Conversation

Notices

1. meso (meso@asbestos.cafe)'s status on Friday, 10-Feb-2023 04:15:04 JST meso

   • Alex Gleason
   @alex how would i install soapbox under like a subdomain :marseyquestion:
   •  (mint@ryona.agency)'s status on Friday, 10-Feb-2023 04:15:03 JST 

     in reply to

     • Alex Gleason
     @meso @alex Show your nginx config for the main domain.
   •  (mint@ryona.agency)'s status on Friday, 10-Feb-2023 04:19:30 JST 

     in reply to

     • Alex Gleason

     @meso @alex Get a cert for soap.asbestos.cafe (or whatever other subdomain you want), download soapbox and unpack it into /var/www/soapbox (move files out of static/ so that index.html and the rest is in the dir), then add the following server block after the others.

     server { server_name soap.asbestos.cafe; listen 443 ssl http2; listen [::]:443 ssl http2; ssl_session_timeout 1d; ssl_session_cache shared:MozSSL:10m; # about 40000 sessions ssl_session_tickets off; ssl_trusted_certificate /etc/letsencrypt/live/soap.asbestos.cafe/chain.pem; ssl_certificate /etc/letsencrypt/live/soap.asbestos.cafe/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/soap.asbestos.cafe/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"; ssl_prefer_server_ciphers off; # In case of an old server with an OpenSSL version of 1.0.2 or below, # leave only prime256v1 or comment out the following line. ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1; ssl_stapling on; ssl_stapling_verify on; gzip_vary on; gzip_proxied any; gzip_comp_level 6; gzip_buffers 16 8k; gzip_http_version 1.1; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml; # the nginx default is 1m, not enough for large media uploads client_max_body_size 90m; ignore_invalid_headers off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; root /var/www/soapbox; location / { try_files $uri /index.html =404; error_page 404 = /404.html; } location ~ ^/(activities|relay|schemas|pleroma|contexts|objects|internal|users|inbox|api|.well-known|nodeinfo|proxy|media|oauth|socket|manifest.json|favicon.png) { proxy_pass http://phoenix; } access_log /var/log/nginx/asbestos.cafe.access.log; }
   • meso (meso@asbestos.cafe)'s status on Friday, 10-Feb-2023 04:19:31 JST meso

     in reply to

     • Alex Gleason
     • 

     @mint @alex

     proxy_cache_path /tmp/akkoma-media-cache levels=1:2 keys_zone=akkoma_media_cache:10m max_size=10g inactive=720m use_temp_path=off; # this is explicitly IPv4 since Pleroma.Web.Endpoint binds on IPv4 only # and `localhost.` resolves to [::0] on some systems: see issue #930 upstream phoenix { server 127.0.0.1:4000 max_fails=5 fail_timeout=60s; } server { server_name asbestos.cafe; listen 80; listen [::]:80; location / { return 301 https://$server_name$request_uri; } } # Enable SSL session caching for improved performance ssl_session_cache shared:ssl_session_cache:10m; server { server_name asbestos.cafe; listen 443 ssl http2; listen [::]:443 ssl http2; ssl_session_timeout 1d; ssl_session_cache shared:MozSSL:10m; # about 40000 sessions ssl_session_tickets off; ssl_trusted_certificate /etc/letsencrypt/live/asbestos.cafe/chain.pem; ssl_certificate /etc/letsencrypt/live/asbestos.cafe/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/asbestos.cafe/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"; ssl_prefer_server_ciphers off; # In case of an old server with an OpenSSL version of 1.0.2 or below, # leave only prime256v1 or comment out the following line. ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1; ssl_stapling on; ssl_stapling_verify on; gzip_vary on; gzip_proxied any; gzip_comp_level 6; gzip_buffers 16 8k; gzip_http_version 1.1; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml; # the nginx default is 1m, not enough for large media uploads client_max_body_size 90m; ignore_invalid_headers off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; location / { proxy_pass http://phoenix; } location ~ ^/(media|proxy) { proxy_cache akkoma_media_cache; slice 1m; proxy_cache_key $host$uri$is_args$args$slice_range; proxy_set_header Range $slice_range; proxy_cache_valid 200 206 301 304 1h; proxy_cache_lock on; proxy_ignore_client_abort on; proxy_buffering on; chunked_transfer_encoding on; proxy_pass http://phoenix; } access_log /var/log/nginx/asbestos.cafe.access.log; }

     i hope theres no vulnerability here :marseyclueless:

   • ew (e@masochi.st)'s status on Friday, 10-Feb-2023 04:20:34 JST ew

     in reply to

     • Alex Gleason
     • 
     @mint @meso @alex LEWD
      likes this.
   •  (mint@ryona.agency)'s status on Friday, 10-Feb-2023 04:39:29 JST 

     in reply to

     • Alex Gleason
     • 
     @meso @alex Btw, there's lots of duplicated lines across both blocks that could be confined to a single include, but I just went with the path of least resistance.
   •  (mint@ryona.agency)'s status on Friday, 10-Feb-2023 04:46:08 JST 

     in reply to

     • Alex Gleason
     • anemone
     @animeirl @meso @alex Alex has just added them to gleasonator branch as well, though not sure it that's based on your work, ew's, or it's a brand-new implementation.
   • anemone (animeirl@shitposter.club)'s status on Friday, 10-Feb-2023 04:46:09 JST anemone

     in reply to

     • Alex Gleason
     • 
     also you should install my fork because it's better than alex's and support full unicode emoji reacts