mirrors/lemmy
1
0
Fork 0
mirror of https://github.com/LemmyNet/lemmy.git synced 2024-11-20 08:21:01 +00:00
Code Issues Projects Releases Wiki Activity

Merge branch 'main' into move_blocklist_to_db

Browse source
This commit is contained in:
Dessalines 2022-10-12 16:17:29 -04:00
commit 215a9dce88
15 changed files with 444 additions and 158 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

37
api_tests/src/community.spec.ts
View file

@ -4,6 +4,7 @@ import { CommunityView } from 'lemmy-js-client';
import {
alpha,
beta,
gamma,
setupLogins,
resolveCommunity,
createCommunity,
@ -11,6 +12,12 @@ import {
removeCommunity,
getCommunity,
followCommunity,
banPersonFromCommunity,
resolvePerson,
getSite,
createPost,
getPost,
resolvePost,
} from './shared';
beforeAll(async () => {
@ -162,3 +169,33 @@ test('Search for beta community', async () => {
let alphaCommunity = (await resolveCommunity(alpha, searchShort)).community.unwrap();
assertCommunityFederation(alphaCommunity, communityRes.community_view);
});
test('Admin actions in remote community are not federated to origin', async () => {
// create a community on alpha
let communityRes = (await createCommunity(alpha)).community_view;
expect(communityRes.community.name).toBeDefined();
// gamma follows community and posts in it
let gammaCommunity = (await resolveCommunity(gamma, communityRes.community.actor_id)).community.unwrap();
let gammaFollow = (await followCommunity(gamma, true, gammaCommunity.community.id));
expect(gammaFollow.community_view.subscribed).toBe("Subscribed");
let gammaPost = (await createPost(gamma, gammaCommunity.community.id)).post_view;
expect(gammaPost.post.id).toBeDefined();
expect(gammaPost.creator_banned_from_community).toBe(false);
// admin of beta decides to ban gamma from community
let betaCommunity = (await resolveCommunity(beta, communityRes.community.actor_id)).community.unwrap();
let bannedUserInfo1 = (await getSite(gamma)).my_user.unwrap().local_user_view.person;
let bannedUserInfo2 = (await resolvePerson(beta, bannedUserInfo1.actor_id)).person.unwrap();
let banRes = (await banPersonFromCommunity(beta, bannedUserInfo2.person.id, betaCommunity.community.id, true, true));
console.log(banRes);
expect(banRes.banned).toBe(true);
// ban doesnt federate to community's origin instance alpha
let alphaPost = (await resolvePost(alpha, gammaPost.post)).post.unwrap();
expect(alphaPost.creator_banned_from_community).toBe(false);
// and neither to gamma
let gammaPost2 = (await getPost(gamma, gammaPost.post.id));
expect(gammaPost2.post_view.creator_banned_from_community).toBe(false);
});

2
crates/apub/src/activities/block/block_user.rs
View file

@ -145,7 +145,7 @@ impl ActivityHandler for BlockUser {
verify_mod_action(
&self.actor,
self.object.inner(),
&community,
community.id,
context,
request_counter,
)

2
crates/apub/src/activities/community/add_mod.rs
View file

@ -90,7 +90,7 @@ impl ActivityHandler for AddMod {
verify_mod_action(
&self.actor,
self.object.inner(),
&community,
community.id,
context,
request_counter,
)

2
crates/apub/src/activities/community/remove_mod.rs
View file

@ -90,7 +90,7 @@ impl ActivityHandler for RemoveMod {
verify_mod_action(
&self.actor,
self.object.inner(),
&community,
community.id,
context,
request_counter,
)

2
crates/apub/src/activities/community/update.rs
View file

@ -75,7 +75,7 @@ impl ActivityHandler for UpdateCommunity {
verify_mod_action(
&self.actor,
self.object.id.inner(),
&community,
community.id,
context,
request_counter,
)

2
crates/apub/src/activities/create_or_update/post.rs
View file

@ -120,7 +120,7 @@ impl ActivityHandler for CreateOrUpdatePost {
verify_mod_action(
&self.actor,
self.object.id.inner(),
&community,
community.id,
context,
request_counter,
)

4
crates/apub/src/activities/deletion/mod.rs
View file

@ -159,7 +159,7 @@ pub(in crate::activities) async fn verify_delete_activity(
verify_mod_action(
&activity.actor,
activity.object.id(),
&community,
community.id,
context,
request_counter,
)
@ -208,7 +208,7 @@ async fn verify_delete_post_or_comment(
) -> Result<(), LemmyError> {
verify_person_in_community(actor, community, context, request_counter).await?;
if is_mod_action {
verify_mod_action(actor, object_id, community, context, request_counter).await?;
verify_mod_action(actor, object_id, community.id, context, request_counter).await?;
} else {
// domain of post ap_id and post.creator ap_id are identical, so we just check the former
verify_domains_match(actor.inner(), object_id)?;

52
crates/apub/src/activities/mod.rs
View file

@ -14,7 +14,7 @@ use activitypub_federation::{
use activitystreams_kinds::public;
use anyhow::anyhow;
use lemmy_api_common::utils::blocking;
use lemmy_db_schema::source::community::Community;
use lemmy_db_schema::{newtypes::CommunityId, source::community::Community};
use lemmy_db_views_actor::structs::{CommunityPersonBanView, CommunityView};
use lemmy_utils::error::LemmyError;
use lemmy_websocket::LemmyContext;
@ -75,9 +75,7 @@ pub(crate) async fn verify_person_in_community(
Ok(())
}
/// Verify that the actor is a community mod. This check is only run if the community is local,
/// because in case of remote communities, admins can also perform mod actions. As admin status
/// is not federated, we cant verify their actions remotely.
/// Verify that mod action in community was performed by a moderator.
///
/// * `mod_id` - Activitypub ID of the mod or admin who performed the action
/// * `object_id` - Activitypub ID of the actor or object that is being moderated
@ -86,40 +84,30 @@ pub(crate) async fn verify_person_in_community(
pub(crate) async fn verify_mod_action(
mod_id: &ObjectId<ApubPerson>,
object_id: &Url,
community: &ApubCommunity,
community_id: CommunityId,
context: &LemmyContext,
request_counter: &mut i32,
) -> Result<(), LemmyError> {
if community.local {
let actor = mod_id
.dereference(context, local_instance(context), request_counter)
.await?;
// Note: this will also return true for admins in addition to mods, but as we dont know about
// remote admins, it doesnt make any difference.
let community_id = community.id;
let actor_id = actor.id;
let is_mod_or_admin = blocking(context.pool(), move |conn| {
CommunityView::is_mod_or_admin(conn, actor_id, community_id)
})
let mod_ = mod_id
.dereference(context, local_instance(context), request_counter)
.await?;
// mod action was done either by a community mod or a local admin, so its allowed
if is_mod_or_admin {
return Ok(());
}
// mod action comes from the same instance as the moderated object, so it was presumably done
// by an instance admin and is legitimate (admin status is not federated).
if mod_id.inner().domain() == object_id.domain() {
return Ok(());
}
// the user is not a valid mod
return Err(LemmyError::from_message("Not a mod"));
let is_mod_or_admin = blocking(context.pool(), move |conn| {
CommunityView::is_mod_or_admin(conn, mod_.id, community_id)
})
.await?;
if is_mod_or_admin {
return Ok(());
}
Ok(())
// mod action comes from the same instance as the moderated object, so it was presumably done
// by an instance admin.
// TODO: federate instance admin status and check it here
if mod_id.inner().domain() == object_id.domain() {
return Ok(());
}
Err(LemmyError::from_message("Not a mod"))
}
/// For Add/Remove community moderator activities, check that the target field actually contains

115
docker/dev/docker-compose.yml
View file

@ -1,47 +1,100 @@
version: '3.3'
version: "3.3"
networks:
# communication to web and clients
lemmyexternalproxy:
# communication between lemmy services
lemmyinternal:
driver: bridge
internal: true
services:
nginx:
proxy:
image: nginx:1-alpine
networks:
- lemmyinternal
- lemmyexternalproxy
ports:
# actual and only port facing any connection from outside
- "1236:1236"
volumes:
- ./nginx.conf:/etc/nginx/nginx.conf
- ./nginx.conf:/etc/nginx/nginx.conf:ro
restart: always
depends_on:
- pictrs
- lemmy-ui
lemmy:
image: lemmy-dev:latest
ports:
- "8536:8536"
- "6669:6669"
image: dessalines/lemmy:dev
# use this to build your local lemmy server image for development
# run docker compose up --build
# build:
# context: ../..
# dockerfile: docker/dev/Dockerfile
# this hostname is used in nginx reverse proxy and also for lemmy ui to connect to the backend, do not change
hostname: lemmy
networks:
- lemmyinternal
restart: always
environment:
- RUST_LOG="warn,lemmy_server=debug,lemmy_api=debug,lemmy_api_common=debug,lemmy_api_crud=debug,lemmy_apub=debug,lemmy_db_schema=debug,lemmy_db_views=debug,lemmy_db_views_actor=debug,lemmy_db_views_moderator=debug,lemmy_routes=debug,lemmy_utils=debug,lemmy_websocket=debug"
- RUST_BACKTRACE=full
volumes:
- ../lemmy.hjson:/config/config.hjson
depends_on:
- pictrs
- ./lemmy.hjson:/config/config.hjson
depends_on:
- postgres
- otel
- pictrs
lemmy-ui:
image: dessalines/lemmy-ui:0.16.5
restart: always
image: dessalines/lemmy-ui:dev
# use this to build your local lemmy ui image for development
# run docker compose up --build
# assuming lemmy-ui is cloned besides lemmy directory
# build:
# context: ../../../lemmy-ui
# dockerfile: Dockerfile
networks:
- lemmyinternal
environment:
- LEMMY_INTERNAL_HOST=lemmy:8536
- LEMMY_EXTERNAL_HOST=localhost:1234
# this needs to match the hostname defined in the lemmy service
- LEMMY_UI_LEMMY_INTERNAL_HOST=lemmy:8536
# set the outside hostname here
- LEMMY_UI_LEMMY_EXTERNAL_HOST=localhost:1236
- LEMMY_HTTPS=false
- LEMMY_UI_DEBUG=true
depends_on:
depends_on:
- lemmy
restart: always
pictrs:
image: asonix/pictrs:0.3.1
# this needs to match the pictrs url in lemmy.hjson
hostname: pictrs
# we can set options to pictrs like this, here we set max. image size and forced format for conversion
# entrypoint: /sbin/tini -- /usr/local/bin/pict-rs -p /mnt -m 4 --image-format webp
networks:
- lemmyinternal
environment:
- PICTRS_OPENTELEMETRY_URL=http://otel:4137
- PICTRS__API_KEY=API_KEY
- RUST_LOG=debug
- RUST_BACKTRACE=full
user: 991:991
volumes:
- ./volumes/pictrs:/mnt
restart: always
postgres:
image: postgres:14-alpine
# this needs to match the database host in lemmy.hson
hostname: postgres
command: ["postgres", "-c", "session_preload_libraries=auto_explain", "-c", "auto_explain.log_min_duration=5ms", "-c", "auto_explain.log_analyze=true"]
networks:
- lemmyinternal
# adding the external facing network to allow direct db access for devs
- lemmyexternalproxy
ports:
# use a different port so it doesnt conflict with postgres running on the host
# use a different port so it doesnt conflict with potential postgres db running on the host
- "5433:5432"
environment:
- POSTGRES_USER=lemmy
@ -50,40 +103,30 @@ services:
volumes:
- ./volumes/postgres:/var/lib/postgresql/data
restart: always
command: ["postgres", "-c", "session_preload_libraries=auto_explain", "-c", "auto_explain.log_min_duration=5ms", "-c", "auto_explain.log_analyze=true"]
pictrs:
image: asonix/pictrs:0.3.1
user: 991:991
environment:
- PICTRS_OPENTELEMETRY_URL=http://otel:4137
- PICTRS__API_KEY=API_KEY
ports:
- "6670:6669"
- "8080:8080"
volumes:
- ./volumes/pictrs:/mnt
restart: always
depends_on:
- otel
otel:
image: otel/opentelemetry-collector:latest
command: --config otel-local-config.yaml
networks:
- lemmyinternal
- lemmyexternalproxy
ports:
- "4317:4317"
volumes:
- type: bind
source: ./otel.yml
target: /otel-local-config.yaml
restart: always
restart: unless-stopped
depends_on:
- jaeger
jaeger:
image: jaegertracing/all-in-one:1
networks:
- lemmyinternal
- lemmyexternalproxy
ports:
- "14250:14250"
# To view traces, visit http://localhost:16686
- "16686:16686"
restart: always
restart: unless-stopped

25
docker/dev/lemmy.hjson Normal file
View file

@ -0,0 +1,25 @@
{
# for more info about the config, check out the documentation
# https://join-lemmy.org/docs/en/administration/configuration.html
# This is a minimal lemmy config for the dev / main branch. Do not use for a
# release / stable version.
setup: {
# username for the admin user
admin_username: "lemmy"
# password for the admin user
admin_password: "lemmylemmy"
# name of the site (can be changed later)
site_name: "lemmy-dev"
}
opentelemetry_url: "http://otel:4137"
# the domain name of your instance (eg "lemmy.ml")
hostname: "localhost"
# address where lemmy should listen for incoming requests
bind: "0.0.0.0"
# port where lemmy should listen for incoming requests
port: 8536
}

92
docker/dev/nginx.conf
View file

@ -1,51 +1,71 @@
worker_processes 1;
worker_processes 1;
events {
worker_connections 1024;
worker_connections 1024;
}
http {
upstream lemmy {
# this needs to map to the lemmy (server) docker service hostname
server "lemmy:8536";
}
upstream lemmy-ui {
# this needs to map to the lemmy-ui docker service hostname
server "lemmy-ui:1234";
}
server {
listen 1236;
server_name localhost;
# this is the port inside docker, not the public one yet
listen 1236;
# change if needed, this is facing the public web
server_name localhost;
server_tokens off;
# frontend
location / {
set $proxpass "http://lemmy-ui";
if ($http_accept = "application/activity+json") {
set $proxpass "http://lemmy";
gzip on;
gzip_types text/css application/javascript image/svg+xml;
gzip_vary on;
# Upload limit, relevant for pictrs
client_max_body_size 20M;
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
# frontend general requests
location / {
# distinguish between ui requests and backend
# don't change lemmy-ui or lemmy here, they refer to the upstream definitions on top
set $proxpass "http://lemmy-ui";
if ($http_accept = "application/activity+json") {
set $proxpass "http://lemmy";
}
if ($http_accept = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"") {
set $proxpass "http://lemmy";
}
if ($request_method = POST) {
set $proxpass "http://lemmy";
}
proxy_pass $proxpass;
rewrite ^(.+)/+$ $1 permanent;
# Send actual client IP upstream
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
if ($http_accept = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"") {
set $proxpass "http://lemmy";
# backend
location ~ ^/(api|pictrs|feeds|nodeinfo|.well-known) {
proxy_pass "http://lemmy";
# proxy common stuff
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# Send actual client IP upstream
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
if ($request_method = POST) {
set $proxpass "http://lemmy";
}
proxy_pass $proxpass;
rewrite ^(.+)/+$ $1 permanent;
# Send actual client IP upstream
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
# backend
location ~ ^/(api|pictrs|feeds|nodeinfo|.well-known) {
proxy_pass "http://lemmy";
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# Add IP forwarding headers
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
}

3
docker/dev/otel.yml
View file

@ -11,7 +11,8 @@ exporters:
logging:
jaeger:
endpoint: jaeger:14250
insecure: true
tls:
insecure: true
service:
pipelines:

80
docker/prod/docker-compose.yml
View file

@ -1,23 +1,39 @@
version: '2.2'
version: "3.3"
networks:
# communication to web and clients
lemmyexternalproxy:
# communication between lemmy services
lemmyinternal:
driver: bridge
internal: true
services:
postgres:
image: postgres:14-alpine
environment:
- POSTGRES_USER=lemmy
- POSTGRES_PASSWORD=password
- POSTGRES_DB=lemmy
proxy:
image: nginx:1-alpine
networks:
- lemmyinternal
- lemmyexternalproxy
ports:
# only ports facing any connection from outside
- 80:80
- 443:443
volumes:
- ./volumes/postgres:/var/lib/postgresql/data
- ./nginx.conf:/etc/nginx/nginx.conf:ro
# setup your certbot and letsencrypt config
- ./certbot:/var/www/certbot
- ./letsencrypt:/etc/letsencrypt/live
restart: always
depends_on:
- pictrs
- lemmy-ui
lemmy:
image: dessalines/lemmy:0.16.6
ports:
- "127.0.0.1:8536:8536"
- "127.0.0.1:6669:6669"
image: dessalines/lemmy:0.16.7
hostname: lemmy
networks:
- lemmyinternal
restart: always
environment:
- RUST_LOG="warn,lemmy_server=info,lemmy_api=info,lemmy_api_common=info,lemmy_api_crud=info,lemmy_apub=info,lemmy_db_schema=info,lemmy_db_views=info,lemmy_db_views_actor=info,lemmy_db_views_moderator=info,lemmy_routes=info,lemmy_utils=info,lemmy_websocket=info"
volumes:
- ./lemmy.hjson:/config/config.hjson
@ -26,24 +42,44 @@ services:
- pictrs
lemmy-ui:
image: dessalines/lemmy-ui:0.16.6
ports:
- "127.0.0.1:1235:1234"
restart: always
image: dessalines/lemmy-ui:0.16.7
networks:
- lemmyinternal
environment:
# this needs to match the hostname defined in the lemmy service
- LEMMY_INTERNAL_HOST=lemmy:8536
- LEMMY_EXTERNAL_HOST=localhost:8536
# set the outside hostname here
- LEMMY_EXTERNAL_HOST=localhost:1236
- LEMMY_HTTPS=true
depends_on:
depends_on:
- lemmy
restart: always
pictrs:
image: asonix/pictrs:0.3.1
ports:
- "127.0.0.1:8537:8080"
- "127.0.0.1:6670:6669"
# this needs to match the pictrs url in lemmy.hjson
hostname: pictrs
# we can set options to pictrs like this, here we set max. image size and forced format for conversion
# entrypoint: /sbin/tini -- /usr/local/bin/pict-rs -p /mnt -m 4 --image-format webp
networks:
- lemmyinternal
environment:
- PICTRS__API_KEY=API_KEY
user: 991:991
volumes:
- ./volumes/pictrs:/mnt
restart: always
postgres:
image: postgres:14-alpine
# this needs to match the database host in lemmy.hson
hostname: postgres
networks:
- lemmyinternal
environment:
- POSTGRES_USER=lemmy
- POSTGRES_PASSWORD=password
- POSTGRES_DB=lemmy
volumes:
- ./volumes/postgres:/var/lib/postgresql/data
restart: always

32
docker/lemmy.hjson → docker/prod/lemmy.hjson
View file

@ -1,6 +1,7 @@
{
# for more info about the config, check out the documentation
# https://join-lemmy.org/docs/en/administration/configuration.html
# only few config options are covered in this example config
setup: {
# username for the admin user
@ -8,22 +9,22 @@
# password for the admin user
admin_password: "lemmylemmy"
# name of the site (can be changed later)
site_name: "lemmy-test"
site_name: "mylemmyinstance"
}
opentelemetry_url: "http://otel:4137"
# the domain name of your instance (eg "lemmy.ml")
hostname: "mydomain.ml"
# address where lemmy should listen for incoming requests
bind: "0.0.0.0"
# port where lemmy should listen for incoming requests
port: 8536
# Whether the site is available over TLS. Needs to be true for federation to work.
tls_enabled: true
# pictrs host
pictrs_url: "http://pictrs:8080"
# settings related to the postgresql database
pictrs_config: {
url: "http://pictrs:8080"
api_key: "API_KEY"
}
database: {
# name of the postgres database for lemmy
database: "lemmy"
@ -38,22 +39,5 @@
# maximum number of active sql connections
pool_size: 5
}
slur_filter:
'''
(fag(g|got|tard)?\b|cock\s?sucker(s|ing)?|ni((g{2,}|q)+|[gq]{2,})[e3r]+(s|z)?|mudslime?s?|kikes?|\bspi(c|k)s?\b|\bchinks?|gooks?|bitch(es|ing|y)?|whor(es?|ing)|\btr(a|@)nn?(y|ies?)|\b(b|re|r)tard(ed)?s?)
'''
# # optional: email sending configuration
# email: {
# # hostname and port of the smtp server
# smtp_server: ""
# # login name for smtp server
# smtp_login: ""
# # password to login to the smtp server
# smtp_password: ""
# # address to send emails from, eg "noreply@your-instance.com"
# smtp_from_address: ""
# # whether or not smtp connections should use tls
# use_tls: true
# }
}

152
docker/prod/nginx.conf Normal file
View file

@ -0,0 +1,152 @@
# nginx example config
# replace {{yourdomain}} and review the certbot/letsencrypt config
worker_processes 1;
events {
worker_connections 1024;
}
http {
limit_req_zone $binary_remote_addr zone={{yourdomain}}_ratelimit:10m rate=1r/s;
upstream lemmy {
# this needs to map to the lemmy (server) docker service hostname
server "lemmy:8536";
}
upstream lemmy-ui {
# this needs to map to the lemmy-ui docker service hostname
server "lemmy-ui:1234";
}
server {
# allow letsencrypt challenge
# redirect everything else to 443
listen 80;
listen [::]:80;
server_name {{yourdomain}};
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
location / {
return 301 https://$host$request_uri;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name {{yourdomain}};
ssl_certificate /etc/letsencrypt/live/{{yourdomain}}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{yourdomain}}/privkey.pem;
# Various TLS hardening settings
# https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_session_timeout 10m;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets on;
ssl_stapling on;
ssl_stapling_verify on;
# Hide nginx version
server_tokens off;
# Enable compression for JS/CSS/HTML bundle, for improved client load times.
# It might be nice to compress JSON, but leaving that out to protect against potential
# compression+encryption information leak attacks like BREACH.
gzip on;
gzip_types text/css application/javascript image/svg+xml;
gzip_vary on;
# Only connect to this site via HTTPS for the two years
add_header Strict-Transport-Security "max-age=63072000";
# Various content security headers
add_header Referrer-Policy "same-origin";
add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options "DENY";
add_header X-XSS-Protection "1; mode=block";
# Upload limit for pictrs
client_max_body_size 20M;
# frontend
location / {
# distinguish between ui requests and backend
# don't change lemmy-ui or lemmy here, they refer to the upstream definitions on top
set $proxpass "http://lemmy-ui";
if ($http_accept = "application/activity+json") {
set $proxpass "http://lemmy";
}
if ($http_accept = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"") {
set $proxpass "http://lemmy";
}
if ($request_method = POST) {
set $proxpass "http://lemmy";
}
proxy_pass $proxpass;
rewrite ^(.+)/+$ $1 permanent;
# Send actual client IP upstream
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
# backend
location ~ ^/(api|feeds|nodeinfo|.well-known) {
proxy_pass "http://lemmy";
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# Rate limit
limit_req zone={{yourdomain}}_ratelimit burst=30 nodelay;
# Add IP forwarding headers
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
# pictrs only - for adding browser cache control.
location ~ ^/(pictrs) {
# allow browser cache, images never update, we can apply long term cache
expires 120d;
add_header Pragma "public";
add_header Cache-Control "public";
proxy_pass "http://lemmy";
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# Rate limit
limit_req zone={{yourdomain}}_ratelimit burst=30 nodelay;
# Add IP forwarding headers
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
# Redirect pictshare images to pictrs
location ~ /pictshare/(.*)$ {
return 301 /pictrs/image/$1;
}
}
# Anonymize IP addresses
# https://www.supertechcrew.com/anonymizing-logs-nginx-apache/
map $remote_addr $remote_addr_anon {
~(?P<ip>\d+\.\d+\.\d+)\. $ip.0;
~(?P<ip>[^:]+:[^:]+): $ip::;
127.0.0.1 $remote_addr;
::1 $remote_addr;
default 0.0.0.0;
}
access_log /var/log/nginx/access.log combined;
}