akkoma/config/config.exs

916 lines
26 KiB
Elixir
Raw Normal View History

# .i;;;;i.
# iYcviii;vXY:
# .YXi .i1c.
# .YC. . in7.
# .vc. ...... ;1c.
# i7, .. .;1;
# i7, .. ... .Y1i
# ,7v .6MMM@; .YX,
# .7;. ..IMMMMMM1 :t7.
# .;Y. ;$MMMMMM9. :tc.
# vY. .. .nMMM@MMU. ;1v.
# i7i ... .#MM@M@C. .....:71i
# it: .... $MMM@9;.,i;;;i,;tti
# :t7. ..... 0MMMWv.,iii:::,,;St.
# .nC. ..... IMMMQ..,::::::,.,czX.
# .ct: ....... .ZMMMI..,:::::::,,:76Y.
# c2: ......,i..Y$M@t..:::::::,,..inZY
# vov ......:ii..c$MBc..,,,,,,,,,,..iI9i
# i9Y ......iii:..7@MA,..,,,,,,,,,....;AA:
# iIS. ......:ii::..;@MI....,............;Ez.
# .I9. ......:i::::...8M1..................C0z.
# .z9; ......:i::::,.. .i:...................zWX.
# vbv ......,i::::,,. ................. :AQY
# c6Y. .,...,::::,,..:t0@@QY. ................ :8bi
# :6S. ..,,...,:::,,,..EMMMMMMI. ............... .;bZ,
# :6o, .,,,,..:::,,,..i#MMMMMM#v................. YW2.
# .n8i ..,,,,,,,::,,,,.. tMMMMM@C:.................. .1Wn
# 7Uc. .:::,,,,,::,,,,.. i1t;,..................... .UEi
# 7C...::::::::::::,,,,.. .................... vSi.
# ;1;...,,::::::,......... .................. Yz:
# v97,......... .voC.
# izAotX7777777777777777777777777777777777777777Y7n92:
# .;CoIIIIIUAA666666699999ZZZZZZZZZZZZZZZZZZZZ6ov.
#
# !!! ATTENTION !!!
# DO NOT EDIT THIS FILE! THIS FILE CONTAINS THE DEFAULT VALUES FOR THE CON-
# FIGURATION! EDIT YOUR SECRET FILE (either prod.secret.exs, dev.secret.exs).
#
2017-03-17 16:09:58 +00:00
# This file is responsible for configuring your application
# and its dependencies with the aid of the Mix.Config module.
#
# This configuration file is loaded before any dependency and
# is restricted to this project.
import Config
2017-03-17 16:09:58 +00:00
# General application configuration
2018-03-30 13:01:53 +00:00
config :pleroma, ecto_repos: [Pleroma.Repo]
2017-03-17 16:09:58 +00:00
2019-01-30 15:32:30 +00:00
config :pleroma, Pleroma.Repo,
2019-05-17 09:30:35 +00:00
telemetry_event: [Pleroma.Repo.Instrumenter],
2022-09-16 13:23:31 +00:00
queue_target: 20_000,
2019-05-17 09:30:35 +00:00
migration_lock: nil
2019-01-30 15:32:30 +00:00
config :pleroma, Pleroma.Captcha,
enabled: true,
seconds_valid: 300,
method: Pleroma.Captcha.Native
2019-12-16 12:35:10 +00:00
config :pleroma, Pleroma.Captcha.Kocaptcha, endpoint: "https://captcha.kotobank.ch"
2018-11-29 20:11:45 +00:00
# Upload configuration
2018-06-26 20:49:57 +00:00
config :pleroma, Pleroma.Upload,
2018-08-28 01:45:53 +00:00
uploader: Pleroma.Uploaders.Local,
filters: [],
link_name: false,
2018-11-23 16:40:45 +00:00
proxy_remote: false,
filename_display_max_length: 30,
Sanitise Content-Type of uploads The lack thereof enables spoofing ActivityPub objects. A malicious user could upload fake activities as attachments and (if having access to remote search) trick local and remote fedi instances into fetching and processing it as a valid object. If uploads are hosted on the same domain as the instance itself, it is possible for anyone with upload access to impersonate(!) other users of the same instance. If uploads are exclusively hosted on a different domain, even the most basic check of domain of the object id and fetch url matching should prevent impersonation. However, it may still be possible to trick servers into accepting bogus users on the upload (sub)domain and bogus notes attributed to such users. Instances which later migrated to a different domain and have a permissive redirect rule in place can still be vulnerable. If — like Akkoma — the fetching server is overly permissive with redirects, impersonation still works. This was possible because Plug.Static also uses our custom MIME type mappings used for actually authentic AP objects. Provided external storage providers don’t somehow return ActivityStream Content-Types on their own, instances using those are also safe against their users being spoofed via uploads. Akkoma instances using the OnlyMedia upload filter cannot be exploited as a vector in this way — IF the fetching server validates the Content-Type of fetched objects (Akkoma itself does this already). However, restricting uploads to only multimedia files may be a bit too heavy-handed. Instead this commit will restrict the returned Content-Type headers for user uploaded files to a safe subset, falling back to generic 'application/octet-stream' for anything else. This will also protect against non-AP payloads as e.g. used in past frontend code injection attacks. It’s a slight regression in user comfort, if say PDFs are uploaded, but this trade-off seems fairly acceptable. (Note, just excluding our own custom types would offer no protection against non-AP payloads and bear a (perhaps small) risk of a silent regression should MIME ever decide to add a canonical extension for ActivityPub objects) Now, one might expect there to be other defence mechanisms besides Content-Type preventing counterfeits from being accepted, like e.g. validation of the queried URL and AP ID matching. Inserting a self-reference into our uploads is hard, but unfortunately *oma does not verify the id in such a way and happily accepts _anything_ from the same domain (without even considering redirects). E.g. Sharkey (and possibly other *keys) seem to attempt to guard against this by immediately refetching the object from its ID, but this is easily circumvented by just uploading two payloads with the ID of one linking to the other. Unfortunately *oma is thus _both_ a vector for spoofing and vulnerable to those spoof payloads, resulting in an easy way to impersonate our users. Similar flaws exists for emoji and media proxy. Subsequent commits will fix this by rigorously sanitising content types in more areas, hardening our checks, improving the default config and discouraging insecure config options.
2024-03-04 16:50:21 +00:00
base_url: nil,
allowed_mime_types: ["image", "audio", "video"]
2018-11-29 20:11:45 +00:00
2018-11-23 16:40:45 +00:00
config :pleroma, Pleroma.Uploaders.Local, uploads: "uploads"
2018-08-28 01:20:54 +00:00
config :pleroma, Pleroma.Uploaders.S3,
bucket: nil,
bucket_namespace: nil,
truncated_namespace: nil,
streaming_enabled: true
config :ex_aws, :s3,
# host: "s3.wasabisys.com", # required if not Amazon AWS
access_key_id: nil,
secret_access_key: nil,
2021-01-20 22:39:39 +00:00
# region: "us-east-1", # may be required for Amazon AWS
scheme: "https://"
2017-03-28 23:39:01 +00:00
config :pleroma, :emoji,
shortcode_globs: ["/emoji/custom/**/*.png"],
pack_extensions: [".png", ".gif"],
groups: [
Custom: ["/emoji/*.png", "/emoji/**/*.png"]
],
2019-08-12 10:13:01 +00:00
default_manifest: "https://git.pleroma.social/pleroma/emoji-index/raw/master/index.json",
shared_pack_cache_seconds_per_file: 60
config :pleroma, :uri_schemes,
valid_schemes: [
"https",
"http",
"dat",
"dweb",
2022-06-29 11:12:48 +00:00
"gopher",
2020-07-07 07:05:54 +00:00
"hyper",
"ipfs",
"ipns",
"irc",
"ircs",
"magnet",
"mailto",
"mumble",
"ssb",
"xmpp"
]
2017-03-17 16:09:58 +00:00
# Configures the endpoint
config :pleroma, Pleroma.Web.Endpoint,
url: [host: "localhost"],
2018-12-17 13:39:59 +00:00
http: [
ip: {127, 0, 0, 1},
2018-12-17 13:39:59 +00:00
dispatch: [
{:_,
[
{"/api/v1/streaming", Pleroma.Web.MastodonAPI.WebsocketHandler, []},
{:_, Plug.Cowboy.Handler, {Pleroma.Web.Endpoint, []}}
2018-12-17 13:39:59 +00:00
]}
]
],
2017-03-29 00:05:51 +00:00
protocol: "https",
2017-03-17 16:09:58 +00:00
secret_key_base: "aK4Abxf29xU9TTDKre9coZPUgevcVCFQJe/5xP/7Lt4BEif6idBIbjupVbOrbKxl",
live_view: [signing_salt: "U5ELgdEwTD3n1+D5s0rY0AMg8/y1STxZ3Zvsl3bWh+oBcGrYdil0rXqPMRd3Glcq"],
2018-11-16 20:35:08 +00:00
signing_salt: "CqaoopA2",
2017-03-17 16:09:58 +00:00
render_errors: [view: Pleroma.Web.ErrorView, accepts: ~w(json)],
pubsub_server: Pleroma.PubSub,
secure_cookie_flag: true,
extra_cookie_attrs: [
"SameSite=Lax"
]
2017-03-17 16:09:58 +00:00
# Configures Elixir's Logger
2022-06-29 11:12:48 +00:00
config :logger, truncate: 65_536
2017-03-17 16:09:58 +00:00
config :logger, :console,
2022-06-11 15:14:22 +00:00
level: :info,
format: "\n$time $metadata[$level] $message\n",
2017-03-17 16:09:58 +00:00
metadata: [:request_id]
2019-01-02 22:07:48 +00:00
config :logger, :ex_syslogger,
2022-06-11 15:14:22 +00:00
level: :info,
ident: "pleroma",
format: "$metadata[$level] $message",
2019-01-02 22:07:48 +00:00
metadata: [:request_id]
# ———————————————————————————————————————————————————————————————
# W A R N I N G
# ———————————————————————————————————————————————————————————————
#
# Whenever adding a privileged new custom type for e.g.
# ActivityPub objects, ALWAYS map their extension back
# to "application/octet-stream".
# Else files served by us can automatically end up with
# those privileged types causing severe security hazards.
# (We need those mappings so Phoenix can assoiate its format
# (the "extension") to incoming requests of those MIME types)
#
# ———————————————————————————————————————————————————————————————
2017-04-17 11:44:41 +00:00
config :mime, :types, %{
"application/xml" => ["xml"],
2017-12-11 09:37:22 +00:00
"application/xrd+xml" => ["xrd+xml"],
"application/jrd+json" => ["jrd+json"],
2018-04-01 12:58:01 +00:00
"application/activity+json" => ["activity+json"],
"application/ld+json" => ["activity+json"],
# Can be removed when bumping MIME past 2.0.5
# see https://akkoma.dev/AkkomaGang/akkoma/issues/657
"image/apng" => ["apng"]
2017-04-17 11:44:41 +00:00
}
2023-08-07 03:07:42 +00:00
config :mime, :extensions, %{
"xrd+xml" => "text/plain",
"jrd+json" => "text/plain",
"activity+json" => "text/plain"
2023-08-07 03:07:42 +00:00
}
# ———————————————————————————————————————————————————————————————
config :tesla, :adapter, {Tesla.Adapter.Finch, name: MyFinch}
2017-12-30 18:02:51 +00:00
# Configures http settings, upstream proxy etc.
config :pleroma, :http,
pool_timeout: :timer.seconds(5),
receive_timeout: :timer.seconds(15),
proxy_url: nil,
user_agent: :default,
2024-06-09 16:20:29 +00:00
pool_size: 10,
adapter: [],
# see: https://hexdocs.pm/finch/Finch.html#start_link/1
2024-06-09 20:17:12 +00:00
pool_max_idle_time: :timer.seconds(30)
2017-09-15 08:26:28 +00:00
config :pleroma, :instance,
name: "Akkoma",
email: "example@example.com",
notify_email: "noreply@example.com",
2022-06-29 11:12:48 +00:00
description: "Akkoma: The cooler fediverse server",
background_image: "/images/city.jpg",
instance_thumbnail: "/instance/thumbnail.jpeg",
limit: 5_000,
2020-07-06 09:08:13 +00:00
description_limit: 5_000,
2018-12-28 18:57:50 +00:00
remote_limit: 100_000,
upload_limit: 16_000_000,
avatar_upload_limit: 2_000_000,
background_upload_limit: 4_000_000,
banner_upload_limit: 4_000_000,
languages: ["en"],
poll_limits: %{
max_options: 20,
max_option_chars: 200,
min_expiration: 0,
max_expiration: 365 * 24 * 60 * 60
},
2018-03-05 08:26:24 +00:00
registrations_open: true,
invites_enabled: false,
account_activation_required: false,
account_approval_required: false,
federating: true,
2019-06-30 12:58:50 +00:00
federation_incoming_replies_max_depth: 100,
federation_reachability_timeout_days: 7,
federation_publisher_modules: [
Pleroma.Web.ActivityPub.Publisher
],
allow_relay: false,
public: true,
static_dir: "instance/static/",
allowed_post_formats: [
"text/plain",
"text/html",
2019-04-26 10:17:57 +00:00
"text/markdown",
2022-06-14 14:56:12 +00:00
"text/bbcode",
"text/x.misskeymarkdown"
],
2020-01-16 16:13:51 +00:00
staff_transparency: [],
autofollowed_nicknames: [],
autofollowing_nicknames: [],
2019-01-17 15:50:34 +00:00
max_pinned_statuses: 1,
attachment_links: false,
2019-03-20 20:09:36 +00:00
max_report_comment_size: 1000,
safe_dm_mentions: false,
healthcheck: false,
2019-06-03 13:04:39 +00:00
remote_post_retention_days: 90,
skip_thread_containment: true,
limit_to_local_content: :unauthenticated,
user_bio_length: 5000,
user_name_length: 100,
2019-08-08 06:20:35 +00:00
max_account_fields: 10,
max_remote_account_fields: 20,
account_field_name_length: 512,
account_field_value_length: 2048,
registration_reason_length: 500,
external_user_synchronization: true,
2020-01-30 22:20:37 +00:00
extended_nickname_format: true,
cleanup_attachments: false,
multi_factor_authentication: [
totp: [
# digits 6 or 8
digits: 6,
period: 30
],
backup_codes: [
number: 5,
length: 16
]
],
show_reactions: true,
2021-12-26 02:35:17 +00:00
password_reset_token_validity: 60 * 60 * 24,
profile_directory: true,
privileged_staff: false,
local_bubble: [],
2022-12-16 11:17:04 +00:00
max_frontend_settings_json_chars: 100_000,
2023-03-17 15:33:28 +00:00
export_prometheus_metrics: true,
federated_timeline_available: true
2017-09-15 08:26:28 +00:00
2020-07-21 06:25:53 +00:00
config :pleroma, :welcome,
direct_message: [
enabled: false,
sender_nickname: nil,
message: nil
],
email: [
enabled: false,
2020-07-22 12:34:47 +00:00
sender: nil,
2020-07-21 06:25:53 +00:00
subject: "Welcome to <%= instance_name %>",
html: "Welcome to <%= instance_name %>",
text: "Welcome to <%= instance_name %>"
]
2017-09-15 08:26:28 +00:00
2019-11-08 06:23:24 +00:00
config :pleroma, :feed,
post_title: %{
max_length: 100,
2019-11-10 11:02:34 +00:00
omission: "..."
2019-11-08 06:23:24 +00:00
}
config :pleroma, :markup,
# XXX - unfortunately, inline images must be enabled by default right now, because
# of custom emoji. Issue #275 discusses defanging that somehow.
allow_inline_images: true,
allow_headings: false,
allow_tables: false,
allow_fonts: false,
scrub_policy: [
Pleroma.HTML.Scrubber.Default,
Pleroma.HTML.Transform.MediaProxy
]
2019-01-23 11:40:57 +00:00
config :pleroma, :frontend_configurations,
pleroma_fe: %{
2020-05-19 21:05:39 +00:00
alwaysShowSubjectInput: true,
2019-01-28 12:04:51 +00:00
background: "/images/city.jpg",
2019-01-23 11:40:57 +00:00
collapseMessageWithSubject: false,
2020-05-19 21:05:39 +00:00
greentext: false,
hideFilteredStatuses: false,
hideMutedPosts: false,
2019-01-23 11:40:57 +00:00
hidePostStats: false,
2020-05-19 21:05:39 +00:00
hideSitename: false,
2019-01-23 11:40:57 +00:00
hideUserStats: false,
2020-05-19 21:05:39 +00:00
loginMethod: "password",
logo: "/static/logo.svg",
2020-05-19 21:05:39 +00:00
logoMargin: ".1em",
logoMask: true,
noAttachmentLinks: false,
nsfwCensorImage: "",
postContentType: "text/plain",
redirectRootLogin: "/main/friends",
redirectRootNoLogin: "/main/public",
2019-01-23 11:40:57 +00:00
scopeCopy: true,
2020-05-20 17:22:31 +00:00
sidebarRight: false,
2020-05-19 21:05:39 +00:00
showFeaturesPanel: true,
showInstanceSpecificPanel: false,
2019-01-23 11:40:57 +00:00
subjectLineBehavior: "email",
2020-05-19 21:05:39 +00:00
theme: "pleroma-dark",
2022-11-20 22:21:56 +00:00
webPushNotifications: false,
conversationDisplay: "linear"
},
masto_fe: %{
showInstanceSpecificPanel: true
2019-01-23 11:40:57 +00:00
}
config :pleroma, :assets,
mascots: [
pleroma_fox_tan: %{
url: "/images/pleroma-fox-tan-smol.png",
mime_type: "image/png"
},
pleroma_fox_tan_shy: %{
url: "/images/pleroma-fox-tan-shy.png",
mime_type: "image/png"
}
],
default_mascot: :pleroma_fox_tan
2019-10-11 12:48:01 +00:00
config :pleroma, :manifest,
icons: [
%{
src: "/static/logo.svg",
type: "image/svg+xml"
2019-10-11 12:48:01 +00:00
}
],
theme_color: "#282c37",
background_color: "#191b22"
config :pleroma, :activitypub,
unfollow_blocked: true,
outgoing_blocks: false,
2020-10-10 06:29:41 +00:00
blockers_visible: true,
2019-07-17 21:38:06 +00:00
follow_handshake_timeout: 500,
note_replies_output_limit: 5,
sign_object_fetches: true,
2022-07-03 18:20:59 +00:00
authorized_fetch_mode: false,
max_collection_objects: 50
config :pleroma, :streamer,
workers: 3,
overflow_workers: 2
2018-06-09 04:28:11 +00:00
config :pleroma, :user, deny_follow_blocked: true
config :pleroma, :mrf_normalize_markup, scrub_policy: Pleroma.HTML.Scrubber.Default
config :pleroma, :mrf_rejectnonpublic,
allow_followersonly: false,
allow_direct: false
2019-02-03 19:12:23 +00:00
config :pleroma, :mrf_hellthread,
delist_threshold: 10,
reject_threshold: 20
2018-12-22 22:18:31 +00:00
config :pleroma, :mrf_simple,
media_removal: [],
media_nsfw: [],
federated_timeline_removal: [],
report_removal: [],
reject: [],
followers_only: [],
accept: [],
avatar_removal: [],
banner_removal: [],
background_removal: [],
reject_deletes: [],
handle_threads: true
2019-01-31 15:18:20 +00:00
2019-02-08 09:48:39 +00:00
config :pleroma, :mrf_keyword,
reject: [],
federated_timeline_removal: [],
2019-02-08 09:48:39 +00:00
replace: []
config :pleroma, :mrf_hashtag,
sensitive: ["nsfw"],
reject: [],
federated_timeline_removal: []
2019-06-02 10:29:15 +00:00
config :pleroma, :mrf_subchain, match_actor: %{}
2019-06-02 09:50:16 +00:00
2020-02-11 09:53:24 +00:00
config :pleroma, :mrf_activity_expiration, days: 365
2019-08-13 20:28:59 +00:00
config :pleroma, :mrf_vocabulary,
accept: [],
reject: []
config :pleroma, :mrf_inline_quote, prefix: "RE"
# threshold of 7 days
config :pleroma, :mrf_object_age,
threshold: 604_800,
actions: [:delist, :strip_followers]
config :pleroma, :mrf_reject_newly_created_account_notes, age: 86_400
config :pleroma, :rich_media,
enabled: true,
ignore_hosts: [],
2019-07-11 13:04:42 +00:00
ignore_tld: ["local", "localdomain", "lan"],
parsers: [
Pleroma.Web.RichMedia.Parsers.TwitterCard,
Pleroma.Web.RichMedia.Parsers.OEmbed
],
failure_backoff: 60_000,
ttl_setters: [
Pleroma.Web.RichMedia.Parser.TTL.AwsSignedUrl,
Pleroma.Web.RichMedia.Parser.TTL.Opengraph
],
max_body: 5_000_000
config :pleroma, :media_proxy,
enabled: false,
2020-05-15 18:34:46 +00:00
invalidation: [
enabled: false,
2020-05-18 03:48:19 +00:00
provider: Pleroma.Web.MediaProxy.Invalidation.Script
2020-05-15 18:34:46 +00:00
],
proxy_opts: [
redirect_on_failure: false,
max_body_length: 25 * 1_048_576,
# Note: max_read_duration defaults to Pleroma.ReverseProxy.max_read_duration_default/1
max_read_duration: 30_000
2019-04-25 23:11:47 +00:00
],
2023-06-26 13:18:31 +00:00
whitelist: [],
blocklist: []
2018-03-30 13:01:53 +00:00
2020-06-14 18:02:57 +00:00
config :pleroma, Pleroma.Web.MediaProxy.Invalidation.Http,
method: :purge,
headers: [],
options: []
config :pleroma, Pleroma.Web.MediaProxy.Invalidation.Script,
script_path: nil,
url_format: nil
2020-06-14 18:02:57 +00:00
# Note: media preview proxy depends on media proxy to be enabled
config :pleroma, :media_preview_proxy,
enabled: false,
thumbnail_max_width: 600,
thumbnail_max_height: 600,
image_quality: 85,
min_content_length: 100 * 1024
config :phoenix, :format_encoders, json: Jason, "activity+json": Jason
config :phoenix, :json_library, Jason
2020-02-28 04:27:50 +00:00
config :phoenix, :filter_parameters, ["password", "confirm"]
2019-04-19 07:50:21 +00:00
config :pleroma, Pleroma.Web.Metadata,
providers: [
Pleroma.Web.Metadata.Providers.OpenGraph,
Pleroma.Web.Metadata.Providers.TwitterCard
],
2019-04-19 07:50:21 +00:00
unfurl_nsfw: false
config :pleroma, Pleroma.Web.Metadata.Providers.Theme, theme_color: "#593196"
2020-05-12 15:08:00 +00:00
config :pleroma, Pleroma.Web.Preload,
providers: [
2020-07-06 10:25:25 +00:00
Pleroma.Web.Preload.Providers.Instance
2020-05-12 15:08:00 +00:00
]
2018-11-12 15:08:02 +00:00
config :pleroma, :http_security,
enabled: true,
sts: false,
HTTP header improvements (#294) - Drop Expect-CT Expect-CT has been redundant since 2018 when Certificate Transparency became mandated and required for all CAs and browsers. This header is only implemented in Chrome and is now deprecated. HTTP header analysers do not check this anymore as this is enforced by default. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT - Raise HSTS to 2 years and explicitly preload The longer age for HSTS, the better. Header analysers prefer 2 years over 1 year now as free TLS is very common using Let's Encrypt. For HSTS to be fully effective, you need to submit your root domain (domain.tld) to https://hstspreload.org. However, a requirement for this is the "preload" directive in Strict-Transport-Security. If you do not have "preload", it will reject your domain. - Drop X-Download-Options This is an IE8-era header when Adobe products used to use the IE engine for making outbound web requests to embed webpages in things like Adobe Acrobat (PDFs). Modern apps are using Microsoft Edge WebView2 or Chromium Embedded Framework. No modern browser checks or header analyser check for this. - Set base-uri to 'none' This is to specify the domain for relative links (`<base>` HTML tag). pleroma-fe does not use this and it's an incredibly niche tag. I use all of these myself on my instance by rewriting the headers with zero problems. No breakage observed. I have not compiled my Elixr changes, but I don't see why they'd break. Co-authored-by: r3g_5z <june@terezi.dev> Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/294 Co-authored-by: @r3g_5z@plem.sapphic.site <june@terezi.dev> Co-committed-by: @r3g_5z@plem.sapphic.site <june@terezi.dev>
2022-11-20 21:20:06 +00:00
sts_max_age: 63_072_000,
referrer_policy: "same-origin"
2018-11-11 05:40:55 +00:00
config :cors_plug,
max_age: 86_400,
methods: ["POST", "PUT", "DELETE", "GET", "PATCH", "OPTIONS"],
expose: [
"Link",
"X-RateLimit-Reset",
"X-RateLimit-Limit",
"X-RateLimit-Remaining",
"X-Request-Id",
"Idempotency-Key"
],
credentials: true,
headers: ["Authorization", "Content-Type", "Idempotency-Key"]
config :pleroma, Pleroma.User,
restricted_nicknames: [
2019-01-10 00:06:03 +00:00
".well-known",
2018-12-26 13:16:41 +00:00
"~",
2019-01-10 00:06:03 +00:00
"about",
"activities",
"api",
2019-01-10 00:06:03 +00:00
"auth",
2019-05-20 22:18:59 +00:00
"check_password",
2019-01-10 00:06:03 +00:00
"dev",
"friend-requests",
"inbox",
"internal",
"main",
"media",
"nodeinfo",
"notice",
"oauth",
2019-01-10 00:06:03 +00:00
"objects",
"ostatus_subscribe",
"pleroma",
"proxy",
"push",
2019-01-10 00:06:03 +00:00
"registration",
"relay",
2019-01-10 00:06:03 +00:00
"settings",
"status",
"tag",
"user-search",
2019-05-20 22:18:59 +00:00
"user_exists",
2019-01-10 00:06:03 +00:00
"users",
"web",
"verify_credentials",
"update_credentials",
"relationships",
"search",
"confirmation_resend",
"mfa"
2020-08-02 19:53:42 +00:00
],
email_blacklist: []
config :pleroma, Oban,
repo: Pleroma.Repo,
2020-06-23 12:09:01 +00:00
log: false,
queues: [
activity_expiration: 10,
2020-09-05 15:35:01 +00:00
token_expiration: 5,
filter_expiration: 1,
2020-09-02 17:45:22 +00:00
backup: 1,
federator_incoming: 50,
federator_outgoing: 50,
ingestion_queue: 50,
web_push: 50,
mailer: 10,
transmogrifier: 20,
scheduled_activities: 10,
2021-07-18 01:35:35 +00:00
poll_notifications: 10,
2020-01-21 16:48:14 +00:00
background: 5,
remote_fetcher: 2,
attachments_cleanup: 1,
2020-09-08 10:26:44 +00:00
new_users_digest: 1,
2022-01-22 12:23:11 +00:00
mute_expire: 5,
search_indexing: 10,
nodeinfo_fetcher: 1,
RichMedia refactor Rich Media parsing was previously handled on-demand with a 2 second HTTP request timeout and retained only in Cachex. Every time a Pleroma instance is restarted it will have to request and parse the data for each status with a URL detected. When fetching a batch of statuses they were processed in parallel to attempt to keep the maximum latency at 2 seconds, but often resulted in a timeline appearing to hang during loading due to a URL that could not be successfully reached. URLs which had images links that expire (Amazon AWS) were parsed and inserted with a TTL to ensure the image link would not break. Rich Media data is now cached in the database and fetched asynchronously. Cachex is used as a read-through cache. When the data becomes available we stream an update to the clients. If the result is returned quickly the experience is almost seamless. Activities were already processed for their Rich Media data during ingestion to warm the cache, so users should not normally encounter the asynchronous loading of the Rich Media data. Implementation notes: - The async worker is a Task with a globally unique process name to prevent duplicate processing of the same URL - The Task will attempt to fetch the data 3 times with increasing sleep time between attempts - The HTTP request obeys the default HTTP request timeout value instead of 2 seconds - URLs that cannot be successfully parsed due to an unexpected error receives a negative cache entry for 15 minutes - URLs that fail with an expected error will receive a negative cache with no TTL - Activities that have no detected URLs insert a nil value in the Cachex :scrubber_cache so we do not repeat parsing the object content with Floki every time the activity is rendered - Expiring image URLs are handled with an Oban job - There is no automatic cleanup of the Rich Media data in the database, but it is safe to delete at any time - The post draft/preview feature makes the URL processing synchronous so the rendered post preview will have an accurate rendering Overall performance of timelines and creating new posts which contain URLs is greatly improved.
2024-02-11 21:11:52 +00:00
database_prune: 1,
rich_media_backfill: 2,
RichMedia refactor Rich Media parsing was previously handled on-demand with a 2 second HTTP request timeout and retained only in Cachex. Every time a Pleroma instance is restarted it will have to request and parse the data for each status with a URL detected. When fetching a batch of statuses they were processed in parallel to attempt to keep the maximum latency at 2 seconds, but often resulted in a timeline appearing to hang during loading due to a URL that could not be successfully reached. URLs which had images links that expire (Amazon AWS) were parsed and inserted with a TTL to ensure the image link would not break. Rich Media data is now cached in the database and fetched asynchronously. Cachex is used as a read-through cache. When the data becomes available we stream an update to the clients. If the result is returned quickly the experience is almost seamless. Activities were already processed for their Rich Media data during ingestion to warm the cache, so users should not normally encounter the asynchronous loading of the Rich Media data. Implementation notes: - The async worker is a Task with a globally unique process name to prevent duplicate processing of the same URL - The Task will attempt to fetch the data 3 times with increasing sleep time between attempts - The HTTP request obeys the default HTTP request timeout value instead of 2 seconds - URLs that cannot be successfully parsed due to an unexpected error receives a negative cache entry for 15 minutes - URLs that fail with an expected error will receive a negative cache with no TTL - Activities that have no detected URLs insert a nil value in the Cachex :scrubber_cache so we do not repeat parsing the object content with Floki every time the activity is rendered - Expiring image URLs are handled with an Oban job - There is no automatic cleanup of the Rich Media data in the database, but it is safe to delete at any time - The post draft/preview feature makes the URL processing synchronous so the rendered post preview will have an accurate rendering Overall performance of timelines and creating new posts which contain URLs is greatly improved.
2024-02-11 21:11:52 +00:00
rich_media_expiration: 2
],
plugins: [
Oban.Plugins.Pruner,
{Oban.Plugins.Reindexer, schedule: "@weekly"}
],
crontab: [
{"0 0 * * 0", Pleroma.Workers.Cron.DigestEmailsWorker},
{"0 0 * * *", Pleroma.Workers.Cron.NewUsersDigestWorker},
{"0 3 * * *", Pleroma.Workers.Cron.PruneDatabaseWorker}
]
2019-01-28 15:17:17 +00:00
config :pleroma, :workers,
retries: [
federator_incoming: 5,
federator_outgoing: 5,
search_indexing: 2,
rich_media_backfill: 3
],
timeout: [
activity_expiration: :timer.seconds(5),
token_expiration: :timer.seconds(5),
filter_expiration: :timer.seconds(5),
backup: :timer.seconds(900),
federator_incoming: :timer.seconds(10),
federator_outgoing: :timer.seconds(10),
ingestion_queue: :timer.seconds(5),
web_push: :timer.seconds(5),
mailer: :timer.seconds(5),
transmogrifier: :timer.seconds(5),
scheduled_activities: :timer.seconds(5),
poll_notifications: :timer.seconds(5),
background: :timer.seconds(5),
remote_fetcher: :timer.seconds(10),
attachments_cleanup: :timer.seconds(900),
new_users_digest: :timer.seconds(10),
mute_expire: :timer.seconds(5),
search_indexing: :timer.seconds(5),
nodeinfo_fetcher: :timer.seconds(10),
database_prune: :timer.minutes(10),
rich_media_backfill: :timer.seconds(30)
]
config :pleroma, Pleroma.Formatter,
class: false,
rel: "ugc",
new_window: false,
truncate: false,
strip_prefix: false,
extra: true,
validate_tld: :no_scheme
2019-02-26 23:32:26 +00:00
config :pleroma, :ldap,
enabled: System.get_env("LDAP_ENABLED") == "true",
host: System.get_env("LDAP_HOST") || "localhost",
port: String.to_integer(System.get_env("LDAP_PORT") || "389"),
ssl: System.get_env("LDAP_SSL") == "true",
sslopts: [],
tls: System.get_env("LDAP_TLS") == "true",
tlsopts: [],
base: System.get_env("LDAP_BASE") || "dc=example,dc=com",
uid: System.get_env("LDAP_UID") || "cn"
oauth_consumer_strategies =
2022-06-29 11:12:48 +00:00
"OAUTH_CONSUMER_STRATEGIES"
|> System.get_env()
|> to_string()
|> String.split()
|> Enum.map(&hd(String.split(&1, ":")))
ueberauth_providers =
for strategy <- oauth_consumer_strategies do
strategy_module_name = "Elixir.Ueberauth.Strategy.#{String.capitalize(strategy)}"
strategy_module = String.to_atom(strategy_module_name)
{String.to_atom(strategy), {strategy_module, [callback_params: ["state"]]}}
end
2019-03-11 17:37:26 +00:00
config :ueberauth,
Ueberauth,
base_path: "/oauth",
providers: ueberauth_providers
config :pleroma, :auth, oauth_consumer_strategies: oauth_consumer_strategies
2019-03-11 17:37:26 +00:00
config :pleroma, Pleroma.Emails.Mailer, adapter: Swoosh.Adapters.Sendmail, enabled: false
2022-12-11 19:19:31 +00:00
config :swoosh,
api_client: Swoosh.ApiClient.Finch,
finch_name: MyFinch
config :pleroma, Pleroma.Emails.UserEmail,
logo: nil,
styling: %{
link_color: "#d8a070",
background_color: "#2C3645",
content_background_color: "#1B2635",
header_color: "#d8a070",
text_color: "#b9b9ba",
text_muted_color: "#b9b9ba"
}
2020-01-22 16:53:06 +00:00
config :pleroma, Pleroma.Emails.NewUsersDigestEmail, enabled: false
config :pleroma, Pleroma.ScheduledActivity,
daily_user_limit: 25,
total_user_limit: 300,
enabled: true
2019-04-17 09:59:05 +00:00
config :pleroma, :email_notifications,
digest: %{
2019-06-06 22:22:35 +00:00
active: false,
2019-04-17 09:59:05 +00:00
interval: 7,
inactivity_threshold: 7
}
config :pleroma, :oauth2,
token_expires_in: 3600 * 24 * 365 * 100,
issue_new_refresh_token: true,
clean_expired_tokens: false
config :pleroma, :database, rum_enabled: false
config :pleroma, :features, improved_hashtag_timeline: :auto
config :pleroma, :populate_hashtags_table, fault_rate_allowance: 0.01
config :pleroma, :env, Mix.env()
config :http_signatures,
adapter: Pleroma.Signature
config :pleroma, :rate_limit,
authentication: {60_000, 15},
timeline: {500, 3},
search: [{1000, 10}, {1000, 30}],
app_account_creation: {1_800_000, 25},
relations_actions: {10_000, 10},
relation_id_action: {60_000, 2},
statuses_actions: {10_000, 15},
status_id_action: {60_000, 3},
password_reset: {1_800_000, 5},
account_confirmation_resend: {8_640_000, 5},
ap_routes: {60_000, 15}
2019-06-11 07:28:39 +00:00
config :pleroma, Pleroma.Workers.PurgeExpiredActivity, enabled: true, min_lifetime: 600
2019-06-11 07:28:39 +00:00
2020-06-24 06:30:32 +00:00
config :pleroma, Pleroma.Web.Plugs.RemoteIp,
enabled: true,
headers: ["x-forwarded-for"],
proxies: [],
reserved: [
"127.0.0.0/8",
"::1/128",
"fc00::/7",
"10.0.0.0/8",
"172.16.0.0/12",
"192.168.0.0/16"
]
2019-09-27 21:59:23 +00:00
2022-06-29 11:16:00 +00:00
config :pleroma, :static_fe, enabled: false
# Example of frontend configuration
# This example will make us serve the primary frontend from the
# frontends directory within your `:pleroma, :instance, static_dir`.
# e.g., instance/static/frontends/pleroma/develop/
#
# With no frontend configuration, the bundled files from the `static` directory will
# be used.
#
# config :pleroma, :frontends,
# primary: %{"name" => "pleroma-fe", "ref" => "develop"},
# admin: %{"name" => "admin-fe", "ref" => "stable"},
2022-06-29 11:12:48 +00:00
# mastodon: %{"enabled" => true, "name" => "mastodon-fe", "ref" => "develop"}
2020-07-30 12:14:58 +00:00
# available: %{...}
config :pleroma, :frontends,
primary: %{"name" => "pleroma-fe", "ref" => "stable"},
admin: %{"name" => "admin-fe", "ref" => "stable"},
mastodon: %{"name" => "mastodon-fe", "ref" => "akkoma"},
2023-03-12 23:24:07 +00:00
pickable: [
"pleroma-fe/stable"
],
swagger: %{
"name" => "swagger-ui",
"ref" => "stable",
"enabled" => false
},
2020-07-30 12:14:58 +00:00
available: %{
"pleroma-fe" => %{
"name" => "pleroma-fe",
2022-06-15 17:18:23 +00:00
"git" => "https://akkoma.dev/AkkomaGang/pleroma-fe",
"build_url" =>
"https://akkoma-updates.s3-website.fr-par.scw.cloud/frontend/${ref}/akkoma-fe.zip",
"ref" => "stable",
2022-06-15 17:18:23 +00:00
"build_dir" => "dist"
2020-07-30 12:14:58 +00:00
},
# Mastodon-Fe cannot be set as a primary - this is only here so we can update this seperately
2022-06-29 11:12:48 +00:00
"mastodon-fe" => %{
"name" => "mastodon-fe",
"git" => "https://akkoma.dev/AkkomaGang/masto-fe",
2022-07-21 10:29:28 +00:00
"build_url" =>
"https://akkoma-updates.s3-website.fr-par.scw.cloud/frontend/${ref}/masto-fe.zip",
2022-06-29 11:12:48 +00:00
"build_dir" => "distribution",
"ref" => "akkoma"
2020-07-30 12:14:58 +00:00
},
"fedibird-fe" => %{
"name" => "fedibird-fe",
"git" => "https://akkoma.dev/AkkomaGang/fedibird-fe",
"build_url" =>
"https://akkoma-updates.s3-website.fr-par.scw.cloud/frontend/${ref}/fedibird-fe.zip",
"build_dir" => "distribution",
"ref" => "akkoma"
},
2020-07-30 12:14:58 +00:00
"admin-fe" => %{
"name" => "admin-fe",
2022-06-29 11:12:48 +00:00
"git" => "https://akkoma.dev/AkkomaGang/admin-fe",
"build_url" =>
"https://akkoma-updates.s3-website.fr-par.scw.cloud/frontend/${ref}/admin-fe.zip",
"ref" => "stable"
2020-07-30 12:14:58 +00:00
},
# For developers - enables a swagger frontend to view the openapi spec
"swagger-ui" => %{
"name" => "swagger-ui",
"git" => "https://github.com/swagger-api/swagger-ui",
"build_url" => "https://akkoma-updates.s3-website.fr-par.scw.cloud/frontend/swagger-ui.zip",
"build_dir" => "dist",
"ref" => "stable"
2020-07-30 12:14:58 +00:00
}
}
2019-09-09 18:53:08 +00:00
config :pleroma, :web_cache_ttl,
activity_pub: nil,
activity_pub_question: 30_000
config :pleroma, :modules, runtime_dir: "instance/modules"
config :pleroma, configurable_from_database: false
config :pleroma, Pleroma.Repo,
parameters: [
gin_fuzzy_search_limit: "500",
plan_cache_mode: "force_custom_plan"
]
config :pleroma, :majic_pool, size: 2
2020-05-14 19:36:31 +00:00
private_instance? = :if_instance_is_private
2020-03-20 10:04:37 +00:00
config :pleroma, :restrict_unauthenticated,
2023-03-17 15:33:28 +00:00
timelines: %{local: private_instance?, federated: private_instance?, bubble: true},
profiles: %{local: private_instance?, remote: private_instance?},
activities: %{local: private_instance?, remote: private_instance?}
2020-03-20 10:04:37 +00:00
config :pleroma, Pleroma.Web.ApiSpec.CastAndValidate, strict: false
config :pleroma, :mrf,
2020-08-02 17:24:40 +00:00
policies: [Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy, Pleroma.Web.ActivityPub.MRF.TagPolicy],
transparency: true,
transparency_exclusions: [],
transparency_obfuscate_domains: []
config :ex_aws, http_client: Pleroma.HTTP.ExAws
2020-10-01 10:32:11 +00:00
config :web_push_encryption, http_client: Pleroma.HTTP.WebPush
config :pleroma, :instances_favicons, enabled: true
config :pleroma, :instances_nodeinfo, enabled: true
2020-02-10 21:29:25 +00:00
config :floki, :html_parser, Floki.HTMLParser.FastHtml
config :pleroma, Pleroma.Web.Auth.Authenticator, Pleroma.Web.Auth.PleromaAuthenticator
config :pleroma, Pleroma.User.Backup,
2020-09-04 14:30:39 +00:00
purge_after_days: 30,
2020-09-16 19:21:13 +00:00
limit_days: 7,
dir: nil
2020-09-04 14:30:39 +00:00
config :pleroma, ConcurrentLimiter, [
{Pleroma.Web.RichMedia.Helpers, [max_running: 5, max_waiting: 5]},
{Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy, [max_running: 5, max_waiting: 5]},
2021-10-28 21:38:00 +00:00
{Pleroma.Search, [max_running: 30, max_waiting: 50]}
]
config :pleroma, Pleroma.Web.WebFinger, domain: nil, update_nickname_on_user_fetch: true
config :pleroma, Pleroma.Search, module: Pleroma.Search.DatabaseSearch
2021-12-20 15:48:52 +00:00
config :pleroma, Pleroma.Search.Meilisearch,
url: "http://127.0.0.1:7700/",
private_key: nil,
initial_indexing_chunk_size: 100_000
2022-06-30 15:28:31 +00:00
config :pleroma, Pleroma.Search.Elasticsearch.Cluster,
url: "http://localhost:9200",
username: "elastic",
password: "changeme",
api: Elasticsearch.API.HTTP,
json_library: Jason,
indexes: %{
activities: %{
settings: "priv/es-mappings/activity.json",
store: Pleroma.Search.Elasticsearch.Store,
sources: [Pleroma.Activity],
bulk_page_size: 1000,
2022-06-30 15:28:31 +00:00
bulk_wait_interval: 15_000
}
}
config :pleroma, :translator,
enabled: false,
2022-08-29 21:20:47 +00:00
module: Pleroma.Akkoma.Translators.DeepL
config :pleroma, :deepl,
# either :free or :pro
tier: :free,
api_key: ""
config :pleroma, :libre_translate,
url: "http://127.0.0.1:5000",
api_key: nil
config :pleroma, :argos_translate,
command_argos_translate: "argos-translate",
command_argospm: "argospm",
strip_html: true
2017-03-17 16:09:58 +00:00
# Import environment specific config. This must remain at the bottom
# of this file so it overrides the configuration defined above.
2018-03-30 13:01:53 +00:00
import_config "#{Mix.env()}.exs"