Untitled attachment

Notices where this attachment appears

1. pwm (pwm@crlf.ninja)'s status on Tuesday, 01-Aug-2023 02:15:35 JST pwm

   in reply to
   @jeff @mint full section
   ```
   location /objects {
   proxy_cache objects_cache;
   proxy_cache_key "$host$request_uri";
   proxy_cache_valid 200;
   proxy_no_cache $cookie_sessionid;
   proxy_ignore_headers Cache-Control;
   proxy_set_header Accept application/activity+json;
   proxy_pass http://phoenix;
   add_header x-cache "$upstream_cache_status from nginx";
   }
   ```
   I think I may have some directives that are not exactly kosher but it does what I wanted
2. Matty-kun :Christmas_kitty_bell: (matty@nicecrew.digital)'s status on Sunday, 19-Feb-2023 18:59:09 JST Matty-kun :Christmas_kitty_bell:

   in reply to

   Should I remove the location / { proxy_pass http://phoenix; } directive then?

3. :btrfly: anime graf mays 🛰️🪐 (graf@poa.st)'s status on Sunday, 19-Feb-2023 09:48:37 JST :btrfly: anime graf mays 🛰️🪐

   in reply to

   @matty @thatguyoverthere @thegreatape if you used the default pleroma you already have something similar

   location ~ ^/(media|proxy) { proxy_cache pleroma_media_cache; slice 1m; proxy_cache_key $host$uri$is_args$args$slice_range; proxy_set_header Range $slice_range; proxy_cache_valid 200 206 301 304 1h; proxy_cache_lock on; proxy_ignore_client_abort on; proxy_buffering on; chunked_transfer_encoding on; proxy_pass http://phoenix; }

   remove media from that, copy it and set the location as location ~ ^/media { and location ~ ^/emoji { then replace proxy_pass with try_files $uri @phoenix;

   location @Phoenix { proxy_pass http://phoenix; }

   this is very basic, you will have to tweak it but thats more or less what you need

4. meso (meso@asbestos.cafe)'s status on Friday, 10-Feb-2023 04:19:31 JST meso

   in reply to

   @mint @alex

   proxy_cache_path /tmp/akkoma-media-cache levels=1:2 keys_zone=akkoma_media_cache:10m max_size=10g inactive=720m use_temp_path=off; # this is explicitly IPv4 since Pleroma.Web.Endpoint binds on IPv4 only # and `localhost.` resolves to [::0] on some systems: see issue #930 upstream phoenix { server 127.0.0.1:4000 max_fails=5 fail_timeout=60s; } server { server_name asbestos.cafe; listen 80; listen [::]:80; location / { return 301 https://$server_name$request_uri; } } # Enable SSL session caching for improved performance ssl_session_cache shared:ssl_session_cache:10m; server { server_name asbestos.cafe; listen 443 ssl http2; listen [::]:443 ssl http2; ssl_session_timeout 1d; ssl_session_cache shared:MozSSL:10m; # about 40000 sessions ssl_session_tickets off; ssl_trusted_certificate /etc/letsencrypt/live/asbestos.cafe/chain.pem; ssl_certificate /etc/letsencrypt/live/asbestos.cafe/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/asbestos.cafe/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"; ssl_prefer_server_ciphers off; # In case of an old server with an OpenSSL version of 1.0.2 or below, # leave only prime256v1 or comment out the following line. ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1; ssl_stapling on; ssl_stapling_verify on; gzip_vary on; gzip_proxied any; gzip_comp_level 6; gzip_buffers 16 8k; gzip_http_version 1.1; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml; # the nginx default is 1m, not enough for large media uploads client_max_body_size 90m; ignore_invalid_headers off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; location / { proxy_pass http://phoenix; } location ~ ^/(media|proxy) { proxy_cache akkoma_media_cache; slice 1m; proxy_cache_key $host$uri$is_args$args$slice_range; proxy_set_header Range $slice_range; proxy_cache_valid 200 206 301 304 1h; proxy_cache_lock on; proxy_ignore_client_abort on; proxy_buffering on; chunked_transfer_encoding on; proxy_pass http://phoenix; } access_log /var/log/nginx/asbestos.cafe.access.log; }

   i hope theres no vulnerability here :marseyclueless:

5.  (mint@ryona.agency)'s status on Friday, 10-Feb-2023 04:19:30 JST 

   in reply to

   @meso @alex Get a cert for soap.asbestos.cafe (or whatever other subdomain you want), download soapbox and unpack it into /var/www/soapbox (move files out of static/ so that index.html and the rest is in the dir), then add the following server block after the others.

   server { server_name soap.asbestos.cafe; listen 443 ssl http2; listen [::]:443 ssl http2; ssl_session_timeout 1d; ssl_session_cache shared:MozSSL:10m; # about 40000 sessions ssl_session_tickets off; ssl_trusted_certificate /etc/letsencrypt/live/soap.asbestos.cafe/chain.pem; ssl_certificate /etc/letsencrypt/live/soap.asbestos.cafe/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/soap.asbestos.cafe/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"; ssl_prefer_server_ciphers off; # In case of an old server with an OpenSSL version of 1.0.2 or below, # leave only prime256v1 or comment out the following line. ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1; ssl_stapling on; ssl_stapling_verify on; gzip_vary on; gzip_proxied any; gzip_comp_level 6; gzip_buffers 16 8k; gzip_http_version 1.1; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml; # the nginx default is 1m, not enough for large media uploads client_max_body_size 90m; ignore_invalid_headers off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; root /var/www/soapbox; location / { try_files $uri /index.html =404; error_page 404 = /404.html; } location ~ ^/(activities|relay|schemas|pleroma|contexts|objects|internal|users|inbox|api|.well-known|nodeinfo|proxy|media|oauth|socket|manifest.json|favicon.png) { proxy_pass http://phoenix; } access_log /var/log/nginx/asbestos.cafe.access.log; }