Add post on hosting masto
This commit is contained in:
parent
0154015497
commit
73201e8164
1 changed files with 206 additions and 0 deletions
206
content/posts/2023/01/mastodon-nixos.md
Normal file
206
content/posts/2023/01/mastodon-nixos.md
Normal file
|
|
@ -0,0 +1,206 @@
|
||||||
|
---
|
||||||
|
title: Containerised Mastodon server on NixOS
|
||||||
|
date: 2023-01-15
|
||||||
|
tags: [nix, fediverse]
|
||||||
|
---
|
||||||
|
|
||||||
|
I've been on the fediverse on and off since [friendi.ca](https://friendi.ca/) started to be a thing.
|
||||||
|
I remember hosting an instance at ponk.pink that suddenly got popular and the server melted away while I was apologising to the users.
|
||||||
|
I can see someone bought the domain to host some psychedelic My Little Pony stuff, I'm all for that.
|
||||||
|
|
||||||
|
I moved to [todon.nl](https://todon.nl/) when it got started and was quite happy there - check it out if you're looking for an instance !
|
||||||
|
The itch was there though, what if I host my own small cozy place on the fediverse myself.
|
||||||
|
I knew I didn't have as much time to do server admin, so I decided to start small, with a single user instance an use the power of NixOS to help with maintenance.
|
||||||
|
|
||||||
|
Here is my full config - hosting Mastodon under the apex domain of [peninsula.industries](https://peninsula.industries/), Mastodon is running inside a systemd container and the config is using nix-sops to store the secrets.
|
||||||
|
Few things that were unexpected/of note
|
||||||
|
- I needed to create the folder structure with correct permissions so that Mastodon starts normally.
|
||||||
|
- I'm decrypting secrets on the host and making them available read-only to the container. Not sure if this is better or worse than having sops inside of the container, but I was having some trouble using sops module from there, so left it as it is for now - something to look into in the future
|
||||||
|
- I needed to change the postgres port that is running inside of the Mastodon container because I had another postgres on this host already.
|
||||||
|
- If you're gonna be playing with this a lot, you might need to remove the container and its data and start from scratch - you can do so by doing:
|
||||||
|
- remove the container definition and `nixos-rebuild switch`
|
||||||
|
- rm -fr /var/lib/nixos-containers/mastodon/ *
|
||||||
|
- to use Mastodon CLI you need to be running it as a correct user and within the Nix-changed env:
|
||||||
|
```bash
|
||||||
|
nixos-container root-login mastodon
|
||||||
|
sudo -u mastodon bash
|
||||||
|
cd
|
||||||
|
source mastodon-env
|
||||||
|
RAILS_ENV=production tootctl
|
||||||
|
```
|
||||||
|
- The below can use some refactoring, there is some weird repetition in some places still
|
||||||
|
- You can find the newest version of this and see how it's being used in context on my [code hosting site](https://git.cyplo.dev/cyplo/dotfiles/src/branch/main/nixos/boxes/vpsfree1/mastodon.nix).
|
||||||
|
```nix
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
inputs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
domain = "peninsula.industries";
|
||||||
|
streamingPort = 55000;
|
||||||
|
webPort = 55001;
|
||||||
|
postgresPort = 5433;
|
||||||
|
path = "/var/lib/mastodon/";
|
||||||
|
mailgunSmtpSecretName = "mastodon-mailgun-smtp-password";
|
||||||
|
mailgunSmtpPasswordPath = "/run/secrets/${mailgunSmtpSecretName}";
|
||||||
|
mastodonDbSecretName = "mastodon-db";
|
||||||
|
mastodonDbSecretPath = "/run/secrets/${mastodonDbSecretName}";
|
||||||
|
uid = 2049;
|
||||||
|
gid = 3049;
|
||||||
|
systemUserName = "mastodon";
|
||||||
|
systemGroupName = "mastodon";
|
||||||
|
users = {
|
||||||
|
users."${systemUserName}" = {
|
||||||
|
inherit uid;
|
||||||
|
isSystemUser = true;
|
||||||
|
isNormalUser = false;
|
||||||
|
group = systemGroupName;
|
||||||
|
};
|
||||||
|
groups."${systemGroupName}" = {
|
||||||
|
inherit gid;
|
||||||
|
members = ["${systemUserName}" "nginx"];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
secretSettings = {
|
||||||
|
owner = systemUserName;
|
||||||
|
group = systemGroupName;
|
||||||
|
};
|
||||||
|
publicPath = "${path}/public-system/";
|
||||||
|
package =
|
||||||
|
inputs.nixpkgs-nixos-unstable.legacyPackages."${pkgs.system}".mastodon;
|
||||||
|
in {
|
||||||
|
imports = [../nginx.nix];
|
||||||
|
|
||||||
|
services.nginx = {
|
||||||
|
virtualHosts = {
|
||||||
|
"${domain}" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
root = "${package}/public/";
|
||||||
|
|
||||||
|
locations."/" = {tryFiles = "$uri @proxy";};
|
||||||
|
locations."/system/".alias = "${publicPath}";
|
||||||
|
|
||||||
|
locations."@proxy" = {
|
||||||
|
proxyPass = "http://127.0.0.1:" + toString webPort;
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
locations."/api/v1/streaming/" = {
|
||||||
|
proxyPass = "http://127.0.0.1:" + toString streamingPort;
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
sops.secrets."${mailgunSmtpSecretName}" =
|
||||||
|
{
|
||||||
|
sopsFile = ./mailgun.sops.yaml;
|
||||||
|
path = mailgunSmtpPasswordPath;
|
||||||
|
}
|
||||||
|
// secretSettings;
|
||||||
|
sops.secrets."${mastodonDbSecretName}" =
|
||||||
|
{
|
||||||
|
sopsFile = ./mastodon-db.sops.yaml;
|
||||||
|
path = mastodonDbSecretPath;
|
||||||
|
}
|
||||||
|
// secretSettings;
|
||||||
|
|
||||||
|
inherit users;
|
||||||
|
|
||||||
|
systemd.services.mastodon-make-path = {
|
||||||
|
script = ''
|
||||||
|
mkdir -p ${path}
|
||||||
|
chown -R ${systemUserName}:${systemGroupName} ${path}
|
||||||
|
mkdir -p ${publicPath}
|
||||||
|
chmod -R o-rwx ${publicPath}
|
||||||
|
chmod -R g-rwx ${publicPath}
|
||||||
|
chmod -R g+X ${publicPath}
|
||||||
|
chmod -R g+r ${publicPath}
|
||||||
|
chmod -R u+rwX ${publicPath}
|
||||||
|
'';
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
ProtectSystem = "strict";
|
||||||
|
ReadWritePaths = path;
|
||||||
|
};
|
||||||
|
before = ["container@mastodon.service"];
|
||||||
|
};
|
||||||
|
|
||||||
|
containers.mastodon = {
|
||||||
|
autoStart = true;
|
||||||
|
forwardPorts = [
|
||||||
|
{
|
||||||
|
containerPort = streamingPort;
|
||||||
|
hostPort = streamingPort;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
containerPort = webPort;
|
||||||
|
hostPort = webPort;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
bindMounts = {
|
||||||
|
"${path}" = {
|
||||||
|
hostPath = "${path}";
|
||||||
|
isReadOnly = false;
|
||||||
|
};
|
||||||
|
"${mailgunSmtpPasswordPath}" = {
|
||||||
|
hostPath = "${mailgunSmtpPasswordPath}";
|
||||||
|
isReadOnly = true;
|
||||||
|
};
|
||||||
|
"${mastodonDbSecretPath}" = {
|
||||||
|
hostPath = "${mastodonDbSecretPath}";
|
||||||
|
isReadOnly = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
config = {
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
system.stateVersion = "22.05";
|
||||||
|
services.postgresql.port = postgresPort;
|
||||||
|
users =
|
||||||
|
users
|
||||||
|
// {
|
||||||
|
mutableUsers = false;
|
||||||
|
allowNoPasswordLogin = true;
|
||||||
|
};
|
||||||
|
services.mastodon = {
|
||||||
|
enable = true;
|
||||||
|
inherit package;
|
||||||
|
localDomain = "${domain}";
|
||||||
|
user = systemUserName;
|
||||||
|
group = systemGroupName;
|
||||||
|
smtp = {
|
||||||
|
host = "smtp.eu.mailgun.org";
|
||||||
|
port = 465;
|
||||||
|
authenticate = true;
|
||||||
|
user = "postmaster@${domain}";
|
||||||
|
fromAddress = "Peninsula Industries Mastodon <mastodon@${domain}>";
|
||||||
|
createLocally = false;
|
||||||
|
passwordFile = "${mailgunSmtpPasswordPath}";
|
||||||
|
};
|
||||||
|
extraConfig = {
|
||||||
|
SMTP_TLS = "true";
|
||||||
|
SMTP_ENABLE_STARTTLS_AUTO = "true";
|
||||||
|
SINGLE_USER_MODE = "true";
|
||||||
|
RAILS_SERVE_STATIC_FILES = "true";
|
||||||
|
};
|
||||||
|
inherit streamingPort;
|
||||||
|
inherit webPort;
|
||||||
|
configureNginx = false;
|
||||||
|
enableUnixSocket = false;
|
||||||
|
database = {
|
||||||
|
port = postgresPort;
|
||||||
|
passwordFile = mastodonDbSecretPath;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
Loading…
Reference in a new issue