15791 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
floatingghost	09fa7227f6	Merge pull request 'Tweak fetch security checks' (#819) from Oneric/akkoma:id-refetch into develop ... Reviewed-on: #819	2024-10-16 14:16:14 +00:00
Oneric	d5b0720596	Allow cross-domain redirects on AP requests ... Since we now remember the final location redirects lead to and use it for all further checks since 3e134b07fa, these redirects can no longer be exploited to serve counterfeit objects. This fixes: - display URLs from independent webapp clients redirecting to the canonical domain - Peertube display URLs for remote content (acting like the above)	2024-10-14 01:42:51 +02:00
Oneric	940792f8ba	Refetch on AP ID mismatch ... As hinted at in the commit message when strict checking was added in 8684964c5d, refetching is more robust than display URL comparison but in exchange is harder to implement correctly. A similar refetch approach is also employed by e.g. Mastodon, IceShrimp and FireFish. To make sure no checks can be bypassed by forcing a refetch, id checking is placed at the very end. This will fix: - Peertube display URL arrays our transmogrifier fails to normalise - non-canonical display URLs from alternative frontends (theoretical; we didnt’t get any actual reports about this) It will also be helpful in the planned key handling overhaul. The modified user collision test was introduced in https://git.pleroma.social/pleroma/pleroma/-/merge_requests/461 and unfortunately the issues this fixes aren’t public. Afaict it was just meant to guard against someone serving faked data belonging to an unrelated domain. Since we now refetch and the id actually is mocked, lookup now succeeds but will use the real data from the authorative server making it unproblematic. Instead modify the fake data further and make sure we don’t end up using the spoofed version.	2024-10-14 01:42:43 +02:00
floatingghost	3c72b48a05	Merge pull request 'Fix busywait on docker-entrypoint script' (#832) from cevado/akkoma:fix-busy-wait-docker-entrypoint into develop ... Reviewed-on: #832	2024-09-24 23:52:07 +00:00
floatingghost	6475cf127e	Merge pull request 'Overhaul OpenRC service file and disable busy wait by default' (#834) from Oneric/akkoma:openrc-upd into develop ... Reviewed-on: #834	2024-09-24 23:50:48 +00:00
Oneric	a8a231c5b2	Don't busy wait in default from-source service files	2024-09-24 17:36:54 +02:00
Oneric	2901fda29c	openrc: recompile with lower CPU prio	2024-09-24 16:58:54 +02:00
Oneric	bd14440386	openrc: overhaul service file ... - pass env vars the proper™ way - write log to file - drop superfluous command_background - make settings easily overwritable via conf.d to avoid needing to edit the service file directly if e.g. Akkoma was installed to another location	2024-09-24 16:58:35 +02:00
cevado	b312edac4c	Fix busywait on docker-entrypoint script	2024-08-20 19:29:11 -03:00
floatingghost	3bb31117e6	Merge pull request 'Handle domain mutes on the backend' (#804) from domain-mute-backend-processing into develop ... Reviewed-on: #804	2024-08-20 10:32:47 +00:00
Floatingghost	2c5c531c35	readd comment about domain mutes	2024-08-20 11:05:36 +01:00
floatingghost	3ff0f46b9f	Merge pull request 'Docs: Improve backup restore + fix warnings' (#554) from ilja/akkoma:docs_db_create_in_separate_commands into develop ... Reviewed-on: #554	2024-06-25 21:33:42 +00:00
floatingghost	4f0cb61782	Merge pull request 'Move prune changelog entries to correct version' (#808) from norm/akkoma:prune-changelog into develop ... Reviewed-on: #808	2024-06-23 02:20:36 +00:00
floatingghost	5fdb5d69d2	Merge pull request 'Update Caddyfile' (#809) from norm/akkoma:caddyfile-update into develop ... Reviewed-on: #809	2024-06-23 02:20:24 +00:00
floatingghost	f66135ed08	Merge pull request 'Avoid accumulation of stale data in websockets' (#806) from Oneric/akkoma:websocket_fullsweep into develop ... Reviewed-on: #806 Reviewed-by: floatingghost <hannah@coffee-and-dreams.uk>	2024-06-23 02:19:36 +00:00
floatingghost	dc34328f15	Merge pull request 'Fix elixir 1.17 and migration lock warnings' (#810) from Oneric/akkoma:ex1.17-warnings into develop ... Reviewed-on: #810	2024-06-23 02:18:41 +00:00
Oneric	13e2a811ec	Avoid accumulation of stale data in websockets ... We’ve received reports of some specific instances slowly accumulating more and more binary data over time up to OOMs and globally setting ERL_FULLSWEEP_AFTER=0 has proven to be an effective countermeasure. However, this incurs increased cpu perf costs everywhere and is thus not suitable to apply out of the box. Apparently long-lived Phoenix websocket processes are known to often cause exactly this by getting into a state unfavourable for the garbage collector. Therefore it seems likely affected instances are using timeline streaming and do so in just the right way to trigger this. We can tune the garbage collector just for websocket processes and use a more lenient value of 20 to keep the added perf cost in check. Testing on one affected instance appears to confirm this theory Ref.: https://www.erlang.org/doc/man/erlang#ghlink-process_flag-2-idp226 https://blog.guzman.codes/using-phoenix-channels-high-memory-usage-save-money-with-erlfullsweepafter https://git.pleroma.social/pleroma/pleroma/-/merge_requests/4060 Tested-by: bjo	2024-06-22 22:22:33 +02:00
Oneric	1a4238bf98	cosmetic: fix concurrent index creation warnings ... Since those old migrations will now most likely only run during db init, there’s not much point in running them in the background concurrently anyway, so just drop the cncurrent setting rather than disabling migration locks.	2024-06-19 02:25:23 +02:00
Oneric	c3069b9478	cosmetic: fix elixir 1.17 compiler warnings in main application	2024-06-19 01:49:59 +02:00
Norm	51f09531c4	Disable gzip compression in Caddyfile ... Currently Akkoma doesn't have any proper mitigations against BREACH, which exploits the use of HTTP compression to exfiltrate sensitive data. (see: #721 (comment)) To err on the side of caution, disable gzip compression for now until we can confirm that there's some sort of mitigation in place (whether that would be Heal-The-Breach on the Caddy side or any Akkoma-side mitigations).	2024-06-17 23:13:55 -04:00
Norm	962847fdc3	Uncomment media subdomain settings in Caddyfile ... Now that a media subdomain is strongly recommended for security reasons, there is no reason for them to be commented out by default.	2024-06-17 23:12:55 -04:00
Norm	83aab0859a	Move prune changelog entries to correct version	2024-06-17 22:41:40 -04:00
Weblate	eb2b0d26e4	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	91870590ec	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	c442877c25	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	16af0bad55	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	16ee6ed500	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	babf5df0e7	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	5767f59294	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	72ce0b7759	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	0cf9b44179	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	3cf335c4d0	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	1556e2be8e	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	629077dce4	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	50256af6f6	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	c5d36d9679	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	fb4c5b97c7	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	a715cf4b3c	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:04 +00:00
Weblate	693a6486da	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:03 +00:00
Weblate	4e353f0335	Update translation files ... Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/ Translation: Pleroma fe/Akkoma Backend (Config Descriptions)	2024-06-17 21:53:03 +00:00
floatingghost	5992e8bb16	Merge pull request 'Update http-signatures dep, allow created header' (#800) from created-pseudoheader into develop ... Reviewed-on: #800	2024-06-17 21:52:59 +00:00
Floatingghost	57273754b7	we may as well handle (expires) as well	2024-06-17 22:30:14 +01:00
floatingghost	59bfdf2ca4	Merge pull request 'Add limit CLI flags to prune jobs' (#655) from Oneric/akkoma:prune-batch into develop ... Reviewed-on: #655	2024-06-17 20:47:53 +00:00
floatingghost	a9e2e31e3b	Merge pull request 'Remove proxy_remote vestiges' (#805) from Oneric/akkoma:purge_proxy_remote into develop ... Reviewed-on: #805	2024-06-17 20:47:11 +00:00
Oneric	bf8f493ffd	Remove proxy_remote vestiges ... Ever since 364b6969eb this setting wasn't used by the backend and a noop. The stated usecase is better served by setting the base_url to a local subdomain and using proxying in nginx/Caddy/...	2024-06-16 01:21:52 +02:00
Floatingghost	3b197503d2	me me stupid person	2024-06-15 15:30:02 +01:00
Floatingghost	c0b2bba55e	revert subdomain change until i can look at why i did that	2024-06-15 15:14:42 +01:00
Floatingghost	4b765b1886	mix format	2024-06-15 15:06:28 +01:00
Floatingghost	cba2c5725f	Filter emoji reaction accounts by domain blocks	2024-06-15 15:05:52 +01:00
Floatingghost	2b96c3b224	Update http-signatures dep, allow created header	2024-06-12 18:40:44 +01:00