2022-04-27 06:38:39 +00:00
|
|
|
# docs: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/pleroma.nix
|
|
|
|
#
|
|
|
|
# to run it in a oci-container: https://github.com/barrucadu/nixfiles/blob/master/services/pleroma.nix
|
2022-06-08 23:46:32 +00:00
|
|
|
{ config, pkgs, ... }:
|
2022-04-27 06:38:39 +00:00
|
|
|
|
|
|
|
{
|
2022-08-01 07:23:49 +00:00
|
|
|
sane.impermanence.service-dirs = [
|
2022-07-11 00:58:16 +00:00
|
|
|
# TODO: mode? could be more granular
|
2022-07-15 06:58:27 +00:00
|
|
|
{ user = "pleroma"; group = "pleroma"; directory = "/var/lib/pleroma"; }
|
2022-07-11 00:58:16 +00:00
|
|
|
];
|
2022-08-01 07:23:49 +00:00
|
|
|
users.users.pleroma.uid = config.sane.allocations.pleroma-uid;
|
|
|
|
users.groups.pleroma.gid = config.sane.allocations.pleroma-gid;
|
2022-04-27 06:38:39 +00:00
|
|
|
services.pleroma.enable = true;
|
2022-06-08 23:46:32 +00:00
|
|
|
services.pleroma.secretConfigFile = config.sops.secrets.pleroma_secrets.path;
|
2022-04-27 06:38:39 +00:00
|
|
|
services.pleroma.configs = [
|
|
|
|
''
|
|
|
|
import Config
|
2022-09-24 21:06:47 +00:00
|
|
|
|
2022-04-27 06:38:39 +00:00
|
|
|
config :pleroma, Pleroma.Web.Endpoint,
|
|
|
|
url: [host: "fed.uninsane.org", scheme: "https", port: 443],
|
2022-06-08 23:46:32 +00:00
|
|
|
http: [ip: {127, 0, 0, 1}, port: 4000]
|
|
|
|
# secret_key_base: "{secrets.pleroma.secret_key_base}",
|
|
|
|
# signing_salt: "{secrets.pleroma.signing_salt}"
|
2022-09-24 21:06:47 +00:00
|
|
|
|
2022-04-27 06:38:39 +00:00
|
|
|
config :pleroma, :instance,
|
|
|
|
name: "Perfectly Sane",
|
2022-05-09 07:55:43 +00:00
|
|
|
description: "Single-user Pleroma instance",
|
2022-05-09 00:37:49 +00:00
|
|
|
email: "admin.pleroma@uninsane.org",
|
|
|
|
notify_email: "notify.pleroma@uninsane.org",
|
2022-04-27 06:38:39 +00:00
|
|
|
limit: 5000,
|
2022-05-09 00:37:49 +00:00
|
|
|
registrations_open: true,
|
|
|
|
account_approval_required: true,
|
2022-05-09 07:55:43 +00:00
|
|
|
max_pinned_statuses: 5,
|
|
|
|
external_user_synchronization: true
|
2022-05-09 00:37:49 +00:00
|
|
|
|
|
|
|
# docs: https://hexdocs.pm/swoosh/Swoosh.Adapters.Sendmail.html
|
|
|
|
# test mail config with sudo -u pleroma ./bin/pleroma_ctl email test --to someone@somewhere.net
|
|
|
|
config :pleroma, Pleroma.Emails.Mailer,
|
|
|
|
enabled: true,
|
|
|
|
adapter: Swoosh.Adapters.Sendmail,
|
|
|
|
cmd_path: "${pkgs.postfix}/bin/sendmail"
|
|
|
|
|
|
|
|
config :pleroma, Pleroma.User,
|
|
|
|
restricted_nicknames: [ "admin", "uninsane", "root" ]
|
|
|
|
|
2022-04-27 06:38:39 +00:00
|
|
|
config :pleroma, :media_proxy,
|
|
|
|
enabled: false,
|
|
|
|
redirect_on_failure: true
|
|
|
|
#base_url: "https://cache.pleroma.social"
|
2022-09-24 21:06:47 +00:00
|
|
|
|
2022-04-27 06:38:39 +00:00
|
|
|
config :pleroma, Pleroma.Repo,
|
|
|
|
adapter: Ecto.Adapters.Postgres,
|
|
|
|
username: "pleroma",
|
|
|
|
database: "pleroma",
|
|
|
|
hostname: "localhost",
|
|
|
|
pool_size: 10,
|
|
|
|
prepare: :named,
|
|
|
|
parameters: [
|
|
|
|
plan_cache_mode: "force_custom_plan"
|
|
|
|
]
|
2022-06-08 23:46:32 +00:00
|
|
|
# password: "{secrets.pleroma.db_password}",
|
2022-05-27 06:09:54 +00:00
|
|
|
|
|
|
|
# Configure web push notifications
|
|
|
|
config :web_push_encryption, :vapid_details,
|
2022-06-08 23:46:32 +00:00
|
|
|
subject: "mailto:notify.pleroma@uninsane.org"
|
|
|
|
# public_key: "{secrets.pleroma.vapid_public_key}",
|
|
|
|
# private_key: "{secrets.pleroma.vapid_private_key}"
|
2022-05-27 06:09:54 +00:00
|
|
|
|
2022-06-08 23:46:32 +00:00
|
|
|
# config :joken, default_signer: "{secrets.pleroma.joken_default_signer}"
|
2022-09-24 21:06:47 +00:00
|
|
|
|
2022-04-27 06:38:39 +00:00
|
|
|
config :pleroma, :database, rum_enabled: false
|
|
|
|
config :pleroma, :instance, static_dir: "/var/lib/pleroma/instance/static"
|
|
|
|
config :pleroma, Pleroma.Uploaders.Local, uploads: "/var/lib/pleroma/uploads"
|
|
|
|
config :pleroma, configurable_from_database: false
|
|
|
|
|
2022-05-09 21:22:15 +00:00
|
|
|
# strip metadata from uploaded images
|
2022-10-25 11:11:47 +00:00
|
|
|
config :pleroma, Pleroma.Upload, filters: [Pleroma.Upload.Filter.Exiftool.StripLocation]
|
2022-04-27 06:38:39 +00:00
|
|
|
|
2022-05-09 07:55:43 +00:00
|
|
|
# TODO: GET /api/pleroma/captcha is broken
|
2022-10-25 11:11:47 +00:00
|
|
|
# there was a nixpkgs PR to fix this around 2022/10 though.
|
2022-05-09 07:55:43 +00:00
|
|
|
config :pleroma, Pleroma.Captcha,
|
|
|
|
enabled: false,
|
|
|
|
method: Pleroma.Captcha.Native
|
|
|
|
|
2022-04-27 06:38:39 +00:00
|
|
|
|
|
|
|
# (enabled by colin)
|
|
|
|
# Enable Strict-Transport-Security once SSL is working:
|
|
|
|
config :pleroma, :http_security,
|
|
|
|
sts: true
|
2022-09-24 21:06:47 +00:00
|
|
|
|
2022-05-09 21:22:15 +00:00
|
|
|
# docs: https://docs.pleroma.social/backend/configuration/cheatsheet/#logger
|
2022-04-27 06:38:39 +00:00
|
|
|
config :logger,
|
2022-05-05 21:44:56 +00:00
|
|
|
backends: [{ExSyslogger, :ex_syslogger}]
|
2022-09-24 21:06:47 +00:00
|
|
|
|
2022-04-27 06:38:39 +00:00
|
|
|
config :logger, :ex_syslogger,
|
2022-10-15 07:39:55 +00:00
|
|
|
level: :warn
|
|
|
|
# level: :debug
|
2022-05-09 21:22:15 +00:00
|
|
|
|
|
|
|
# XXX colin: not sure if this actually _does_ anything
|
|
|
|
config :pleroma, :emoji,
|
|
|
|
shortcode_globs: ["/emoji/**/*.png"],
|
|
|
|
groups: [
|
|
|
|
"Cirno": "/emoji/cirno/*.png",
|
|
|
|
"Kirby": "/emoji/kirby/*.png",
|
|
|
|
"Bun": "/emoji/bun/*.png",
|
|
|
|
"Yuru Camp": "/emoji/yuru_camp/*.png",
|
|
|
|
]
|
2022-04-27 06:38:39 +00:00
|
|
|
''
|
|
|
|
];
|
|
|
|
|
|
|
|
systemd.services.pleroma.path = [
|
|
|
|
# something inside pleroma invokes `sh` w/o specifying it by path, so this is needed to allow pleroma to start
|
|
|
|
pkgs.bash
|
|
|
|
# used by Pleroma to strip geo tags from uploads
|
|
|
|
pkgs.exiftool
|
2022-05-09 00:37:49 +00:00
|
|
|
# i saw some errors when pleroma was shutting down about it not being able to find `awk`. probably not critical
|
|
|
|
pkgs.gawk
|
|
|
|
# needed for email operations like password reset
|
|
|
|
pkgs.postfix
|
2022-04-27 06:38:39 +00:00
|
|
|
];
|
2022-05-09 00:37:49 +00:00
|
|
|
|
2022-05-17 07:24:26 +00:00
|
|
|
systemd.services.pleroma.serviceConfig = {
|
|
|
|
# postgres can be slow to service early requests, preventing pleroma from starting on the first try
|
|
|
|
Restart = "on-failure";
|
|
|
|
};
|
|
|
|
|
2022-05-09 00:37:49 +00:00
|
|
|
# systemd.services.pleroma.serviceConfig = {
|
|
|
|
# # required for sendmail. see https://git.pleroma.social/pleroma/pleroma/-/issues/2259
|
|
|
|
# NoNewPrivileges = lib.mkForce false;
|
|
|
|
# PrivateTmp = lib.mkForce false;
|
|
|
|
# CapabilityBoundingSet = lib.mkForce "~";
|
|
|
|
# };
|
2022-06-08 23:46:32 +00:00
|
|
|
|
|
|
|
sops.secrets.pleroma_secrets = {
|
2022-06-12 22:11:41 +00:00
|
|
|
sopsFile = ../../../secrets/servo.yaml;
|
2022-06-08 23:46:32 +00:00
|
|
|
owner = config.users.users.pleroma.name;
|
|
|
|
};
|
2022-04-27 06:38:39 +00:00
|
|
|
}
|