ];
182 daily = 31;
183 monthly = 3;
184 recursive = true;
185 };
186 };
187 systemd.services = {
188 nginx = {
189 serviceConfig = {
190 LogsDirectory = lib.mkForce [ "nginx/${domain}/${srv}" ];
191 };
192 };
193 pleroma = {
194 path = [
195 pkgs.exiftool
196 # For RELEASE_COOKIE
197 pkgs.hexdump
198 # For rand()
199 pkgs.gawk
200 ];
201 environment.RELEASE_VM_ARGS = pkgs.writeText "vm.args" ''
202 # Disable the busy-waiting.
203 # https://docs-develop.pleroma.social/backend/configuration/optimizing_beam/#virtual-machine-andor-few-cpu-cores
204 +sbwt none
205 +sbwtdcpu none
206 +sbwtdio none
207 '';
208 unitConfig = {
209 StartLimitBurst = 5;
210 StartLimitIntervalSec = "600s";
211 };
212 serviceConfig = {
213 LoadCredentialEncrypted = [ "config.exs:${./pleroma/config.exs.cred}" ];
214 SupplementaryGroups = [ groups."postgres".name ];
215 TimeoutStopSec = "10s";
216 Restart = "on-failure";
217 RestartSec = "10s";
218 MemoryAccounting = true;
219 MemoryMax = "500M";
220 MemoryHigh = "600M";
221 # For sendmail
222 NoNewPrivileges = lib.mkForce false;
223 };
224 };
225 postgresql = {
226 postStart = lib.mkAfter ''
227 connection_limit=64 \
228 encoding=UTF8 \
229 lc_collate=fr_FR.UTF-8 \
230 lc_type=fr_FR.UTF-8 \
231 owner="${owner}" \
232 pass="" \
233 pg_createdb "${db}" >/dev/null
234 pg_adduser "${db}" "${owner}" >/dev/null
235
236 $PSQL -d "${db}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
237 --Extensions made by ecto.migrate that need superuser access
238 CREATE EXTENSION IF NOT EXISTS citext;
239 CREATE EXTENSION IF NOT EXISTS pg_trgm;
240 CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
241 EOF
242 '';
243 };
244 };
245 }