From: Thibaut Girka Date: Sun, 5 Jul 2020 17:35:56 +0000 (+0200) Subject: Merge branch 'master' into glitch-soc/merge-upstream X-Git-Url: https://git.xn--scling-oua.cat.family/?a=commitdiff_plain;h=2d8be0a6e1fbe9da892937b05b373ab907d89b77;p=mastodon.git Merge branch 'master' into glitch-soc/merge-upstream Conflicts: - `.env.production.sample`: Upstream changed it completely. Changed ours to merge upstream's new structure, but keeping most of the information. --- 2d8be0a6e1fbe9da892937b05b373ab907d89b77 diff --cc .env.production.sample index b76a937ad,558ed1880..6d9929f70 --- a/.env.production.sample +++ b/.env.production.sample @@@ -1,292 -1,60 +1,265 @@@ - # Service dependencies - # You may set REDIS_URL instead for more advanced options - # You may also set REDIS_NAMESPACE to share Redis between multiple Mastodon servers - REDIS_HOST=redis - REDIS_PORT=6379 - # You may set DATABASE_URL instead for more advanced options - DB_HOST=db - DB_USER=postgres - DB_NAME=postgres - DB_PASS= - DB_PORT=5432 - # Optional ElasticSearch configuration - # You may also set ES_PREFIX to share the same cluster between multiple Mastodon servers (falls back to REDIS_NAMESPACE if not set) - # ES_ENABLED=true - # ES_HOST=es - # ES_PORT=9200 + # This is a sample configuration file. You can generate your configuration + # with the `rake mastodon:setup` interactive setup wizard, but to customize + # your setup even further, you'll need to edit it manually. This sample does + # not demonstrate all available configuration options. Please look at + # https://docs.joinmastodon/admin/config/ for the full documentation. # Federation - # Note: Changing LOCAL_DOMAIN at a later time will cause unwanted side effects, including breaking all existing federation. - # LOCAL_DOMAIN should *NOT* contain the protocol part of the domain e.g https://example.com. + # ---------- + # This identifies your server and cannot be changed safely later + # ---------- LOCAL_DOMAIN=example.com - # Changing LOCAL_HTTPS in production is no longer supported. (Mastodon will always serve https:// links) - +# Use this only if you need to run mastodon on a different domain than the one used for federation. +# You can read more about this option on https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Serving_a_different_domain.md +# DO *NOT* USE THIS UNLESS YOU KNOW *EXACTLY* WHAT YOU ARE DOING. +# WEB_DOMAIN=mastodon.example.com + +# Use this if you want to have several aliases handler@example1.com +# handler@example2.com etc. for the same user. LOCAL_DOMAIN should not +# be added. Comma separated values +# ALTERNATE_DOMAINS=example1.com,example2.com + - # Application secrets ++# Use HTTP proxy for outgoing request (optional) ++# http_proxy=http://gateway.local:8118 ++# Access control for hidden service. ++# ALLOW_ACCESS_TO_HIDDEN_SERVICE=true ++ ++# Authorized fetch mode (optional) ++# Require remote servers to authentify when fetching toots, see ++# https://docs.joinmastodon.org/admin/config/#authorized_fetch ++# AUTHORIZED_FETCH=true ++ ++# Limited federation mode (optional) ++# Only allow federation with specific domains, see ++# https://docs.joinmastodon.org/admin/config/#whitelist_mode ++# LIMITED_FEDERATION_MODE=true ++ + # Redis + # ----- + REDIS_HOST=localhost + REDIS_PORT=6379 + ++ + # PostgreSQL + # ---------- + DB_HOST=/var/run/postgresql + DB_USER=mastodon + DB_NAME=mastodon_production + DB_PASS= + DB_PORT=5432 + ++ + # ElasticSearch (optional) + # ------------------------ -ES_ENABLED=true -ES_HOST=localhost -ES_PORT=9200 ++#ES_ENABLED=true ++#ES_HOST=localhost ++#ES_PORT=9200 ++ + + # Secrets + # ------- -# Make sure to use `rake secret` to generate secrets +# Generate each with the `RAILS_ENV=production bundle exec rake secret` task (`docker-compose run --rm web bundle exec rake secret` if you use docker compose) + # ------- SECRET_KEY_BASE= OTP_SECRET= - # VAPID keys (used for push notifications - # You can generate the keys using the following command (first is the private key, second is the public one) ++ + # Web Push + # -------- -# Generate with `rake mastodon:webpush:generate_vapid_key` ++# Generate with `rake mastodon:webpush:generate_vapid_key` (first is the private key, second is the public one) +# You should only generate this once per instance. If you later decide to change it, all push subscription will +# be invalidated, requiring the users to access the website again to resubscribe. - # - # Generate with `RAILS_ENV=production bundle exec rake mastodon:webpush:generate_vapid_key` task (`docker-compose run --rm web bundle exec rake mastodon:webpush:generate_vapid_key` if you use docker compose) - # - # For more information visit https://rossta.net/blog/using-the-web-push-api-with-vapid.html + # -------- VAPID_PRIVATE_KEY= VAPID_PUBLIC_KEY= ++ +# Registrations ++# ------------- ++ +# Single user mode will disable registrations and redirect frontpage to the first profile +# SINGLE_USER_MODE=true ++ +# Prevent registrations with following e-mail domains +# EMAIL_DOMAIN_DENYLIST=example1.com|example2.de|etc ++ +# Only allow registrations with the following e-mail domains +# EMAIL_DOMAIN_ALLOWLIST=example1.com|example2.de|etc + ++#TODO move this +# Optionally change default language +# DEFAULT_LOCALE=de + - # E-mail configuration - # Note: Mailgun and SparkPost (https://sparkpo.st/smtp) each have good free tiers - # If you want to use an SMTP server without authentication (e.g local Postfix relay) - # then set SMTP_AUTH_METHOD and SMTP_OPENSSL_VERIFY_MODE to 'none' and - # *comment* SMTP_LOGIN and SMTP_PASSWORD (leaving them blank is not enough). ++ + # Sending mail + # ------------ SMTP_SERVER=smtp.mailgun.org SMTP_PORT=587 SMTP_LOGIN= SMTP_PASSWORD= - SMTP_FROM_ADDRESS=notifications@example.com - #SMTP_REPLY_TO= - #SMTP_DOMAIN= # defaults to LOCAL_DOMAIN - #SMTP_DELIVERY_METHOD=smtp # delivery method can also be sendmail - #SMTP_AUTH_METHOD=plain - #SMTP_CA_FILE=/etc/ssl/certs/ca-certificates.crt - #SMTP_OPENSSL_VERIFY_MODE=peer - #SMTP_ENABLE_STARTTLS_AUTO=true - #SMTP_TLS=true - - # Optional user upload path and URL (images, avatars). Default is :rails_root/public/system. If you set this variable, you are responsible for making your HTTP server (eg. nginx) serve these files. - # PAPERCLIP_ROOT_PATH=/var/lib/mastodon/public-system - # PAPERCLIP_ROOT_URL=/system - - # Optional asset host for multi-server setups - # The asset host must allow cross origin request from WEB_DOMAIN or LOCAL_DOMAIN - # if WEB_DOMAIN is not set. For example, the server may have the - # following header field: - # Access-Control-Allow-Origin: https://example.com/ - # CDN_HOST=https://assets.example.com + SMTP_FROM_ADDRESS=notificatons@example.com - # Optional list of hosts that are allowed to serve media for your instance - # This is useful if you include external media in your custom CSS or about page, - # or if your data storage provider makes use of redirects to other domains. - # EXTRA_DATA_HOSTS=https://data.example1.com|https://data.example2.com + - # S3 (optional) + # File storage (optional) + # ----------------------- -S3_ENABLED=true -S3_BUCKET=files.example.com -AWS_ACCESS_KEY_ID= -AWS_SECRET_ACCESS_KEY= -S3_ALIAS_HOST=files.example.com +# The attachment host must allow cross origin request from WEB_DOMAIN or +# LOCAL_DOMAIN if WEB_DOMAIN is not set. For example, the server may have the +# following header field: +# Access-Control-Allow-Origin: https://192.168.1.123:9000/ - # S3_ENABLED=true - # S3_BUCKET= - # AWS_ACCESS_KEY_ID= - # AWS_SECRET_ACCESS_KEY= - # S3_REGION= - # S3_PROTOCOL=http - # S3_HOSTNAME=192.168.1.123:9000 - - # S3 (Minio Config (optional) Please check Minio instance for details) - # The attachment host must allow cross origin request - see the description - # above. - # S3_ENABLED=true - # S3_BUCKET= - # AWS_ACCESS_KEY_ID= - # AWS_SECRET_ACCESS_KEY= - # S3_REGION= - # S3_PROTOCOL=https - # S3_HOSTNAME= - # S3_ENDPOINT= - # S3_SIGNATURE_VERSION= - - # Google Cloud Storage (optional) - # Use S3 compatible API. Since GCS does not support Multipart Upload, - # increase the value of S3_MULTIPART_THRESHOLD to disable Multipart Upload. - # The attachment host must allow cross origin request - see the description - # above. - # S3_ENABLED=true - # AWS_ACCESS_KEY_ID= - # AWS_SECRET_ACCESS_KEY= - # S3_REGION= - # S3_PROTOCOL=https - # S3_HOSTNAME=storage.googleapis.com - # S3_ENDPOINT=https://storage.googleapis.com - # S3_MULTIPART_THRESHOLD=52428801 # 50.megabytes ++# ----------------------- ++#S3_ENABLED=true ++#S3_BUCKET=files.example.com ++#AWS_ACCESS_KEY_ID= ++#AWS_SECRET_ACCESS_KEY= ++#S3_ALIAS_HOST=files.example.com + +# Swift (optional) +# The attachment host must allow cross origin request - see the description +# above. +# SWIFT_ENABLED=true +# SWIFT_USERNAME= +# For Keystone V3, the value for SWIFT_TENANT should be the project name +# SWIFT_TENANT= +# SWIFT_PASSWORD= +# Some OpenStack V3 providers require PROJECT_ID (optional) +# SWIFT_PROJECT_ID= +# Keystone V2 and V3 URLs are supported. Use a V3 URL if possible to avoid +# issues with token rate-limiting during high load. +# SWIFT_AUTH_URL= +# SWIFT_CONTAINER= +# SWIFT_OBJECT_URL= +# SWIFT_REGION= +# Defaults to 'default' +# SWIFT_DOMAIN_NAME= +# Defaults to 60 seconds. Set to 0 to disable +# SWIFT_CACHE_TTL= + ++# Optional asset host for multi-server setups ++# The asset host must allow cross origin request from WEB_DOMAIN or LOCAL_DOMAIN ++# if WEB_DOMAIN is not set. For example, the server may have the ++# following header field: ++# Access-Control-Allow-Origin: https://example.com/ ++# CDN_HOST=https://assets.example.com ++ ++# Optional list of hosts that are allowed to serve media for your instance ++# This is useful if you include external media in your custom CSS or about page, ++# or if your data storage provider makes use of redirects to other domains. ++# EXTRA_DATA_HOSTS=https://data.example1.com|https://data.example2.com ++ +# Optional alias for S3 (e.g. to serve files on a custom domain, possibly using Cloudfront or Cloudflare) +# S3_ALIAS_HOST= + +# Streaming API integration +# STREAMING_API_BASE_URL= + - # Advanced settings - # If you need to use pgBouncer, you need to disable prepared statements: - # PREPARED_STATEMENTS=false - - # Cluster number setting for streaming API server. - # If you comment out following line, cluster number will be `numOfCpuCores - 1`. - STREAMING_CLUSTER_NUM=1 - - # Docker mastodon user - # If you use Docker, you may want to assign UID/GID manually. - # UID=1000 - # GID=1000 - - # Maximum allowed character count - # MAX_TOOT_CHARS=500 - - # Maximum number of pinned posts - # MAX_PINNED_TOOTS=5 - - # Maximum allowed bio characters - # MAX_BIO_CHARS=500 - - # Maximim number of profile fields allowed - # MAX_PROFILE_FIELDS=4 - - # Maximum allowed display name characters - # MAX_DISPLAY_NAME_CHARS=30 - - # Maximum image and video/audio upload sizes - # Units are in bytes - # 1048576 bytes equals 1 megabyte - # MAX_IMAGE_SIZE=8388608 - # MAX_VIDEO_SIZE=41943040 - - # Maximum search results to display - # Only relevant when elasticsearch is installed - # MAX_SEARCH_RESULTS=20 + ++# External authentication (optional) ++# ---------------------------------- +# LDAP authentication (optional) +# LDAP_ENABLED=true +# LDAP_HOST=localhost +# LDAP_PORT=389 +# LDAP_METHOD=simple_tls +# LDAP_BASE= +# LDAP_BIND_DN= +# LDAP_PASSWORD= +# LDAP_UID=cn +# LDAP_MAIL=mail +# LDAP_SEARCH_FILTER=(|(%{uid}=%{email})(%{mail}=%{email})) +# LDAP_UID_CONVERSION_ENABLED=true +# LDAP_UID_CONVERSION_SEARCH=., - +# LDAP_UID_CONVERSION_REPLACE=_ + +# PAM authentication (optional) +# PAM authentication uses for the email generation the "email" pam variable +# and optional as fallback PAM_DEFAULT_SUFFIX +# The pam environment variable "email" is provided by: +# https://github.com/devkral/pam_email_extractor +# PAM_ENABLED=true +# Fallback email domain for email address generation (LOCAL_DOMAIN by default) +# PAM_EMAIL_DOMAIN=example.com +# Name of the pam service (pam "auth" section is evaluated) +# PAM_DEFAULT_SERVICE=rpam +# Name of the pam service used for checking if an user can register (pam "account" section is evaluated) (nil (disabled) by default) +# PAM_CONTROLLED_SERVICE=rpam + +# Global OAuth settings (optional) : +# If you have only one strategy, you may want to enable this +# OAUTH_REDIRECT_AT_SIGN_IN=true + +# Optional CAS authentication (cf. omniauth-cas) : +# CAS_ENABLED=true +# CAS_URL=https://sso.myserver.com/ +# CAS_HOST=sso.myserver.com/ +# CAS_PORT=443 +# CAS_SSL=true +# CAS_VALIDATE_URL= +# CAS_CALLBACK_URL= +# CAS_LOGOUT_URL= +# CAS_LOGIN_URL= +# CAS_UID_FIELD='user' +# CAS_CA_PATH= +# CAS_DISABLE_SSL_VERIFICATION=false +# CAS_UID_KEY='user' +# CAS_NAME_KEY='name' +# CAS_EMAIL_KEY='email' +# CAS_NICKNAME_KEY='nickname' +# CAS_FIRST_NAME_KEY='firstname' +# CAS_LAST_NAME_KEY='lastname' +# CAS_LOCATION_KEY='location' +# CAS_IMAGE_KEY='image' +# CAS_PHONE_KEY='phone' + +# Optional SAML authentication (cf. omniauth-saml) +# SAML_ENABLED=true +# SAML_ACS_URL=http://localhost:3000/auth/auth/saml/callback +# SAML_ISSUER=https://example.com +# SAML_IDP_SSO_TARGET_URL=https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO +# SAML_IDP_CERT= +# SAML_IDP_CERT_FINGERPRINT= +# SAML_NAME_IDENTIFIER_FORMAT= +# SAML_CERT= +# SAML_PRIVATE_KEY= +# SAML_SECURITY_WANT_ASSERTION_SIGNED=true +# SAML_SECURITY_WANT_ASSERTION_ENCRYPTED=true +# SAML_SECURITY_ASSUME_EMAIL_IS_VERIFIED=true +# SAML_ATTRIBUTES_STATEMENTS_UID="urn:oid:0.9.2342.19200300.100.1.1" +# SAML_ATTRIBUTES_STATEMENTS_EMAIL="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" +# SAML_ATTRIBUTES_STATEMENTS_FULL_NAME="urn:oid:2.16.840.1.113730.3.1.241" +# SAML_ATTRIBUTES_STATEMENTS_FIRST_NAME="urn:oid:2.5.4.42" +# SAML_ATTRIBUTES_STATEMENTS_LAST_NAME="urn:oid:2.5.4.4" +# SAML_UID_ATTRIBUTE="urn:oid:0.9.2342.19200300.100.1.1" +# SAML_ATTRIBUTES_STATEMENTS_VERIFIED= +# SAML_ATTRIBUTES_STATEMENTS_VERIFIED_EMAIL= + - # Use HTTP proxy for outgoing request (optional) - # http_proxy=http://gateway.local:8118 - # Access control for hidden service. - # ALLOW_ACCESS_TO_HIDDEN_SERVICE=true + - # Authorized fetch mode (optional) - # Require remote servers to authentify when fetching toots, see - # https://docs.joinmastodon.org/admin/config/#authorized_fetch - # AUTHORIZED_FETCH=true ++# Custom settings ++# --------------- ++# Various ways to customize Mastodon's behavior ++# --------------- ++ ++# Maximum allowed character count ++MAX_TOOT_CHARS=500 + - # Limited federation mode (optional) - # Only allow federation with specific domains, see - # https://docs.joinmastodon.org/admin/config/#whitelist_mode - # LIMITED_FEDERATION_MODE=true ++# Maximum number of pinned posts ++MAX_PINNED_TOOTS=5 ++ ++# Maximum allowed bio characters ++MAX_BIO_CHARS=500 ++ ++# Maximim number of profile fields allowed ++MAX_PROFILE_FIELDS=4 ++ ++# Maximum allowed display name characters ++MAX_DISPLAY_NAME_CHARS=30 ++ ++# Maximum image and video/audio upload sizes ++# Units are in bytes ++# 1048576 bytes equals 1 megabyte ++# MAX_IMAGE_SIZE=8388608 ++# MAX_VIDEO_SIZE=41943040 ++ ++# Maximum search results to display ++# Only relevant when elasticsearch is installed ++# MAX_SEARCH_RESULTS=20