[mass update] fix supporting multiple domains while enforcing ssl

Re: coop-cloud/recipes-catalogue-json#4

.drone.yml

@@ -0,0 +1,43 @@
+---
+kind: pipeline
+name: deploy to swarm-test.autonomic.zone
+steps:
+  - name: deployment
+    image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
+    settings:
+      host: swarm-test.autonomic.zone
+      stack: lemmy
+      generate_secrets: true
+      purge: true
+      networks:
+        - proxy
+      deploy_key:
+        from_secret: drone_ssh_swarm_test
+    environment:
+      DOMAIN: lemmy.swarm-test.autonomic.zone
+      STACK_NAME: lemmy
+      LETS_ENCRYPT_ENV: production
+      SECRET_POSTGRES_PASSWORD_VERSION: v1
+      SECRET_ADMIN_PASSWORD_VERSION: v1
+      NGINX_CONF_VERSION: v1
+      ENTRYPOINT_APP_VERSION: v1
+      CONFIG_HJSON_VERSION: v1
+trigger:
+  branch:
+    - main
+# ---
+# kind: pipeline
+name: generate recipe catalogue
+steps:
+  - name: release a new version
+    image: plugins/downstream
+    settings:
+      server: https://build.coopcloud.tech
+      token:
+        from_secret: drone_abra-bot_token
+      fork: true
+      repositories:
+        - toolshed/auto-recipes-catalogue-json
+
+trigger:
+  event: tag

.env.sample

@@ -13,3 +13,5 @@ SECRET_POSTGRES_PASSWORD_VERSION=v1
 SITE_NAME=LemmyCloud
 
 SLUR_FILTER='(fag(g|got|tard)?\b|cock\s?sucker(s|ing)?|ni((g{2,}|q)+|[gq]{2,})[e3r]+(s|z)?|mudslime?s?|kikes?|\bspi(c|k)s?\b|\bchinks?|gooks?|bitch(es|ing|y)?|whor(es?|ing)|\btr(a|@)nn?(y|ies?)|\b(b|re|r)tard(ed)?s?)'
+
+FEDERATION_ENABLED=true

README.md

@@ -1,16 +1,16 @@
 # lemmy
 
-> One line description of the recipe
+> A federated link aggregator in Rust
 
 <!-- metadata -->
 
 * **Category**: Apps
-* **Status**: 0
+* **Status**: 1, alpha
 * **Image**: [`lemmy`](https://hub.docker.com/r/dessalines/lemmy) etc., 4, upstream
 * **Healthcheck**: Yes
 * **Backups**: No
 * **Email**: No
-* **Tests**: No
+* **Tests**: 2
 * **SSO**: No
 
 <!-- endmetadata -->

abra.sh

@@ -1,3 +1,3 @@
 export NGINX_CONF_VERSION=v5
-export ENTRYPOINT_APP_VERSION=v2
+export ENTRYPOINT_APP_VERSION=v3
 export CONFIG_HJSON_VERSION=v4

compose.yml

@@ -3,7 +3,8 @@ version: "3.8"
 
 services:
   app:
-    image: dessalines/lemmy:0.16.1
+    user: 0:0
+    image: dessalines/lemmy:0.18.3
     environment:
       - RUST_LOG="warn,lemmy_server=info,lemmy_api=info,lemmy_api_common=info,lemmy_api_crud=info,lemmy_apub=info,lemmy_db_schema=info,lemmy_db_views=info,lemmy_db_views_actor=info,lemmy_db_views_moderator=info,lemmy_routes=info,lemmy_utils=info,lemmy_websocket=info"
       - DOMAIN
@@ -11,6 +12,7 @@ services:
       - ADMIN_USERNAME
       - SITE_NAME
       - SLUR_FILTER
+      - FEDERATION_ENABLED
     volumes:
       - lemmy_config:/config/
     secrets:
@@ -33,19 +35,19 @@ services:
       restart_policy:
         condition: on-failure
       labels:
-        - "coop-cloud.${STACK_NAME}.version=0.1.0+0.16.1"
+        - "coop-cloud.${STACK_NAME}.version=0.2.0+0.18.3"
     healthcheck:
       test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8536/api/v3/site"]
       interval: 30s
       timeout: 10s
       retries: 10
-      start_period: 1m
+      start_period: 5m
 
   ui:
-    image: dessalines/lemmy-ui:0.16.1
+    image: dessalines/lemmy-ui:0.18.3
     environment:
-      - "LEMMY_INTERNAL_HOST=${STACK_NAME}_app:8536"
-      - "LEMMY_EXTERNAL_HOST=${DOMAIN}"
+      - "LEMMY_UI_LEMMY_INTERNAL_HOST=${STACK_NAME}_app:8536"
+      - "LEMMY_UI_LEMMY_EXTERNAL_HOST=${DOMAIN}"
       # - LEMMY_HTTPS=true
     networks:
       - backend
@@ -59,7 +61,7 @@ services:
       start_period: 1m
 
   db:
-    image: postgres:12-alpine
+    image: postgres:15-alpine
     environment:
       - POSTGRES_USER=lemmy
       - POSTGRES_DB=lemmy
@@ -73,7 +75,7 @@ services:
 
 
   pictrs:
-    image: asonix/pictrs:0.3.0-beta.12-r1
+    image: asonix/pictrs:0.4.0-beta.19
     user: 991:991
     networks:
       - backend
@@ -104,8 +106,8 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         # Redirect from EXTRA_DOMAINS to DOMAIN
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect"
-        - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLForceHost=true"
-        - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
+        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.scheme=https"
+        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.permanent=true"
 
 volumes:
   lemmy_config:

config.hjson.tmpl

@@ -53,4 +53,13 @@
 #    # whether or not smtp connections should use tls
 #    use_tls: true
 #  }
+
+  # Settings related to activitypub federation
+  federation: {
+    enabled: {{ env "FEDERATION_ENABLED" }}
+    strict_allowlist: false
+    http_fetch_retry_limit: 25
+    worker_count: 64
+    debug: false
+  }
 }

entrypoint.sh

@@ -5,4 +5,4 @@ if [ ! -f /config/config.hjson ]; then
 fi
 
 # https://github.com/LemmyNet/lemmy/blob/main/docker/prod/Dockerfile
-/app/lemmy
+su lemmy -s /bin/sh -c /app/lemmy