Update nginx config according to upstream

instance name or originator it seems

863477173e/server/lib/emailer.ts (L138)

.dockerignore

@@ -2,5 +2,6 @@
 .gitignore
 .dockerignore
 node_modules
-screenshots
+screenshots/
+test/
 

.gitignore

@@ -0,0 +1,2 @@
+node_modules
+

CHANGELOG

@@ -1,9 +0,0 @@
-[0.1.0]
-* Initial version
-
-[0.2.0]
-* Update logo
-
-[0.3.0]
-* Set min box version to 5.3.0
-

CHANGELOG.md

@@ -0,0 +1,319 @@
+[0.1.0]
+* Initial version
+
+[0.2.0]
+* Update logo
+
+[0.3.0]
+* Set min box version to 5.3.0
+
+[0.4.0]
+* Set trust proxy correctly
+* Update PeerTube to 2.3.0
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v2.3.0)
+* Add global search support (has to be explicitely enabled by admins)
+* Add ability for admins to display a banner on their instance
+* Support Vietnamese and Kabyle languages. Also re-establish Occitan language locale despite lack of support in Angular
+* Add video miniature dropdown in Discover page
+* Add channel information in My videos page
+* Add videos count per channel in My channels page
+
+[0.5.0]
+* Fix issue where configs were not loaded correctly
+
+[0.6.0]
+* Install CLI tool in /app/code/cli
+
+[0.7.0]
+* Update Peertube to 2.4.0
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v2.4.0)
+* Add global search support (has to be explicitely enabled by admins)
+* Add ability for admins to display a banner on their instance
+* Support Vietnamese and Kabyle languages. Also re-establish Occitan language locale despite lack of support in Angular
+* Moderation:
+  * Add ability to bulk delete comments of an account
+  * Add ability to mute accounts from video miniature
+  * Improve report modal: @rigelk in #2842
+* Replaced softies icons by feather icons @rigelk
+* Support player hotkeys when it is not focused
+* Improve video miniature grids to fill the space as much as possible @rigelk
+* Add video miniature dropdown in Discover page
+
+[1.0.0]
+* Fix transcoding issues
+
+[1.1.0]
+* Enable LDAP
+
+[1.1.1]
+* Fix transcoding error with readonly file system
+
+[1.2.0]
+* Update ffmpeg to 4.3
+
+[1.2.0]
+* Update to Peertube v3.0.0 RC1
+
+[2.0.0]
+* Update to Peertube v3.0.0
+* Remove deprecated video abuse API
+* Update the default configuration to not federate unlisted videos. We recommend to admins to update this [setting](https://github.com/Chocobozzz/PeerTube/blob/develop/config/production.yaml.example#L182)
+* Update the default configuration to remove remote video views to reduce DB size and improve performances. We recommend to admins to update this [setting](https://github.com/Chocobozzz/PeerTube/blob/develop/config/production.yaml.example#L170)
+
+[2.0.1]
+* Update Peertube to 3.0.1
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v3.0.1)
+* Security: Fix retrieving data of another user if the username contains _ when fetching my information
+* Fix account feed URL
+* Log RTMP server error (address already in use)
+* Fix NPM theme links in admin theme page
+* Don't reject AP actors with empty description
+
+[2.0.2]
+* Update base image to v3
+
+[2.1.0]
+* Update Peertube to 3.1.0
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v3.1.0)
+* Fair transcoding jobs priority: give an higher priority to optimize jobs and decrease priority of transcoding jobs depending on the amount of videos uploaded by the user during the last 7 days #3637
+* Allow admins to choose the transcoding jobs concurrency
+* Support Albanian locale
+* Async torrent creation on video upload. We hope that it should fix some weird upload errors
+* Add .m4a audio upload support
+* Stricter youtube-dl format selectors for import (don't import HDR videos and cap to the max supported resolution) #3516
+* Don't publish imported videos before the user submitted the second step form
+* Implement hot and best trending algorithms #3625 & #3681
+* Support webp avatar upload
+* Allow user to search through their watch history #3576
+* Allow AP resolution for default account/channel pages (/accounts/:name/video-channels and /video-channels/:name/videos)
+
+[2.2.0]
+* Update Peertube to 3.2.1
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v3.2.0)
+* By default, HLS transcoding is now enabled and webtorrent is disabled. We suggest you to reflect this change.
+* PeerTube client now displays bigger video thumbnails.
+
+[2.3.0]
+* Update PeerTube to 3.3.0
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v3.3.0)
+
+[2.4.0]
+* Update PeerTube to 3.4.0
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v3.4.0)
+* Add video filters to common video pages (account videos, channel videos, recently added/local/trending videos...)
+* Add ability for instances to follow any actor (so specific accounts and channels)
+* Updated HLS.js (library to play HLS playlists in PeerTube player) to V1:
+* Add ability to search by PeerTube host in search filters
+* Disallow search engine indexation of remote channels/accounts
+* Support Latin language for videos
+
+[2.4.1]
+* Update PeerTube to 3.4.1
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v3.4.1)
+* Fix broken PeerTube when cookies are disabled or if the embed iframe does not have appropriate options
+* Fix search by channel's handle with an handle containing the local host
+* Don't display autoblock message in upload page it is not enabled by the admin
+* Don't index /about/peertube page
+* Correctly handle OEmbed with an URL containing query parameters
+* More robust youtube-dl thumbnail import
+* Don't send a new video notification when using create transcoding CLI script
+
+[2.5.0]
+* Update PeerTube to 4.0.0
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v4.0.0)
+
+[2.5.1]
+* Update base image to 3.2.0
+
+[2.6.0]
+* Update PeerTube to 4.1.0
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v4.1.0)
+* Player improvements
+* Search improvements
+* Video imports
+* Add ability for users to delete individual elements in videos history
+* Show date and views counter in playlist element miniature #4396
+* Add norsk locale support
+* Check mute status and display mute badges in channel and account pages
+* Add No linguistic content video language option #4631
+* Don't send notifications to admins/moderators if an admin/moderator reported an abuse
+* Add ability for moderators/admins to edit any channel #4608
+* Add a refresh button to admin videos overview page #4753
+
+[2.6.1]
+* Update PeerTube to 4.1.1
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v4.1.1)
+* Strip EXIF data when processing images
+
+[2.6.2]
+* Patch CLI tool - see #4858
+
+[2.6.3]
+* Add prosody for livechat-plugin
+
+[2.6.4]
+* Symlink cache folder for node-gyp to work
+
+[2.7.0]
+* Update PeerTube to 4.2.0
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v4.2.0)
+
+[2.7.1]
+* Update PeerTube to 4.2.1
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v4.2.1)
+* Fix live ending job that breaks new live session
+* Fix search filters counter
+* Fix upload banner icon margin
+* Fix button icon margin
+* Fix my import expander icon that should only be displayed on import error
+* Fix select components styling inconsistency
+* Increase max watch section to avoid too much warnings in server
+* Optimize broadcast job creation
+* Optimize View activities delivery using a dedicated broadcast job queue that can be run in parallel
+* Fix video selection buttons placement
+* Fix searching into account blocklist
+* Fix incorrect instance stats
+* Fix broken player on ICE error
+* Relax views federation
+* Fix peertube user in docker
+* Fix playlist element federation with a deleted video
+
+[2.7.2]
+* Update PeerTube to 4.2.2
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v4.2.2)
+* Upgrade vulnerable server dependencies
+* Fix fast restream in permanent live
+* Fix latency mode setting when creating a live
+* Fix unique constraint tag violation when importing videos
+* Fix latest live sessions order
+* Fix server crash feed when accessing feeds that contains a live
+* Fix false boolean attribute (data-is-live etc) in custom markup
+
+[2.8.0]
+* Update PeerTube to 4.3.0
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v4.3.0)
+* Use yt-dlp by default instead of youtube-dl for new installations (because of much more dev activity)
+* Reduce amount of PeerTube error logs
+* Introduce log.log_tracker_unknown_infohash setting to disable "Unknown infoHash" warnings
+* Web browsers send their error logs to the server that writes them in its own logs. Can be disabled by log.accept_client_log setting
+* Enable metrics export using a Prometheus exporter
+* Enable tracing export using a Jaeger exporter
+* Automatically rebuild native plugin modules on NodeJS ABI change
+
+[2.8.1]
+* Update PeerTube to 4.3.1
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v4.3.1)
+* Prevent XSS in sort select on pages that list videos. Thanks to Anthony Roth who reported the vulnerability!
+* Fix broken embed player on live reload
+* Fix channel follow when manually approve instance followers is enabled
+* Fix input with number overflow on small screen
+* Fix moderation dropdown overflow on mobile
+
+[2.9.0]
+* Update PeerTube to 5.0.0
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v5.0.0)
+* Support object storage for live streams tada
+* Support Two Factor authentication (OTP) tada
+* Add explanation on disk space used for user quota admin config #5305
+* Display channel in my videos list
+* Show which playlists videos are added to in my videos list
+* Add Channels link in left menu
+* Add ... after the truncated video name in miniature
+* Add object storage info badge in videos admin overview
+* Add links to video files in videos admin overview
+* Better indicate the live ended in embed by displaying a message and the live preview
+* Force live autoplay by muting the video if necessary when the user was waiting for the live
+* Handle network issues in video player #5138
+* Cache chunks to upload in server to resume upload later #5224
+* Add ability to serve custom static files under /.well-known URL path #5214
+* Use account/channel avatar in account/channel RSS feeds #5325
+* Add filter to sort videos by name #5351
+* Add ability to configure OpenTelemetry Prometheus exporter listening hostname
+
+[2.10.0]
+* Update base image to 4.0.0
+
+[2.10.1]
+* Update PeerTube to 5.0.1
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v5.0.1)
+* Fix HLS player infinite loading when the live stream/video ends
+* Do not autoplay live without autoplay setting
+* Fix private/internal video playback from Cloudflare object storage
+* Fix local channel stats/OpenTelemetry metric
+* Also display dropdown for videos from the homepage
+* Fix broken P2P with live stream coming from object storage
+* Fix responsive of table pagination
+
+[2.10.2]
+* Remove invokation of 5.0 upgade script
+
+[2.11.0]
+* Update PeerTube to 5.1.0
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v5.1.0)
+* **IMPORTANT**: If your instance has signup enabled, user registration approval is automatically enabled by the default configuration of this release. You can change this setting in your production.yaml or in the configuration page in the web admin
+Update web browsers support list:
+  * Drop support of Safari 11 on iOS
+  * Drop support of Safari 11 on desktop
+  * Drop support of Firefox 68 on desktop
+* Implement user registration approval (https://docs.joinpeertube.org/admin/managing-users#registration-approval) #5544
+* Add "back to live" button in player
+* Add Icelandic & Ukrainian locales
+* Add Global views default trending algorithm option in admin configuration #5471
+
+[2.12.0]
+* Update PeerTube to 5.2.0
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v5.2.0)
+* Implement remote transcoding for VOD videos, Live streams and Studio editions tada #5769
+* If enabled, remote PeerTube runners can process these high CPU jobs
+* Admin documentation: https://docs.joinpeertube.org/admin/remote-runners
+* PeerTube runner CLI documentation: https://docs.joinpeertube.org/maintain/tools#peertube-runner
+* Demonstration video: https://peertube2.cpy.re/w/oJwHHYwt4oKjKhLNh2diAY
+* Architecture documentation: https://docs.joinpeertube.org/contribute/architecture#remote-vod-live-transcoding
+* Add Podcast RSS feed support: #5487
+* Add ability to set custom privacy for live replays #5692
+* Render images of markdown fields in About page #5732
+* Admin can disable user video history by default #5728
+* Improve global accessibility
+
+[2.12.1]
+* Update PeerTube to 5.2.1
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v5.2.1)
+* Fix loading spinner displayed forever on Chrome
+* Fix broken replay with long live name
+* Fix fps transcoding on remote runners
+* Fix terms/code of conduct link toggle
+
+[2.13.0]
+* Update base image to 4.2.0
+
+[2.14.0]
+* Update PeerTube to 6.0.2
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v6.0.2)
+* [Important breaking changes in 6.0](https://github.com/Chocobozzz/PeerTube/blob/develop/CHANGELOG.md#v600). Some keys in `production.yaml` have been renamed (for example, object storage keys).
+
+[2.15.0]
+* Migrate to OIDC login
+
+[2.15.1]
+* Update PeerTube to 6.0.3
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v6.0.3)
+* Fix HTML meta tags with attributes that contain quotes
+* Fix time parsing resulting in broken video start time in some cases
+* Fix WebTorrent video import crash
+* Reload Discover page on logout
+* Fix privacy error when updating a live, even if the privacy has not changed
+* Fix invalid remote live state change notification that causes the player to reload
+* Don't apply big play button skin to settings menu
+* Fix downloading video files from object storage with some video names (that include emojis, quotes etc)
+
+[2.15.2]
+* Update PeerTube to 6.0.4
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v6.0.4)
+* Important: Prevent XSS injection in embed. Thanks Syst3m0ver!
+
+[2.16.0]
+* Update PeerTube to 6.1.0
+* [Full changelog](https://github.com/Chocobozzz/PeerTube/releases/tag/v6.1.0)
+* Compact ActivityPub JSON-LD objects before using them to prevent incorrect access control @tesaguri
+* Protect ActivityPub information related to private/internal/blocked videos
+

CloudronManifest.json

@@ -1,5 +1,6 @@
 {
-  "version": "0.3.0",
+  "version": "2.16.0",
+  "upstreamVersion": "6.1.0",
   "id": "org.joinpeertube.cloudronapp",
   "title": "PeerTube",
   "author": "PeerTube developers",
@@ -9,23 +10,35 @@
   "tagline": "Take back control of your videos",
   "icon": "file://logo.png",
   "healthCheckPath": "/",
-  "httpPort": 9000,
+  "httpPort": 80,
+  "tcpPorts": {
+    "RTMP_PORT": {
+      "title": "RTMP Port",
+      "description": "RTMP Port for livestreaming",
+      "defaultValue": 1935,
+      "containerPort": 1935
+    }
+  },
   "addons": {
     "localstorage": {},
     "postgresql": {},
     "redis": {},
-    "sendmail": {}
+    "sendmail": { "supportsDisplayName": false },
+    "oidc": { "loginRedirectUri": "/plugins/auth-openid-connect/router/code-cb" }
   },
-  "tags": [ "video", "youtube", "vimeo", "blog", "instagram" ],
+  "memoryLimit": 1073741824,
+  "forumUrl": "https://forum.cloudron.io/category/91/peertube",
+  "optionalSso": true,
+  "tags": [ "video", "youtube", "vimeo", "blog", "instagram", "media", "federated" ],
   "mediaLinks": [
-    "https://cloudron-app-screenshots.s3.amazonaws.com/org.joinpeertube.cloudronapp/ae8ff10c10b69017eac15d4bf0f432db932a5082/peertube-screenshot.jpg",
-    "https://cloudron-app-screenshots.s3.amazonaws.com/org.joinpeertube.cloudronapp/ae8ff10c10b69017eac15d4bf0f432db932a5082/home.png",
-    "https://cloudron-app-screenshots.s3.amazonaws.com/org.joinpeertube.cloudronapp/ae8ff10c10b69017eac15d4bf0f432db932a5082/subscribe.png"
+    "https://screenshots.cloudron.io/org.joinpeertube.cloudronapp/peertube-screenshot.jpg",
+    "https://screenshots.cloudron.io/org.joinpeertube.cloudronapp/home.png",
+    "https://screenshots.cloudron.io/org.joinpeertube.cloudronapp/subscribe.png"
   ],
-  "changelog": "file://CHANGELOG",
+  "changelog": "file://CHANGELOG.md",
   "postInstallMessage": "file://POSTINSTALL.md",
-  "documentationUrl": "https://cloudron.io/documentation/apps/peertube/",
-  "minBoxVersion": "5.3.0",
+  "documentationUrl": "https://docs.cloudron.io/apps/peertube/",
+  "minBoxVersion": "7.4.0",
   "manifestVersion": 2
 }
 

DESCRIPTION.md

@@ -1,5 +1,3 @@
-This app packages PeerTube <upstream>2.2.0</upstream>
-
 ## About
 
 PeerTube is a free, decentralized and federated video platform developed as an alternative to other platforms that centralize our data and attention, such as YouTube, Dailymotion or Vimeo.

Dockerfile

@@ -1,35 +1,48 @@
-FROM cloudron/base:2.0.0@sha256:f9fea80513aa7c92fe2e7bf3978b54c8ac5222f47a9a32a7f8833edf0eb5a4f4
+FROM cloudron/base:4.2.0@sha256:46da2fffb36353ef714f97ae8e962bd2c212ca091108d768ba473078319a47f4
 
-RUN mkdir -p /app/code /app/pkg
-WORKDIR /app/code
+RUN mkdir -p /app/code/server /app/pkg
+WORKDIR /app/code/server
 
-RUN apt-get -y update && apt -y install ffmpeg && rm -rf /var/cache/apt /var/lib/apt/lists
+RUN apt update && apt install -y prosody && rm -rf /var/cache/apt /var/lib/apt/lists
 
-# install yq
-RUN curl -sL https://github.com/mikefarah/yq/releases/download/3.2.1/yq_linux_amd64 -o /usr/bin/yq && \
-    chmod +x /usr/bin/yq
+ARG VERSION=6.1.0
 
-ARG VERSION=2.2.0
+# install peertube. the chown is required for some reason for ffmpeg. it fails with EROFS without it when transcoding
+RUN curl -sL https://github.com/Chocobozzz/PeerTube/releases/download/v${VERSION}/peertube-v${VERSION}.tar.xz | tar --strip-components 1 -Jxvf - && \
+    yarn install --production --pure-lockfile
 
-# install peertube
-RUN curl -sL https://github.com/Chocobozzz/PeerTube/releases/download/v${VERSION}/peertube-v${VERSION}.tar.xz | tar --strip-components 1 -Jxvf -
-RUN yarn install --production --pure-lockfile
+RUN npm install -g @peertube/peertube-cli
 
-# remove the peertube suffix of dbname (see https://github.com/Chocobozzz/PeerTube/pull/2898)
-RUN sed -e "s/DBNAME: 'peertube' +/DBNAME: /g" -i dist/server/initializers/config.js
+# the json is created and managed by web ui. it overrides the yaml file (https://github.com/lorenwest/node-config/wiki/Configuration-Files)
+RUN ln -sf /app/data/production.yaml /app/code/server/config/production.yaml && \
+    ln -sf /app/data/local-production.json /app/code/server/config/local-production.json
 
-# dbname branch
-# ARG VERSION=e7fe135b5a5666147256efa11d15474d761c37d4
-# RUN curl -L https://github.com/cloudron-io/PeerTube/archive/${VERSION}.tar.gz | tar -zxvf - --strip-components=1
-# 
-# RUN yarn install && npm run build
+# youtube-dl
+RUN curl -L https://yt-dl.org/downloads/latest/youtube-dl -o /usr/local/bin/youtube-dl && chmod +x /usr/local/bin/youtube-dl
 
-RUN ln -sf /app/data/production.yaml /app/code/config/local-production.yaml
+# required when installing plugins/themes that use node-gyp
+RUN rm -rf /home/cloudron/.cache && ln -s /run/peertube/cache /home/cloudron/.cache && \
+    rm -rf /home/cloudron/.npm && ln -s /run/peertube/npm /home/cloudron/.npm
 
 COPY production.yaml.example start.sh /app/pkg/
 
 ENV NODE_ENV production
-ENV NODE_CONFIG_DIR /app/code/config
+ENV NODE_CONFIG_DIR /app/code/server/config
+
+RUN printf '#!/bin/bash\n\ncd /app/code/cli && node dist/server/tools/peertube.js $@\n' > /usr/bin/peertube && chmod +x /usr/bin/peertube
+
+
+# add nginx config
+RUN rm /etc/nginx/sites-enabled/*
+RUN ln -sf /dev/stdout /var/log/nginx/access.log
+RUN ln -sf /dev/stderr /var/log/nginx/error.log
+RUN ln -sf /run/peertube-nginx.conf /etc/nginx/sites-enabled/peertube.conf
+COPY nginx/readonlyrootfs.conf /etc/nginx/conf.d/readonlyrootfs.conf
+COPY nginx/peertube.conf /app/pkg/peertube-nginx.conf
+
+# supervisor
+COPY supervisor/ /etc/supervisor/conf.d/
+RUN sed -e 's,^logfile=.*$,logfile=/run/supervisord.log,' -i /etc/supervisor/supervisord.conf
 
 CMD [ "/app/pkg/start.sh" ]
 

POSTINSTALL.md

@@ -1,12 +1,10 @@
-PeerTube does not integrate with Cloudron user management.
+This app is pre-setup with an admin account. The initial credentials are:
 
-There is a preconfigured administrator account with the following credentials:
+**Username**: root<br/>
+**Password**: changeme<br/>
 
-* Username: `root`
-* Password: `changeme`
+Please change the admin password immediately.
 
-(Please change that password on first login)
-
-**IMPORTANT:** PeerTube does not support changing the location of
-the app after installation. Doing so, will break the installation.
+IMPORTANT: PeerTube does not support changing the location of the app after installation. Doing so, will
+break the installation.
 

README.md

@@ -0,0 +1,36 @@
+# PeerTube Cloudron App
+
+This repository contains the Cloudron app package source for [PeerTube](https://joinpeertube.org/)
+
+## Installation
+
+[![Install](https://cloudron.io/img/button.svg)](https://cloudron.io/button.html?app=org.joinpeertube.cloudronapp)
+
+or using the [Cloudron command line tooling](https://cloudron.io/references/cli.html)
+
+```
+cloudron install --appstore-id org.joinpeertube.cloudronapp
+```
+
+## Building
+
+The app package can be built using the [Cloudron command line tooling](https://cloudron.io/references/cli.html).
+
+```
+cd peertube-app
+
+cloudron build
+cloudron install
+```
+
+## Testing
+
+The e2e tests are located in the `test/` folder and require [nodejs](http://nodejs.org/). They are creating a fresh build, install the app on your Cloudron, perform tests, backup, restore and test if the repos are still ok. The tests expect port 29418 to be available.
+
+```
+cd peertube-app/test
+
+npm install
+USERNAME=<cloudron username> PASSWORD=<cloudron password> mocha --bail test.js
+```
+

nginx/peertube.conf

@@ -0,0 +1,217 @@
+upstream backend {
+  server 127.0.0.1:9000;
+}
+
+server {
+  listen 80;
+  server_name default_server;
+
+  ##
+  # Application
+  ##
+
+  location @api {
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header Host            $host;
+    proxy_set_header X-Real-IP       $remote_addr;
+
+    client_max_body_size  100k; # default is 1M
+
+    proxy_connect_timeout 10m;
+    proxy_send_timeout    10m;
+    proxy_read_timeout    10m;
+    send_timeout          10m;
+
+    proxy_pass http://backend;
+  }
+
+  location / {
+    try_files /dev/null @api;
+  }
+
+  location ~ ^/api/v1/videos/(upload-resumable|([^/]+/source/replace-resumable))$ {
+    client_max_body_size    0;
+    proxy_request_buffering off;
+
+    try_files /dev/null @api;
+  }
+
+  location ~ ^/api/v1/users/[^/]+/imports/import-resumable$ {
+    client_max_body_size    0;
+    proxy_request_buffering off;
+
+    try_files /dev/null @api;
+  }
+
+  location ~ ^/api/v1/videos/(upload|([^/]+/studio/edit))$ {
+    limit_except POST HEAD { deny all; }
+
+    # This is the maximum upload size, which roughly matches the maximum size of a video file.
+    # Note that temporary space is needed equal to the total size of all concurrent uploads.
+    # This data gets stored in /var/lib/nginx by default, so you may want to put this directory
+    # on a dedicated filesystem.
+    client_max_body_size                      12G; # default is 1M
+    add_header            X-File-Maximum-Size 8G always; # inform backend of the set value in bytes before mime-encoding (x * 1.4 >= client_max_body_size)
+
+    try_files /dev/null @api;
+  }
+
+  location ~ ^/api/v1/runners/jobs/[^/]+/(update|success)$ {
+    client_max_body_size                      12G; # default is 1M
+    add_header            X-File-Maximum-Size 8G always; # inform backend of the set value in bytes before mime-encoding (x * 1.4 >= client_max_body_size)
+
+    try_files /dev/null @api;
+  }
+
+  location ~ ^/api/v1/(videos|video-playlists|video-channels|users/me) {
+    client_max_body_size                      6M; # default is 1M
+    add_header            X-File-Maximum-Size 4M always; # inform backend of the set value in bytes before mime-encoding (x * 1.4 >= client_max_body_size)
+
+    try_files /dev/null @api;
+  }
+
+  ##
+  # Websocket
+  ##
+
+  location @api_websocket {
+    proxy_http_version 1.1;
+    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header   Host            $host;
+    proxy_set_header   X-Real-IP       $remote_addr;
+    proxy_set_header   Upgrade         $http_upgrade;
+    proxy_set_header   Connection      "upgrade";
+
+    proxy_pass http://backend;
+  }
+
+  location /socket.io {
+    try_files /dev/null @api_websocket;
+  }
+
+  location /tracker/socket {
+    # Peers send a message to the tracker every 15 minutes
+    # Don't close the websocket before then
+    proxy_read_timeout 15m; # default is 60s
+
+    try_files /dev/null @api_websocket;
+  }
+
+  # Plugin websocket routes
+  location ~ ^/plugins/[^/]+(/[^/]+)?/ws/ {
+    try_files /dev/null @api_websocket;
+  }
+
+  ##
+  # Performance optimizations
+  # For extra performance please refer to https://github.com/denji/nginx-tuning
+  ##
+
+  #  root /var/www/peertube/storage;
+  root /app/data/storage;
+
+  # Enable compression for JS/CSS/HTML, for improved client load times.
+  # It might be nice to compress JSON/XML as returned by the API, but
+  # leaving that out to protect against potential BREACH attack.
+  gzip              on;
+  gzip_vary         on;
+  gzip_types        # text/html is always compressed by HttpGzipModule
+                    text/css
+                    application/javascript
+                    font/truetype
+                    font/opentype
+                    application/vnd.ms-fontobject
+                    image/svg+xml;
+  gzip_min_length   1000; # default is 20 bytes
+  gzip_buffers      16 8k;
+  gzip_comp_level   2; # default is 1
+
+  client_body_timeout       30s; # default is 60
+  client_header_timeout     10s; # default is 60
+  send_timeout              10s; # default is 60
+  keepalive_timeout         10s; # default is 75
+  resolver_timeout          10s; # default is 30
+  reset_timedout_connection on;
+  proxy_ignore_client_abort on;
+
+  tcp_nopush                on; # send headers in one piece
+  tcp_nodelay               on; # don't buffer data sent, good for small data bursts in real time
+
+  # If you have a small /var/lib partition, it could be interesting to store temp nginx uploads in a different place
+  # See https://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_temp_path
+  #client_body_temp_path /var/www/peertube/storage/nginx/;
+
+  # Bypass PeerTube for performance reasons. Optional.
+  # Should be consistent with client-overrides assets list in client.ts server controller
+  location ~ ^/client/(assets/images/(icons/icon-36x36\.png|icons/icon-48x48\.png|icons/icon-72x72\.png|icons/icon-96x96\.png|icons/icon-144x144\.png|icons/icon-192x192\.png|icons/icon-512x512\.png|logo\.svg|favicon\.png|default-playlist\.jpg|default-avatar-account\.png|default-avatar-account-48x48\.png|default-avatar-video-channel\.png|default-avatar-video-channel-48x48\.png))$ {
+    add_header Cache-Control "public, max-age=31536000, immutable"; # Cache 1 year
+
+    root /app/code/server;
+
+    #    try_files /storage/client-overrides/$1 /peertube-latest/client/dist/$1 @api;
+    try_files /app/data/storage/client-overrides/$1 /app/code/server/client/dist/$1 @api;
+  }
+
+  # Bypass PeerTube for performance reasons. Optional.
+  location ~ ^/client/(.*\.(js|css|png|svg|woff2|otf|ttf|woff|eot))$ {
+    add_header Cache-Control "public, max-age=31536000, immutable"; # Cache 1 year
+
+    #    alias /var/www/peertube/peertube-latest/client/dist/$1;
+    alias /app/code/server/client/dist/$1;
+  }
+
+  location ~ ^(/static/(webseed|web-videos|streaming-playlists/hls)/private/)|^/download {
+    # We can't rate limit a try_files directive, so we need to duplicate @api
+
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header Host            $host;
+    proxy_set_header X-Real-IP       $remote_addr;
+
+    proxy_limit_rate 5M;
+
+    proxy_pass http://backend;
+  }
+
+  # Bypass PeerTube for performance reasons. Optional.
+  location ~ ^/static/(webseed|web-videos|redundancy|streaming-playlists)/ {
+    limit_rate_after            5M;
+
+    set $peertube_limit_rate  5M;
+
+    # Use this line with nginx >= 1.17.0
+    limit_rate $peertube_limit_rate;
+    # Or this line with nginx < 1.17.0
+    # set $limit_rate $peertube_limit_rate;
+
+    if ($request_method = 'OPTIONS') {
+      add_header Access-Control-Allow-Origin  '*';
+      add_header Access-Control-Allow-Methods 'GET, OPTIONS';
+      add_header Access-Control-Allow-Headers 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
+      add_header Access-Control-Max-Age       1728000; # Preflight request can be cached 20 days
+      add_header Content-Type                 'text/plain charset=UTF-8';
+      add_header Content-Length               0;
+      return 204;
+    }
+
+    if ($request_method = 'GET') {
+      add_header Access-Control-Allow-Origin  '*';
+      add_header Access-Control-Allow-Methods 'GET, OPTIONS';
+      add_header Access-Control-Allow-Headers 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
+
+      # Don't spam access log file with byte range requests
+      access_log off;
+    }
+
+    # Enabling the sendfile directive eliminates the step of copying the data into the buffer
+    # and enables direct copying data from one file descriptor to another.
+    sendfile on;
+    sendfile_max_chunk 1M; # prevent one fast connection from entirely occupying the worker process. should be > 800k.
+    aio threads;
+
+    # web-videos is the name of the directory mapped to the `storage.web_videos` key in your PeerTube configuration
+    rewrite ^/static/webseed/(.*)$ /web-videos/$1 break;
+    rewrite ^/static/(.*)$         /$1        break;
+
+    try_files $uri @api;
+  }
+}

nginx/readonlyrootfs.conf

@@ -0,0 +1,7 @@
+# this is already in a http block
+
+client_body_temp_path /run/nginx;
+proxy_temp_path /run/nginx;
+fastcgi_temp_path /run/nginx;
+uwsgi_temp_path /run/nginx;
+scgi_temp_path /run/nginx;

production.yaml.example

@@ -30,13 +30,13 @@ rates_limit:
 # If you run PeerTube just behind a local proxy (nginx), keep 'loopback'
 # If you run PeerTube behind a remote proxy, add the proxy IP address (or subnet)
 trust_proxy:
+  - 172.18.0.0/16
   - 'loopback'
 
-# Your database name will be "peertube"+database.suffix
 database:
   hostname: 'localhost'
+  name: 'dbname'
   port: 5432
-  suffix: '_prod'
   username: 'peertube'
   password: 'peertube'
   pool:
@@ -74,18 +74,20 @@ email:
 
 # From the project root directory
 storage:
-  tmp: '/var/www/peertube/storage/tmp/' # Use to download data (imports etc), store uploaded files before processing...
-  avatars: '/var/www/peertube/storage/avatars/'
-  videos: '/var/www/peertube/storage/videos/'
-  streaming_playlists: '/var/www/peertube/storage/streaming-playlists/'
-  redundancy: '/var/www/peertube/storage/redundancy/'
-  logs: '/var/www/peertube/storage/logs/'
-  previews: '/var/www/peertube/storage/previews/'
-  thumbnails: '/var/www/peertube/storage/thumbnails/'
-  torrents: '/var/www/peertube/storage/torrents/'
-  captions: '/var/www/peertube/storage/captions/'
-  cache: '/var/www/peertube/storage/cache/'
-  plugins: '/var/www/peertube/storage/plugins/'
+  tmp: '/app/data/storage/tmp/' # Use to download data (imports etc), store uploaded files before processing...
+  avatars: '/app/data/storage/avatars/'
+  web_videos: '/app/data/storage/web-videos/'
+  streaming_playlists: '/app/data/storage/streaming-playlists/'
+  redundancy: '/app/data/storage/redundancy/'
+  logs: '/app/data/storage/logs/'
+  previews: '/app/data/storage/previews/'
+  thumbnails: '/app/data/storage/thumbnails/'
+  storyboards: '/app/data/storage/storyboards/'
+  torrents: '/app/data/storage/torrents/'
+  captions: '/app/data/storage/captions/'
+  cache: '/app/data/storage/cache/'
+  plugins: '/app/data/storage/plugins/'
+  client_overrides: '/app/data/storage/client-overrides/'
 
 log:
   level: 'info' # debug/info/warning/error
@@ -239,7 +241,7 @@ transcoding:
   # Generate videos in a WebTorrent format (what we do since the first PeerTube release)
   # If you also enabled the hls format, it will multiply videos storage by 2
   # If disabled, breaks federation with PeerTube instances < 2.1
-  webtorrent:
+  web_videos:
     enabled: true
 
   # /!\ Requires ffmpeg >= 4.1

start.sh

@@ -2,55 +2,148 @@
 
 set -eu
 
-mkdir -p /app/data/storage
+mkdir -p /app/data/storage /run/peertube/cache /run/peertube/npm /tmp/peertube
 
-reset_root_password() {
+# do not rely on WORKDIR
+cd /app/code/server
+
+migrate_ldap_to_oidc() {
+    USERS_TO_MIGRATE=$(PGPASSWORD=${CLOUDRON_POSTGRESQL_PASSWORD} psql -h ${CLOUDRON_POSTGRESQL_HOST} -p ${CLOUDRON_POSTGRESQL_PORT} -U ${CLOUDRON_POSTGRESQL_USERNAME} -d ${CLOUDRON_POSTGRESQL_DATABASE} -AXqtc "SELECT count(*) FROM \"user\" u WHERE \"pluginAuth\"='peertube-plugin-auth-ldap'")
+    echo "==> Migrating users to OIDC";
+    echo "      Users to migrate: ${USERS_TO_MIGRATE}"
+    if [ ${USERS_TO_MIGRATE} -gt 0 ]; then
+        PGPASSWORD=${CLOUDRON_POSTGRESQL_PASSWORD} psql -h ${CLOUDRON_POSTGRESQL_HOST} -p ${CLOUDRON_POSTGRESQL_PORT} -U ${CLOUDRON_POSTGRESQL_USERNAME} -d ${CLOUDRON_POSTGRESQL_DATABASE} -c "UPDATE \"user\" SET \"pluginAuth\"='peertube-plugin-auth-openid-connect' WHERE \"pluginAuth\"='peertube-plugin-auth-ldap'"
+    fi
+
+    LDAP_PLUGIN_INSTALLED=$(PGPASSWORD=${CLOUDRON_POSTGRESQL_PASSWORD} psql -h ${CLOUDRON_POSTGRESQL_HOST} -p ${CLOUDRON_POSTGRESQL_PORT} -U ${CLOUDRON_POSTGRESQL_USERNAME} -d ${CLOUDRON_POSTGRESQL_DATABASE} -AXqtc "SELECT count(*) FROM \"plugin\" WHERE name='auth-ldap'")
+    if [ ${LDAP_PLUGIN_INSTALLED} -gt 0 ]; then
+        echo "==> Uninstalling LDAP plugin"
+        gosu cloudron:cloudron npm run plugin:uninstall -- -n peertube-plugin-auth-ldap
+
+        echo "==> Deleting LDAP settings"
+        PGPASSWORD=${CLOUDRON_POSTGRESQL_PASSWORD} psql -h ${CLOUDRON_POSTGRESQL_HOST} -p ${CLOUDRON_POSTGRESQL_PORT} -U ${CLOUDRON_POSTGRESQL_USERNAME} -d ${CLOUDRON_POSTGRESQL_DATABASE} -c "DELETE FROM \"plugin\" WHERE name='auth-ldap'"
+    fi
+}
+
+install_oidc() {
+    # https://docs.joinpeertube.org/maintain-tools?id=cli-wrapper . Note that we have to restart peertube when installed this way
+    if [[ -n "${CLOUDRON_OIDC_ISSUER:-}" ]]; then
+        echo "==> Installing OIDC plugin"
+        gosu cloudron:cloudron npm run plugin:install -- -n peertube-plugin-auth-openid-connect -v 0.1.1
+        update_oidc
+    fi
+}
+
+update_oidc() {
+    echo "==> Updating OIDC config"
+
+    PGPASSWORD=${CLOUDRON_POSTGRESQL_PASSWORD} psql -h ${CLOUDRON_POSTGRESQL_HOST} -p ${CLOUDRON_POSTGRESQL_PORT} -U ${CLOUDRON_POSTGRESQL_USERNAME} -d ${CLOUDRON_POSTGRESQL_DATABASE} \
+        -c "UPDATE plugin SET settings='{\"scope\": \"openid email profile\", \"client-id\": \"${CLOUDRON_OIDC_CLIENT_ID}\", \"discover-url\": \"${CLOUDRON_OIDC_DISCOVERY_URL}\", \"client-secret\": \"${CLOUDRON_OIDC_CLIENT_SECRET}\", \"mail-property\": \"email\", \"auth-display-name\": \"Cloudron\", \"username-property\": \"preferred_username\", \"signature-algorithm\": \"RS256\", \"display-name-property\": \"name\"}' WHERE name='auth-openid-connect'"
+}
+
+first_time_setup() {
+    echo "==> Starting peertube to run migrations on first run"
+    gosu cloudron:cloudron npm start &  # be wary of https://stackoverflow.com/questions/70738567/why-does-running-npm-run-script-as-root-switch-user
     sleep 10
 
-    while ! curl --fail http://localhost:9000/; do
-        echo "==> (reset root password) Waiting for peertube to initialize..."
+    while ! curl --silent --output /dev/null --fail http://localhost:9000/; do
+        echo "==> Waiting for peertube"
         sleep 5
     done
 
-    echo "changeme" | npm run reset-password -- -u root
+    killall -SIGTERM peertube # this kills the process group
+    sleep 5
+
+    echo "==> Reset root password"
+    echo "changeme" | gosu cloudron:cloudron npm run reset-password -- -u root
+    sleep 5  # the above command seems to spawn a separate process to change password in background
+
+    install_oidc
+
+    echo "==> First time setup complete"
 }
 
+update_config() {
+    echo "==> Ensure and updating configs"
+
+    # version 5 needs this now
+    if [[ `yq eval '.secrets | has("peertube")' /app/data/production.yaml` != "true" ]]; then
+        yq eval ".secrets.peertube = \"`openssl rand -hex 32`\"" -i /app/data/production.yaml
+    fi
+
+    yq eval ".webserver.hostname = \"${CLOUDRON_APP_DOMAIN}\"" -i /app/data/production.yaml
+
+    # database
+    yq eval ".database.hostname = \"${CLOUDRON_POSTGRESQL_HOST}\"" -i /app/data/production.yaml
+    yq eval ".database.port = ${CLOUDRON_POSTGRESQL_PORT}" -i /app/data/production.yaml
+    yq eval ".database.username = \"${CLOUDRON_POSTGRESQL_USERNAME}\"" -i /app/data/production.yaml
+    yq eval ".database.password = \"${CLOUDRON_POSTGRESQL_PASSWORD}\"" -i /app/data/production.yaml
+    yq eval ".database.name = \"${CLOUDRON_POSTGRESQL_DATABASE}\"" -i /app/data/production.yaml
+    yq eval "del(.database.suffix)" -i /app/data/production.yaml
+
+    # redis
+    yq eval ".redis.hostname = \"${CLOUDRON_REDIS_HOST}\"" -i /app/data/production.yaml
+    yq eval ".redis.port = ${CLOUDRON_REDIS_PORT}" -i /app/data/production.yaml
+    yq eval ".redis.auth = \"${CLOUDRON_REDIS_PASSWORD}\"" -i /app/data/production.yaml
+
+    # smtp
+    yq eval ".smtp.hostname = \"${CLOUDRON_MAIL_SMTP_SERVER}\"" -i /app/data/production.yaml
+    yq eval ".smtp.port = ${CLOUDRON_MAIL_SMTP_PORT}" -i /app/data/production.yaml
+    yq eval ".smtp.username = \"${CLOUDRON_MAIL_SMTP_USERNAME}\"" -i /app/data/production.yaml
+    yq eval ".smtp.password = \"${CLOUDRON_MAIL_SMTP_PASSWORD}\"" -i /app/data/production.yaml
+    yq eval ".smtp.tls = false" -i /app/data/production.yaml
+    yq eval ".smtp.disable_starttls = true" -i /app/data/production.yaml
+    yq eval ".smtp.from_address = \"${CLOUDRON_MAIL_FROM}\"" -i /app/data/production.yaml
+
+    # ensure settings which were later added
+    yq eval ".storage.bin = \"/app/data/storage/bin/\"" -i /app/data/production.yaml
+    yq eval ".storage.well_known = \"/app/data/storage/well_known/\"" -i /app/data/production.yaml
+    yq eval ".storage.tmp_persistent = \"/app/data/storage/tmp_persistent/\"" -i /app/data/production.yaml
+
+    # changes for 6.0.0
+    yq eval ".storage.storyboards = \"/app/data/storage/storyboards/\"" -i /app/data/production.yaml
+    if [[ -d "/app/data/storage/videos" ]]; then
+        echo "==> Migrate videos/ to videos-web/"
+        mv /app/data/storage/videos /app/data/storage/web-videos
+    fi
+    yq eval ".storage.web_videos = \"/app/data/storage/web-videos/\"" -i /app/data/production.yaml
+    yq eval "del(.storage.videos)" -i /app/data/production.yaml
+    yq eval "del(.transcoding.webtorrent)" -i /app/data/production.yaml
+    yq eval ".transcoding.web_videos.enabled = true" -i /app/data/production.yaml
+
+    # changes for 6.1.0
+    yq eval ".storage.original_video_files = \"/app/data/storage/original_video_files/\"" -i /app/data/production.yaml
+}
+
+echo "==> Changing ownership"
+chown -R cloudron:cloudron /app/data /run/peertube /tmp/peertube
+
+# Set eviction policy to prevent warnings - https://docs.bullmq.io/guide/going-to-production#max-memory-policy
+while ! REDISCLI_AUTH="${CLOUDRON_REDIS_PASSWORD}" redis-cli -h "${CLOUDRON_REDIS_HOST}" -p "${CLOUDRON_REDIS_PORT}" ping >/dev/null; do
+    echo "==> Waiting for redis"
+    sleep 5
+done
+REDISCLI_AUTH="${CLOUDRON_REDIS_PASSWORD}"  redis-cli -h "${CLOUDRON_REDIS_HOST}" -p "${CLOUDRON_REDIS_PORT}" CONFIG SET maxmemory-policy noeviction
+
 # cd /var/www/peertube/peertube-latest/scripts && sudo -H -u peertube ./upgrade.sh
 if [[ ! -f "/app/data/production.yaml" ]]; then
     echo "==> First run. creating config"
     cp /app/pkg/production.yaml.example /app/data/production.yaml
 
-    # this is sed because there are too many paths
-    sed -e 's,/var/www/peertube/storage,/app/data/storage,g' -i /app/data/production.yaml
-
-    reset_root_password &
+    update_config
+    first_time_setup
+else
+    update_config
+    if [[ -n "${CLOUDRON_OIDC_ISSUER:-}" ]]; then
+        install_oidc
+        migrate_ldap_to_oidc
+        update_oidc
+    fi
 fi
 
-echo "==> Updating configs"
-yq w -i /app/data/production.yaml webserver.hostname "${CLOUDRON_APP_DOMAIN}"
-
-# database
-yq w -i /app/data/production.yaml database.hostname "${CLOUDRON_POSTGRESQL_HOST}"
-yq w -i /app/data/production.yaml database.port "${CLOUDRON_POSTGRESQL_PORT}"
-yq w -i /app/data/production.yaml database.username "${CLOUDRON_POSTGRESQL_USERNAME}"
-yq w -i /app/data/production.yaml database.password "${CLOUDRON_POSTGRESQL_PASSWORD}"
-yq w -i /app/data/production.yaml database.suffix "${CLOUDRON_POSTGRESQL_DATABASE}"
-
-# redis
-yq w -i /app/data/production.yaml redis.hostname "${CLOUDRON_REDIS_HOST}"
-yq w -i /app/data/production.yaml redis.port "${CLOUDRON_REDIS_PORT}"
-yq w -i /app/data/production.yaml redis.auth "${CLOUDRON_REDIS_PASSWORD}"
-
-# smtp
-yq w -i /app/data/production.yaml smtp.hostname "${CLOUDRON_MAIL_SMTP_SERVER}"
-yq w -i /app/data/production.yaml smtp.port "${CLOUDRON_MAIL_SMTP_PORT}"
-yq w -i /app/data/production.yaml smtp.username "${CLOUDRON_MAIL_SMTP_USERNAME}"
-yq w -i /app/data/production.yaml smtp.password "${CLOUDRON_MAIL_SMTP_PASSWORD}"
-yq w -i /app/data/production.yaml smtp.tls false
-yq w -i /app/data/production.yaml smtp.disable_starttls true
-yq w -i /app/data/production.yaml smtp.from_address "${CLOUDRON_MAIL_FROM}"
-
-chown -R cloudron:cloudron /app/data
-
-exec gosu cloudron:cloudron npm start
+echo "==> Configuring nginx"
+cp /app/pkg/peertube-nginx.conf /run/peertube-nginx.conf
 
+echo "==> Starting PeerTube"
+#exec gosu cloudron:cloudron npm start
+exec /usr/bin/supervisord --configuration /etc/supervisor/supervisord.conf --nodaemon -i PeerTube

supervisor/nginx.conf

@@ -0,0 +1,11 @@
+[program:nginx]
+priority=100
+directory=/tmp
+command=/usr/sbin/nginx -g "daemon off;"
+user=root
+autostart=true
+autorestart=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0

supervisor/peertube.conf

@@ -0,0 +1,11 @@
+[program:peertube]
+directory=/app/code/server
+user=cloudron
+environment=HOME="/home/cloudron",USER="cloudron"
+command=npm start
+autostart=true
+autorestart=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0

test/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "test",
+  "version": "1.0.0",
+  "description": "",
+  "main": "test.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "",
+  "license": "ISC",
+  "devDependencies": {
+    "expect.js": "^0.3.1",
+    "mocha": "^10.4.0"
+  },
+  "dependencies": {
+    "chromedriver": "^124.0.1",
+    "safetydance": "^2.4.0",
+    "selenium-webdriver": "^4.20.0"
+  }
+}

test/test.js

@@ -0,0 +1,261 @@
+#!/usr/bin/env node
+
+/* jshint esversion: 8 */
+/* global describe */
+/* global before */
+/* global after */
+/* global it */
+
+'use strict';
+
+require('chromedriver');
+
+const execSync = require('child_process').execSync,
+    expect = require('expect.js'),
+    readlinePromises = require('readline/promises'),
+    path = require('path'),
+    safe = require('safetydance'),
+    util = require('util'),
+    { Builder, By, Key, until } = require('selenium-webdriver'),
+    { Options } = require('selenium-webdriver/chrome');
+
+if (!process.env.USERNAME || !process.env.PASSWORD || !process.env.EMAIL) {
+    console.log('USERNAME, EMAIL and PASSWORD env vars need to be set');
+    process.exit(1);
+}
+
+describe('Application life cycle test', function () {
+    this.timeout(0);
+
+    const LOCATION = 'test';
+    const TEST_TIMEOUT = parseInt(process.env.TEST_TIMEOUT, 10) || 30000;
+    const EXEC_ARGS = { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' };
+
+    let browser;
+    let app;
+    let host_os;
+    let username = process.env.USERNAME;
+    let password = process.env.PASSWORD;
+    let email = process.env.EMAIL;
+    let athenticated_by_oidc = false;
+
+    before(function () {
+        browser = new Builder().forBrowser('chrome').setChromeOptions(new Options().windowSize({ width: 1280, height: 1024 })).build();
+    });
+
+    after(function () {
+        browser.quit();
+    });
+
+    function getAppInfo() {
+        let inspect = JSON.parse(execSync('cloudron inspect'));
+        app = inspect.apps.filter(function (a) { return a.location.indexOf(LOCATION) === 0; })[0];
+        expect(app).to.be.an('object');
+    }
+
+    async function getOS() {
+        if (typeof(host_os) == 'undefined' || host_os == null)
+            host_os = String(await execSync('uname -s')).trim();
+        return host_os;
+    }
+
+    async function waitForElement(elem) {
+        await browser.wait(until.elementLocated(elem), TEST_TIMEOUT);
+        await browser.wait(until.elementIsVisible(browser.findElement(elem)), TEST_TIMEOUT);
+    }
+
+    function sleep(millis) {
+        return new Promise(resolve => setTimeout(resolve, millis));
+    }
+
+    async function login(username, password) {
+        await browser.get('https://' + app.fqdn + '/login');
+
+        await waitForElement(By.id('username'));
+        await browser.findElement(By.id('username')).sendKeys(username);
+        await browser.findElement(By.id('password')).sendKeys(password);
+        await browser.findElement(By.xpath('//input[@value="Login"]')).click();
+        await waitForElement(By.xpath('//a[contains(@href, "/my-library")]'));
+    }
+
+    async function loginOIDC(username, password) {
+        browser.manage().deleteAllCookies();
+        await browser.get(`https://${app.fqdn}/login`);
+        await browser.sleep(2000);
+
+        await browser.wait(until.elementLocated(By.xpath('//a[contains(., "Cloudron")]')), TEST_TIMEOUT);
+        await browser.findElement(By.xpath('//a[contains(., "Cloudron")]')).click();
+        await browser.sleep(2000);
+
+        if (!athenticated_by_oidc) {
+            await waitForElement(By.id('inputUsername'));
+            await browser.findElement(By.id('inputUsername')).sendKeys(username);
+            await browser.findElement(By.id('inputPassword')).sendKeys(password);
+            await browser.findElement(By.id('loginSubmitButton')).click();
+
+            athenticated_by_oidc = true;
+        }
+        await browser.sleep(20000);
+        await waitForElement(By.xpath('//a[contains(@href, "/my-library")]'));
+    }
+
+    async function closeAccountSetupDialog() {
+        await browser.get('https://' + app.fqdn);
+
+        await waitForElement(By.xpath('//span[contains(text(), "show me this anymore")]'));
+        await browser.findElement(By.xpath('//span[contains(text(), "show me this anymore")]')).click();
+        await browser.findElement(By.xpath('//a[contains(text(), "Set up")]')).click();
+        await browser.sleep(3000);
+    }
+
+    async function logout() {
+        await browser.get('https://' + app.fqdn + '/my-account/videos');
+        await waitForElement(By.xpath('//div[@class="logged-in-display-name"]'));
+        await browser.sleep(2000);
+        await browser.findElement(By.xpath('//div[@class="logged-in-display-name"]')).click();
+        await browser.sleep(2000);
+        await browser.findElement(By.xpath('//button[contains(text(), "Log out")]')).click();
+        await browser.sleep(2000);
+    }
+
+    async function completeSetup() {
+        let button;
+
+        await browser.get(`https://${app.fqdn}`);
+        await browser.sleep(2000);
+
+        const [error] = await safe(waitForElement(By.xpath('//a[contains(text(), "Configure my instance")]')));
+        if (error) return; // sometimes it doesn't appear, maybe it's cached in local storage
+        await browser.findElement(By.xpath('//a[contains(text(), "Configure my instance")]')).click(); // this opens a new window
+
+        const say_cmd = await getOS() == "Darwin" ? "say" : "spd-say";
+        execSync(`${say_cmd} "Close the newly opened configuration tab."`);
+
+        const rl = readlinePromises.createInterface({ input: process.stdin, output: process.stdout });
+        await rl.question('Is tab closed? ');
+    }
+
+    async function uploadVideo() {
+        await browser.get(`https://${app.fqdn}/videos/upload#upload`);
+        await browser.sleep(3000);
+        await browser.wait(until.elementLocated(By.id('videofile')), TEST_TIMEOUT); // do not do element visible check . it fails, no clue why
+        await browser.findElement(By.id('videofile')).sendKeys(path.resolve(__dirname, './Cloudron Test Video.mp4'));
+        console.log('waiting 10 seconds for upload');
+        await browser.sleep(10000); // wait for upload
+
+        await waitForElement(By.xpath('//div[@class="submit-container"]//span[text()="Publish"]'));
+        let button = browser.findElement(By.xpath('//div[@class="submit-container"]//span[text()="Publish"]'));
+        await browser.executeScript('arguments[0].scrollIntoView(false)', button);
+        await browser.sleep(2000);
+        await button.click();
+        await browser.sleep(2000);
+    }
+
+    async function videoExists() {
+        await browser.get('https://' + app.fqdn + '/my-account/videos');
+        await waitForElement(By.xpath('//a[contains(@title, "Cloudron Test Video")]'));
+    }
+
+    xit('build app', function () { execSync('cloudron build', EXEC_ARGS); });
+    it('install app', async function () {
+        execSync('cloudron install --location ' + LOCATION, EXEC_ARGS);
+        await sleep(40000); // takes a bit to create root user in background
+    });
+
+    it('can get app information', getAppInfo);
+    it('can root login', login.bind(null, 'root', 'changeme'));
+    it('can complete setup', completeSetup);
+    it('can upload video', uploadVideo);
+    it('video exists', videoExists);
+    it('logout', logout);
+
+    it('can OIDC login', loginOIDC.bind(null, username, password));
+    it('can close account setup dialog', closeAccountSetupDialog);
+    it('logout', logout);
+
+    it('backup app', function () { execSync('cloudron backup create --app ' + app.id, EXEC_ARGS); });
+
+    it('restore app', function () {
+        const backups = JSON.parse(execSync('cloudron backup list --raw'));
+        execSync('cloudron uninstall --app ' + app.id, EXEC_ARGS);
+        execSync('cloudron install --location ' + LOCATION, EXEC_ARGS);
+        getAppInfo();
+        execSync(`cloudron restore --backup ${backups[0].id} --app ${app.id}`, EXEC_ARGS);
+    });
+
+    it('can root login', login.bind(null, 'root', 'changeme'));
+    it('video exists', videoExists);
+    it('logout', logout);
+
+    it('can OIDC login', loginOIDC.bind(null, username, password));
+    it('logout', logout);
+
+    it('can restart app', function () {
+        execSync('cloudron restart --app ' + app.id);
+    });
+    it('can root login', login.bind(null, 'root', 'changeme'));
+    it('video exists', videoExists);
+    it('logout', logout);
+
+    it('can OIDC login', loginOIDC.bind(null, username, password));
+    it('logout', logout);
+
+    // this is not supported for federation
+    it('move to different location', function () { execSync('cloudron configure --location ' + LOCATION + '2 --app ' + app.id, EXEC_ARGS); });
+
+    it('can get app information', getAppInfo);
+    it('can root login', login.bind(null, 'root', 'changeme'));
+    it('video exists', videoExists);
+    it('logout', logout);
+
+    it('can OIDC login', loginOIDC.bind(null, username, password));
+    it('logout', logout);
+
+    it('uninstall app', async function () {
+        await browser.executeScript('localStorage.clear();');
+        execSync('cloudron uninstall --app ' + app.id, EXEC_ARGS);
+    });
+
+    // No SSO
+    it('install app (no sso)', async function () {
+        execSync('cloudron install --no-sso --location ' + LOCATION, EXEC_ARGS);
+        await sleep(10000); // takes a bit to create root user in background
+    });
+
+    it('can get app information', getAppInfo);
+
+    it('can login (no sso)', login.bind(null, 'root', 'changeme'));
+    it('can complete setup', completeSetup);
+    it('can logout', logout);
+
+    it('uninstall app (no sso)', async function () {
+        await browser.executeScript('localStorage.clear();');
+        execSync('cloudron uninstall --app ' + app.id, EXEC_ARGS);
+    });
+
+    // test update
+    it('can install app', async function () {
+        execSync('cloudron install --appstore-id org.joinpeertube.cloudronapp --location ' + LOCATION, EXEC_ARGS);
+        await sleep(10000); // takes a bit to create root user in background
+    });
+
+    it('can get app information', getAppInfo);
+    it('can root login', login.bind(null, 'root', 'changeme'));
+    it('can complete setup', completeSetup);
+    it('can upload video', uploadVideo);
+    it('video exists', videoExists);
+
+    it('can update', function () { execSync('cloudron update --app ' + app.id, EXEC_ARGS); });
+    it('can root login', login.bind(null, 'root', 'changeme'));
+    it('video exists', videoExists);
+    it('logout', logout);
+
+    it('can OIDC login', loginOIDC.bind(null, username, password));
+    it('can close account setup dialog', closeAccountSetupDialog);
+    it('logout', logout);
+
+    it('uninstall app', async function () {
+        await browser.executeScript('localStorage.clear();');
+        execSync('cloudron uninstall --app ' + app.id, EXEC_ARGS);
+    });
+});