Untitled attachment

Notices where this attachment appears

1. Embed this notice
   meso (meso@the.asbestos.cafe)'s status on Sunday, 11-Jun-2023 08:47:40 JST meso

   in reply to

   @alex @MischievousuTomatosu @paulo I had issues with the media/proxy endpoints due to something to do with the proxy settings, don’t remember what it was but check your config against mine @paulo

   location ~ ^/(media|proxy) { proxy_cache pleroma_media_cache; proxy_cache_key $host$uri$is_args$args; proxy_cache_valid 200 206 301 304 5m; proxy_cache_revalidate on; proxy_cache_lock on; proxy_ignore_client_abort on; proxy_buffering on; chunked_transfer_encoding on; proxy_pass http://phoenix; }
2. Embed this notice
   Ted B (tedb@gigaohm.bio)'s status on Sunday, 11-Jun-2023 03:09:26 JST Ted B

   in reply to

   Guessing it’s probably something borked in the nginx media section (although I didn’t change it and I’m using ansible to configure nginx so same config).

   location / { proxy_pass http://phoenix; } location ~ ^/(media|proxy) { proxy_cache pleroma_media_cache; slice 1m; proxy_cache_key $host$uri$is_args$args$slice_range; proxy_set_header Range $slice_range; proxy_cache_valid 200 206 301 304 1h; proxy_cache_lock on; proxy_ignore_client_abort on; proxy_buffering on; chunked_transfer_encoding on; proxy_pass http://phoenix; }

   After 3am here I need 😴

3. Embed this notice
   anime graf mays ?️? (graf@poa.st)'s status on Wednesday, 17-May-2023 03:47:17 JST anime graf mays ?️?

   in reply to

   @ahmad @alex @flappypaddle poast goes over and above to mitigate this with other measures that are a secret, yes however you can do the following:

   /etc/nginx/conf.d/ratelimit.conf:

   limit_req_zone $request_uri zone=register_rate:1m rate=10r/m;

   /etc/nginx/sites-enabled/pleroma.conf (or whatever you named it

   server { [...] location = /api/v1/accounts { limit_req zone=register_rate; proxy_pass http://phoenix; } }

   this will limit hits to the endpoint used for registration to 3 maximum in a minute. lower rate=10r/m to rate=3r/m to restrict to one registration per minute, increase by three per registration you want (3 calls are made each registration attempt)

4. Embed this notice
   meso (meso@asbestos.cafe)'s status on Friday, 10-Feb-2023 04:27:22 JST meso

   in reply to

   @mint @alex

   proxy_cache_path /tmp/akkoma-media-cache levels=1:2 keys_zone=akkoma_media_cache:10m max_size=10g inactive=720m use_temp_path=off; # this is explicitly IPv4 since Pleroma.Web.Endpoint binds on IPv4 only # and `localhost.` resolves to [::0] on some systems: see issue #930 upstream phoenix { server 127.0.0.1:4000 max_fails=5 fail_timeout=60s; } server { server_name asbestos.cafe; listen 80; listen [::]:80; location / { return 301 https://$server_name$request_uri; } } # Enable SSL session caching for improved performance ssl_session_cache shared:ssl_session_cache:10m; server { server_name asbestos.cafe; listen 443 ssl http2; listen [::]:443 ssl http2; ssl_session_timeout 1d; ssl_session_cache shared:MozSSL:10m; # about 40000 sessions ssl_session_tickets off; ssl_trusted_certificate /etc/letsencrypt/live/asbestos.cafe/chain.pem; ssl_certificate /etc/letsencrypt/live/asbestos.cafe/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/asbestos.cafe/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"; ssl_prefer_server_ciphers off; # In case of an old server with an OpenSSL version of 1.0.2 or below, # leave only prime256v1 or comment out the following line. ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1; ssl_stapling on; ssl_stapling_verify on; gzip_vary on; gzip_proxied any; gzip_comp_level 6; gzip_buffers 16 8k; gzip_http_version 1.1; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml; # the nginx default is 1m, not enough for large media uploads client_max_body_size 90m; ignore_invalid_headers off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; location / { proxy_pass http://phoenix; } location ~ ^/(media|proxy) { proxy_cache akkoma_media_cache; slice 1m; proxy_cache_key $host$uri$is_args$args$slice_range; proxy_set_header Range $slice_range; proxy_cache_valid 200 206 301 304 1h; proxy_cache_lock on; proxy_ignore_client_abort on; proxy_buffering on; chunked_transfer_encoding on; proxy_pass http://phoenix; } access_log /var/log/nginx/asbestos.cafe.access.log; }

   i hope theres no vulnerability here :marseyclueless:

5. Embed this notice
    (mint@ryona.agency)'s status on Friday, 10-Feb-2023 04:27:21 JST 

   in reply to

   @meso @alex Get a cert for soap.asbestos.cafe (or whatever other subdomain you want), download soapbox and unpack it into /var/www/soapbox (move files out of static/ so that index.html and the rest is in the dir), then add the following server block after the others.

   server { server_name soap.asbestos.cafe; listen 443 ssl http2; listen [::]:443 ssl http2; ssl_session_timeout 1d; ssl_session_cache shared:MozSSL:10m; # about 40000 sessions ssl_session_tickets off; ssl_trusted_certificate /etc/letsencrypt/live/soap.asbestos.cafe/chain.pem; ssl_certificate /etc/letsencrypt/live/soap.asbestos.cafe/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/soap.asbestos.cafe/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"; ssl_prefer_server_ciphers off; # In case of an old server with an OpenSSL version of 1.0.2 or below, # leave only prime256v1 or comment out the following line. ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1; ssl_stapling on; ssl_stapling_verify on; gzip_vary on; gzip_proxied any; gzip_comp_level 6; gzip_buffers 16 8k; gzip_http_version 1.1; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml; # the nginx default is 1m, not enough for large media uploads client_max_body_size 90m; ignore_invalid_headers off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; root /var/www/soapbox; location / { try_files $uri /index.html =404; error_page 404 = /404.html; } location ~ ^/(activities|relay|schemas|pleroma|contexts|objects|internal|users|inbox|api|.well-known|nodeinfo|proxy|media|oauth|socket|manifest.json|favicon.png) { proxy_pass http://phoenix; } access_log /var/log/nginx/asbestos.cafe.access.log; }