Implement yarn 4.5, new active_record_encryption and mastodon default services

This commit is contained in:
yalh76 2024-12-28 01:29:20 +01:00
parent f42e0062f5
commit 3b0275ba5b
9 changed files with 135 additions and 86 deletions

View file

@ -1,5 +1,5 @@
# This is a sample configuration file. You can generate your configuration
# with the `rake mastodon:setup` interactive setup wizard, but to customize
# with the `bundle exec rails mastodon:setup` interactive setup wizard, but to customize
# your setup even further, you'll need to edit it manually. This sample does
# not demonstrate all available configuration options. Please look at
# https://docs.joinmastodon.org/admin/config/ for the full documentation.
@ -41,14 +41,25 @@ ES_ENABLED=false
# Secrets
# -------
# Make sure to use `rake secret` to generate secrets
# Make sure to use `bundle exec rails secret` to generate secrets
# -------
SECRET_KEY_BASE=__SECRET_KEY_BASE__
OTP_SECRET=__OTP_SECRET__
# Encryption secrets
# ------------------
# Must be available (and set to same values) for all server processes
# These are private/secret values, do not share outside hosting environment
# Use `bin/rails db:encryption:init` to generate fresh secrets
# Do not change these secrets once in use, as this would cause data loss and other issues
# ------------------
ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=__ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY__
ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=__ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT__
ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=__ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY__
# Web Push
# --------
# Generate with `rake mastodon:webpush:generate_vapid_key`
# Generate with `bundle exec rails mastodon:webpush:generate_vapid_key`
# --------
VAPID_PRIVATE_KEY=__VAPID_PRIVATE_KEY__
VAPID_PUBLIC_KEY=__VAPID_PUBLIC_KEY__
@ -104,5 +115,5 @@ LDAP_TLS_NO_VERIFY=true
# Make sure to modify the scheduling of ip_cleanup_scheduler in config/sidekiq.yml
# to be less than daily if you lower IP_RETENTION_PERIOD below two days (172800).
# -----------------------
IP_RETENTION_PERIOD=1209600
SESSION_RETENTION_PERIOD=1209600
IP_RETENTION_PERIOD=31556952
SESSION_RETENTION_PERIOD=31556952

View file

@ -6,10 +6,10 @@ After=network.target
Type=simple
User=__APP__
WorkingDirectory=__INSTALL_DIR__/live
Environment="__LD_PRELOAD__"
Environment="RAILS_ENV=production"
Environment="DB_POOL=25"
Environment="MALLOC_ARENA_MAX=2"
Environment="__LD_PRELOAD__"
Environment="__YNH_RUBY_LOAD_PATH__"
ExecStart=__INSTALL_DIR__/live/bin/bundle exec sidekiq -c 25
TimeoutSec=15
@ -17,22 +17,26 @@ Restart=always
StandardOutput=append:/var/log/__APP__/__APP__-sidekiq.log
StandardError=inherit
# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=no
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
# Proc filesystem
# Capabilities
# Security
NoNewPrivileges=true
# Sandboxing
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
PrivateTmp=true
PrivateDevices=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET
RestrictAddressFamilies=AF_INET6
RestrictAddressFamilies=AF_NETLINK
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=true
LockPersonality=true
RestrictRealtime=true
DevicePolicy=closed
# System Call Filtering
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
# Denying access to capabilities that should not be relevant for webapps

View file

@ -1,5 +1,5 @@
[Unit]
Description=__APP__-streaming
Description=__APP__-streaming on port __PORT_STREAM_
After=network.target
[Service]
@ -16,22 +16,26 @@ Restart=always
StandardOutput=append:/var/log/__APP__/__APP__-streaming.log
StandardError=inherit
# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
# Proc filesystem
# Capabilities
# Security
NoNewPrivileges=true
# Sandboxing
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
PrivateTmp=true
PrivateDevices=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET
RestrictAddressFamilies=AF_INET6
RestrictAddressFamilies=AF_NETLINK
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=true
LockPersonality=true
RestrictRealtime=true
DevicePolicy=closed
# System Call Filtering
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
# Denying access to capabilities that should not be relevant for webapps

View file

@ -6,9 +6,9 @@ After=network.target
Type=simple
User=__APP__
WorkingDirectory=__INSTALL_DIR__/live
Environment="__LD_PRELOAD__"
Environment="RAILS_ENV=production"
Environment="PORT=__PORT_WEB__"
Environment="__LD_PRELOAD__"
Environment="__YNH_RUBY_LOAD_PATH__"
ExecStart=__INSTALL_DIR__/live/bin/bundle exec puma -C config/puma.rb
ExecReload=/bin/kill -SIGUSR1 $MAINPID
@ -17,22 +17,26 @@ Restart=always
StandardOutput=append:/var/log/__APP__/__APP__-web.log
StandardError=inherit
# Sandboxing options to harden security
# Depending on specificities of your service/app, you may need to tweak these
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
# Proc filesystem
# Capabilities
# Security
NoNewPrivileges=true
# Sandboxing
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
PrivateTmp=true
PrivateDevices=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET
RestrictAddressFamilies=AF_INET6
RestrictAddressFamilies=AF_NETLINK
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=true
LockPersonality=true
RestrictRealtime=true
DevicePolicy=closed
# System Call Filtering
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
# Denying access to capabilities that should not be relevant for webapps

View file

@ -75,12 +75,7 @@ ram.runtime = "500M"
stream.default = 4000
[resources.apt]
packages = "imagemagick, ffmpeg, libpq-dev, libxml2-dev, libxslt1-dev, file, git, git-core, g++, libprotobuf-dev, protobuf-compiler, pkg-config, gcc, autoconf, bison, build-essential, libssl-dev, libyaml-dev, libreadline6-dev, zlib1g-dev, libncurses5-dev, libffi-dev, libgdbm6, libgdbm-dev, redis-tools, redis-server, rsync, postgresql, postgresql-contrib, libidn11-dev, libicu-dev, libjemalloc-dev, curl, apt-transport-https"
[resources.apt.extras.yarn]
repo = "deb https://dl.yarnpkg.com/debian/ stable main"
key = "https://dl.yarnpkg.com/debian/pubkey.gpg"
packages = "yarn"
packages = "imagemagick, ffmpeg, libvips-tools, libpq-dev, libxml2-dev, libxslt1-dev, file, git, git-core, g++, libprotobuf-dev, protobuf-compiler, pkg-config, gcc, autoconf, bison, build-essential, libssl-dev, libyaml-dev, libreadline6-dev, zlib1g-dev, libncurses5-dev, libffi-dev, libgdbm6, libgdbm-dev, redis-tools, redis-server, rsync, postgresql, postgresql-contrib, libidn11-dev, libicu-dev, libjemalloc-dev, curl, apt-transport-https"
[resources.database]
type = "postgresql"

View file

@ -5,7 +5,7 @@
#=================================================
memory_needed="2560"
ruby_version=3.2.3
ruby_version=3.3.5
nodejs_version=20
# Workaround for Mastodon on Bullseye

View file

@ -69,22 +69,19 @@ ynh_app_setting_set --app="$app" --key=secret_key_base --value="$secret_key_base
otp_secret=$(ynh_string_random --length=128)
ynh_app_setting_set --app="$app" --key=otp_secret --value="$otp_secret"
# We need rake to build vapid keys, we generate them later once the app is installed
# We need bundle exec rails to build vapid keys, we generate them later once the app is installed
vapid_private_key=""
vapid_public_key=""
# We need `bin/rails db:encryption:init` to generate fresh secrets, we generate them later once the app is installed
active_record_encryption_deterministic_key=""
active_record_encryption_key_derivation_salt=""
active_record_encryption_primary_key=""
ynh_add_config --template=".env.production.sample" --destination="$config"
chmod 400 "$config"
chown $app:$app "$config"
ynh_replace_string --match_string="registrations_mode: 'open'" --replace_string="registrations_mode: 'none'" --target_file="$install_dir/live/config/settings.yml"
ynh_replace_string --match_string="min_invite_role: 'admin'" --replace_string="min_invite_role: 'none'" --target_file="$install_dir/live/config/settings.yml"
ynh_store_file_checksum --file="$install_dir/live/config/settings.yml"
chmod 400 "$install_dir/live/config/settings.yml"
chown $app:$app "$install_dir/live/config/settings.yml"
#=================================================
# BUILD APP
#=================================================
@ -97,31 +94,45 @@ pushd "$install_dir/live"
ynh_gem install bundler --no-document
ynh_exec_as $app $ynh_ruby_load_path $ld_preload bin/bundle config deployment 'true'
ynh_exec_as $app $ynh_ruby_load_path $ld_preload bin/bundle config without 'development test'
ynh_exec_as $app $ynh_ruby_load_path $ld_preload bin/bundle config set force_ruby_platform true
ynh_exec_as $app $ynh_ruby_load_path $ld_preload bin/bundle config set force_ruby_platform true --quiet
ynh_exec_as $app $ynh_ruby_load_path $ld_preload bin/bundle install -j$(getconf _NPROCESSORS_ONLN)
# Building assets
ynh_use_nodejs
ynh_exec_warn_less ynh_exec_as $app $ynh_node_load_PATH yarn install --pure-lockfile --production --network-timeout 600000
env $ynh_node_load_PATH corepack enable
echo Y | ynh_exec_warn_less ynh_exec_as $app env $ynh_node_load_PATH yarn workspaces focus --production
ynh_exec_warn_less ynh_exec_as $app env $ynh_node_load_PATH yarn install --immutable
echo "SAFETY_ASSURED=1">> $config
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails db:migrate --quiet
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails assets:precompile --quiet
# Generate vapid keys
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rake mastodon:webpush:generate_vapid_key > key.txt
# Create the first admin user
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/tootctl accounts create "$admin" --email="$admin_mail" --confirmed --role=Owner > /dev/null
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails mastodon:webpush:generate_vapid_key > vapid_key.txt
# Generate active record encryption
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails db:encryption:init > active_record_encryption.txt
popd
# Re-generate config with vapid keys
vapid_private_key=$(grep -oP "VAPID_PRIVATE_KEY=\K.+" "$install_dir/live/key.txt")
# Re-generate config with vapid keys and active record encryption
vapid_private_key=$(grep -oP "VAPID_PRIVATE_KEY=\K.+" "$install_dir/live/vapid_key.txt")
ynh_app_setting_set --app="$app" --key=vapid_private_key --value="$vapid_private_key"
vapid_public_key=$(grep -oP "VAPID_PUBLIC_KEY=\K.+" "$install_dir/live/key.txt")
vapid_public_key=$(grep -oP "VAPID_PUBLIC_KEY=\K.+" "$install_dir/live/vapid_key.txt")
ynh_app_setting_set --app="$app" --key=vapid_public_key --value="$vapid_public_key"
ynh_secure_remove --file="$install_dir/live/key.txt"
ynh_secure_remove --file="$install_dir/live/vapid_key.txt"
active_record_encryption_deterministic_key=$(grep -oP "ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=\K.+" "$install_dir/live/active_record_encryption.txt")
ynh_app_setting_set --app="$app" --key=active_record_encryption_deterministic_key --value="$active_record_encryption_deterministic_key"
active_record_encryption_key_derivation_salt=$(grep -oP "ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=\K.+" "$install_dir/live/active_record_encryption.txt")
ynh_app_setting_set --app="$app" --key=active_record_encryption_key_derivation_salt --value="$active_record_encryption_key_derivation_salt"
active_record_encryption_primary_key=$(grep -oP "ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=\K.+" "$install_dir/live/active_record_encryption.txt")
ynh_app_setting_set --app="$app" --key=active_record_encryption_primary_key --value="$active_record_encryption_primary_key"
ynh_secure_remove --file="$install_dir/live/active_record_encryption.txt"
ynh_delete_file_checksum --file="$config"
ynh_add_config --template=".env.production.sample" --destination="$config"
chmod 400 "$config"
chown $app:$app "$config"
pushd "$install_dir/live"
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails db:migrate --quiet
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails assets:precompile --quiet
# Create the first admin user
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/tootctl accounts create "$admin" --email="$admin_mail" --confirmed --role=Owner > /dev/null
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/tootctl accounts approve "$admin" > /dev/null
popd
#=================================================
# SYSTEM CONFIGURATION
#=================================================

View file

@ -124,9 +124,9 @@ pushd "$install_dir/live"
ynh_exec_as $app $ynh_ruby_load_path $ld_preload bin/bundle config set force_ruby_platform true --quiet
ynh_exec_as $app $ynh_ruby_load_path $ld_preload bin/bundle install -j$(getconf _NPROCESSORS_ONLN)
ynh_use_nodejs
ynh_exec_as $app $ynh_node_load_PATH yarn install --pure-lockfile --production --network-timeout 600000
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails assets:clean
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails assets:precompile
env $ynh_node_load_PATH corepack enable
echo Y | ynh_exec_warn_less ynh_exec_as $app env $ynh_node_load_PATH yarn workspaces focus --production
ynh_exec_warn_less ynh_exec_as $app env $ynh_node_load_PATH yarn install --immutable
popd
chown "$app:www-data" "$install_dir"
@ -163,6 +163,21 @@ ynh_use_logrotate --non-append
#=================================================
ynh_script_progression --message="Updating a config file..." --weight=1
if ynh_compare_current_package_version --comparison lt --version "4.3.2~ynh1"; then
pushd "$install_dir/live"
ynh_use_ruby
# Generate active record encryption
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails db:encryption:init > active_record_encryption.txt
active_record_encryption_deterministic_key=$(grep -oP "ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=\K.+" "$install_dir/live/active_record_encryption.txt")
ynh_app_setting_set --app="$app" --key=active_record_encryption_deterministic_key --value="$active_record_encryption_deterministic_key"
active_record_encryption_key_derivation_salt=$(grep -oP "ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=\K.+" "$install_dir/live/active_record_encryption.txt")
ynh_app_setting_set --app="$app" --key=active_record_encryption_key_derivation_salt --value="$active_record_encryption_key_derivation_salt"
active_record_encryption_primary_key=$(grep -oP "ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=\K.+" "$install_dir/live/active_record_encryption.txt")
ynh_app_setting_set --app="$app" --key=active_record_encryption_primary_key --value="$active_record_encryption_primary_key"
ynh_secure_remove --file="$install_dir/live/active_record_encryption.txt"
popd
fi
language="$(echo $language | head -c 2)"
ynh_add_config --template=".env.production.sample" --destination="$config"
@ -177,8 +192,9 @@ ynh_script_progression --message="Applying migrations..." --weight=1
pushd "$install_dir/live"
ynh_use_ruby
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails db:migrate
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/tootctl cache clear
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails db:migrate --quiet
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails assets:clean --quiet
ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails assets:precompile --quiet
popd
#=================================================

View file

@ -1,3 +1,5 @@
#:schema https://raw.githubusercontent.com/YunoHost/apps/master/schemas/tests.v1.schema.json
test_format = 1.0
[default]
@ -24,3 +26,5 @@ test_format = 1.0
test_upgrade_from.43504e6.args.is_public=1
test_upgrade_from.43504e6.args.admin="john"
test_upgrade_from.43504e6.args.language="fr_FR"
test_upgrade_from.8102fffa52a4e3279bba9fbdafb3a0e5b1fe3e17.name = "Upgrade from 4.2.13~ynh1"