Importing ansible role
This commit is contained in:
parent
5f01f6c259
commit
8c1388d32a
4 changed files with 441 additions and 0 deletions
146
roles/mastodon/files/docker-compose.yaml
Normal file
146
roles/mastodon/files/docker-compose.yaml
Normal file
|
|
@ -0,0 +1,146 @@
|
|||
version: '3'
|
||||
services:
|
||||
mastodon_db:
|
||||
container_name: mastodon_db
|
||||
restart: always
|
||||
image: postgres:14-alpine
|
||||
shm_size: 256mb
|
||||
networks:
|
||||
- mastodon
|
||||
healthcheck:
|
||||
test: ['CMD', 'pg_isready', '-U', 'postgres']
|
||||
volumes:
|
||||
- ./postgres14:/var/lib/postgresql/data
|
||||
env_file: .env.production
|
||||
environment:
|
||||
- 'POSTGRES_HOST_AUTH_METHOD=trust'
|
||||
|
||||
mastodon_redis:
|
||||
container_name: mastodon_redis
|
||||
restart: always
|
||||
image: redis:7-alpine
|
||||
networks:
|
||||
- mastodon
|
||||
healthcheck:
|
||||
test: ['CMD', 'redis-cli', 'ping']
|
||||
volumes:
|
||||
- ./redis:/data
|
||||
|
||||
# es:
|
||||
# restart: always
|
||||
# image: docker.elastic.co/elasticsearch/elasticsearch:7.17.4
|
||||
# environment:
|
||||
# - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Des.enforce.bootstrap.checks=true"
|
||||
# - "xpack.license.self_generated.type=basic"
|
||||
# - "xpack.security.enabled=false"
|
||||
# - "xpack.watcher.enabled=false"
|
||||
# - "xpack.graph.enabled=false"
|
||||
# - "xpack.ml.enabled=false"
|
||||
# - "bootstrap.memory_lock=true"
|
||||
# - "cluster.name=es-mastodon"
|
||||
# - "discovery.type=single-node"
|
||||
# - "thread_pool.write.queue_size=1000"
|
||||
# networks:
|
||||
# - mastodon
|
||||
# - nginx
|
||||
# healthcheck:
|
||||
# test: ["CMD-SHELL", "curl --silent --fail localhost:9200/_cluster/health || exit 1"]
|
||||
# volumes:
|
||||
# - ./elasticsearch:/usr/share/elasticsearch/data
|
||||
# ulimits:
|
||||
# memlock:
|
||||
# soft: -1
|
||||
# hard: -1
|
||||
# nofile:
|
||||
# soft: 65536
|
||||
# hard: 65536
|
||||
# ports:
|
||||
# - '127.0.0.1:9200:9200'
|
||||
|
||||
mastodon_web:
|
||||
container_name: mastodon_web
|
||||
build: .
|
||||
image: tootsuite/mastodon
|
||||
restart: always
|
||||
env_file: .env.production
|
||||
command: bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000"
|
||||
networks:
|
||||
- mastodon
|
||||
- nginx
|
||||
healthcheck:
|
||||
# prettier-ignore
|
||||
test: ['CMD-SHELL', 'wget -q --spider --proxy=off localhost:3000/health || exit 1']
|
||||
ports:
|
||||
- '127.0.0.1:3000:3000'
|
||||
depends_on:
|
||||
- mastodon_db
|
||||
- mastodon_redis
|
||||
# - es
|
||||
volumes:
|
||||
- ./public/system:/mastodon/public/system
|
||||
|
||||
mastodon_streaming:
|
||||
container_name: mastodon_streaming
|
||||
build: .
|
||||
image: tootsuite/mastodon
|
||||
restart: always
|
||||
env_file: .env.production
|
||||
environment:
|
||||
- PORT=5000
|
||||
command: node ./streaming
|
||||
networks:
|
||||
- mastodon
|
||||
- nginx
|
||||
healthcheck:
|
||||
# prettier-ignore
|
||||
test: ['CMD-SHELL', 'wget -q --spider --proxy=off localhost:5000/api/v1/streaming/health || exit 1']
|
||||
ports:
|
||||
- '127.0.0.1:5000:5000'
|
||||
depends_on:
|
||||
- mastodon_db
|
||||
- mastodon_redis
|
||||
|
||||
mastodon_sidekiq:
|
||||
container_name: mastodon_sidekiq
|
||||
build: .
|
||||
image: tootsuite/mastodon
|
||||
restart: always
|
||||
env_file: .env.production
|
||||
command: bundle exec sidekiq
|
||||
depends_on:
|
||||
- mastodon_db
|
||||
- mastodon_redis
|
||||
networks:
|
||||
- mastodon
|
||||
- nginx
|
||||
volumes:
|
||||
- ./public/system:/mastodon/public/system
|
||||
healthcheck:
|
||||
test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"]
|
||||
|
||||
## Uncomment to enable federation with tor instances along with adding the following ENV variables
|
||||
## http_proxy=http://privoxy:8118
|
||||
## ALLOW_ACCESS_TO_HIDDEN_SERVICE=true
|
||||
# tor:
|
||||
# image: sirboops/tor
|
||||
# networks:
|
||||
# - external_network
|
||||
# - internal_network
|
||||
#
|
||||
# privoxy:
|
||||
# image: sirboops/privoxy
|
||||
# volumes:
|
||||
# - ./priv-config:/opt/config
|
||||
# networks:
|
||||
# - external_network
|
||||
# - internal_network
|
||||
|
||||
networks:
|
||||
mastodon:
|
||||
ipam:
|
||||
driver: default
|
||||
config:
|
||||
- subnet: 172.42.0.0/16
|
||||
nginx:
|
||||
external: true
|
||||
|
||||
84
roles/mastodon/files/mastodon-env
Normal file
84
roles/mastodon/files/mastodon-env
Normal file
|
|
@ -0,0 +1,84 @@
|
|||
# This is a sample configuration file. You can generate your configuration
|
||||
# with the `rake mastodon:setup` interactive setup wizard, but to customize
|
||||
# your setup even further, you'll need to edit it manually. This sample does
|
||||
# not demonstrate all available configuration options. Please look at
|
||||
# https://docs.joinmastodon.org/admin/config/ for the full documentation.
|
||||
|
||||
# Note that this file accepts slightly different syntax depending on whether
|
||||
# you are using `docker-compose` or not. In particular, if you use
|
||||
# `docker-compose`, the value of each declared variable will be taken verbatim,
|
||||
# including surrounding quotes.
|
||||
# See: https://github.com/mastodon/mastodon/issues/16895
|
||||
|
||||
# Federation
|
||||
# ----------
|
||||
# This identifies your server and cannot be changed safely later
|
||||
# ----------
|
||||
LOCAL_DOMAIN=teh.entar.net
|
||||
ALTERNATE_DOMAINS=entar.net,mastodon_web
|
||||
|
||||
# Redis
|
||||
# -----
|
||||
REDIS_HOST=mastodon_redis
|
||||
REDIS_PORT=6379
|
||||
|
||||
# PostgreSQL
|
||||
# ----------
|
||||
DB_HOST=mastodon_db
|
||||
DB_USER=postgres
|
||||
DB_NAME=mastodon_production
|
||||
DB_PASS=letmein
|
||||
DB_PORT=5432
|
||||
|
||||
POSTGRES_USER=postgres
|
||||
POSTGRES_PASSWORD=letmein
|
||||
POSTGRES_DB=mastodon_production
|
||||
|
||||
|
||||
## Elasticsearch (optional)
|
||||
## ------------------------
|
||||
#ES_ENABLED=true
|
||||
#ES_HOST=localhost
|
||||
#ES_PORT=9200
|
||||
## Authentication for ES (optional)
|
||||
#ES_USER=elastic
|
||||
#ES_PASS=password
|
||||
|
||||
# Secrets
|
||||
# -------
|
||||
# Make sure to use `rake secret` to generate secrets
|
||||
# -------
|
||||
SECRET_KEY_BASE=
|
||||
OTP_SECRET=
|
||||
|
||||
# Web Push
|
||||
# --------
|
||||
# Generate with `rake mastodon:webpush:generate_vapid_key`
|
||||
# --------a
|
||||
VAPID_PRIVATE_KEY=
|
||||
VAPID_PUBLIC_KEY=
|
||||
|
||||
# Sending mail
|
||||
# ------------
|
||||
SMTP_SERVER=172.17.0.1
|
||||
SMTP_PORT=587
|
||||
SMTP_LOGIN=
|
||||
SMTP_PASSWORD=
|
||||
SMTP_FROM_ADDRESS=notifications@teh.entar.net
|
||||
|
||||
## File storage (optional)
|
||||
## -----------------------
|
||||
#S3_ENABLED=true
|
||||
#S3_BUCKET=teh-entar-masto
|
||||
#AWS_ACCESS_KEY_ID=
|
||||
#AWS_SECRET_ACCESS_KEY=
|
||||
#S3_ALIAS_HOST=
|
||||
|
||||
# IP and session retention
|
||||
# -----------------------
|
||||
# Make sure to modify the scheduling of ip_cleanup_scheduler in config/sidekiq.yml
|
||||
# to be less than daily if you lower IP_RETENTION_PERIOD below two days (172800).
|
||||
# -----------------------
|
||||
IP_RETENTION_PERIOD=31556952
|
||||
SESSION_RETENTION_PERIOD=31556952
|
||||
|
||||
167
roles/mastodon/files/nginx.conf
Normal file
167
roles/mastodon/files/nginx.conf
Normal file
|
|
@ -0,0 +1,167 @@
|
|||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
upstream backend {
|
||||
server mastodon_web:3000 fail_timeout=0;
|
||||
}
|
||||
|
||||
upstream streaming {
|
||||
server mastodon_streaming:5000 fail_timeout=0;
|
||||
}
|
||||
|
||||
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=1g;
|
||||
|
||||
server {
|
||||
server_name teh.entar.net entar.net;
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
root /srv/mastodon/live/public;
|
||||
location /.well-known/acme-challenge/ { allow all; }
|
||||
location / { return 301 https://$host$request_uri; }
|
||||
}
|
||||
|
||||
server {
|
||||
server_name teh.entar.net entar.net;
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
# Uncomment these lines once you acquire a certificate:
|
||||
# ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
|
||||
# ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/www.poorsquinky.com/chain.pem;
|
||||
ssl_certificate /etc/letsencrypt/live/www.poorsquinky.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/www.poorsquinky.com/privkey.pem;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
|
||||
ssl_prefer_server_ciphers off;
|
||||
# In case of an old server with an OpenSSL version of 1.0.2 or below,
|
||||
# leave only prime256v1 or comment out the following line.
|
||||
ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
|
||||
keepalive_timeout 70;
|
||||
sendfile on;
|
||||
client_max_body_size 80m;
|
||||
|
||||
root /srv/mastodon/live/public;
|
||||
|
||||
gzip on;
|
||||
gzip_disable "msie6";
|
||||
gzip_vary on;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 6;
|
||||
gzip_buffers 16 8k;
|
||||
gzip_http_version 1.1;
|
||||
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml image/x-icon;
|
||||
|
||||
location / {
|
||||
try_files $uri @proxy;
|
||||
}
|
||||
|
||||
# If Docker is used for deployment and Rails serves static files,
|
||||
# then needed must replace line `try_files $uri =404;` with `try_files $uri @proxy;`.
|
||||
location = sw.js {
|
||||
add_header Cache-Control "public, max-age=604800, must-revalidate";
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
|
||||
try_files $uri =404;
|
||||
}
|
||||
|
||||
location ~ ^/assets/ {
|
||||
add_header Cache-Control "public, max-age=2419200, must-revalidate";
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
|
||||
try_files $uri =404;
|
||||
}
|
||||
|
||||
location ~ ^/avatars/ {
|
||||
add_header Cache-Control "public, max-age=2419200, must-revalidate";
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
|
||||
try_files $uri =404;
|
||||
}
|
||||
|
||||
location ~ ^/emoji/ {
|
||||
add_header Cache-Control "public, max-age=2419200, must-revalidate";
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
|
||||
try_files $uri =404;
|
||||
}
|
||||
|
||||
location ~ ^/headers/ {
|
||||
add_header Cache-Control "public, max-age=2419200, must-revalidate";
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
|
||||
try_files $uri =404;
|
||||
}
|
||||
|
||||
location ~ ^/packs/ {
|
||||
add_header Cache-Control "public, max-age=2419200, must-revalidate";
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
|
||||
try_files $uri =404;
|
||||
}
|
||||
|
||||
location ~ ^/shortcuts/ {
|
||||
add_header Cache-Control "public, max-age=2419200, must-revalidate";
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
|
||||
try_files $uri =404;
|
||||
}
|
||||
|
||||
location ~ ^/sounds/ {
|
||||
add_header Cache-Control "public, max-age=2419200, must-revalidate";
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
|
||||
try_files $uri =404;
|
||||
}
|
||||
|
||||
location ~ ^/system/ {
|
||||
add_header Cache-Control "public, max-age=2419200, immutable";
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
|
||||
try_files $uri =404;
|
||||
}
|
||||
|
||||
location ^~ /api/v1/streaming/ {
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Proxy "";
|
||||
|
||||
proxy_pass http://streaming;
|
||||
proxy_buffering off;
|
||||
proxy_redirect off;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
|
||||
|
||||
tcp_nodelay on;
|
||||
}
|
||||
|
||||
location @proxy {
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Proxy "";
|
||||
proxy_pass_header Server;
|
||||
|
||||
proxy_pass http://mastodon_web:3000;
|
||||
proxy_buffering on;
|
||||
proxy_redirect off;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
|
||||
proxy_cache CACHE;
|
||||
proxy_cache_valid 200 7d;
|
||||
proxy_cache_valid 410 24h;
|
||||
proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
|
||||
add_header X-Cached $upstream_cache_status;
|
||||
|
||||
tcp_nodelay on;
|
||||
}
|
||||
|
||||
error_page 404 500 501 502 503 504 /500.html;
|
||||
}
|
||||
|
||||
44
roles/mastodon/tasks/main.yml
Normal file
44
roles/mastodon/tasks/main.yml
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
---
|
||||
|
||||
# https://docs.joinmastodon.org/admin/config/make
|
||||
|
||||
# check out mastodon
|
||||
- name: check out mastodon
|
||||
git:
|
||||
repo: https://github.com/mastodon/mastodon.git
|
||||
version: v3.5.3
|
||||
dest: /srv/mastodon
|
||||
update: no
|
||||
register: mastodon_git
|
||||
|
||||
# copy mastodon docker-compose
|
||||
- name: masto docker-compose
|
||||
copy:
|
||||
src: files/docker-compose.yaml
|
||||
dest: /srv/mastodon/docker-compose.yml
|
||||
register: mastodon_docker_compose
|
||||
|
||||
# mastodon env file
|
||||
- name: masto env
|
||||
copy:
|
||||
src: files/mastodon-env
|
||||
dest: /srv/mastodon/.env.production
|
||||
register: mastodon_env
|
||||
|
||||
# launch mastodon
|
||||
|
||||
- name: nginx config
|
||||
copy:
|
||||
src: files/nginx.conf
|
||||
dest: /srv/nginx/conf.d/teh.entar.net.conf
|
||||
owner: netsrv
|
||||
group: netsrv
|
||||
mode: "0644"
|
||||
register: entarnginx
|
||||
|
||||
- name: restart nginx
|
||||
command: docker restart nginx-www
|
||||
when: entarnginx.changed
|
||||
|
||||
|
||||
|
||||
Loading…
Reference in a new issue