hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

lemmy: lemmy.hacktivism.ch behind Caddy :9026

Browse source
This commit is contained in:
Hernâni Marques 2026-08-17 13:53:59 +02:00
parent 0ab4b08aac
commit 66dbf417f8
No known key found for this signature in database
GPG key ID: CB5738652768F7E9
18 changed files with 327 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

19
configs/caddy/Caddyfile
View file

@ -1,7 +1,7 @@
# Internal only (not in the browser URL):
# 9010 merchant API | 9011 exchange API | 9012 bank API
# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9200 forgejo-ssh
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9200 forgejo-ssh
# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
{
@ -300,7 +300,22 @@ paivana.hacktivism.ch {
}
}
http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch {
# 9026 lemmy (+ ui/pictrs via internal nginx)
lemmy.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9026 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch {
handle /.well-known/acme-challenge/* {
root * /var/www/acme
file_server

2
configs/lemmy/.env.example Normal file
View file

@ -0,0 +1,2 @@
LEMMY_HOSTNAME=lemmy.hacktivism.ch
POSTGRES_PASSWORD=@inline-secret@

18
configs/lemmy/README.md Normal file
View file

@ -0,0 +1,18 @@
# Lemmy — lemmy.hacktivism.ch
| Item | Value |
|------|--------|
| Live | `/home/hernani/koopa-lemmy/` |
| Compose | `compose.yml` (mirror, no secrets) |
| Port | **9026** → Caddy |
| Site | https://lemmy.hacktivism.ch/ |
| Images | `dessalines/lemmy:0.19.20` + `lemmy-ui:0.19.20` |
Secrets: host `~/koopa-lemmy/{.env,lemmy.hjson}` (mode 600). Not in this repo.
```bash
cd ~/koopa-lemmy && set -a && source .env && set +a && podman-compose up -d
scripts/lemmy/install-systemd.sh
```
Daylog: `2026/2026-08-17--lemmy.md`.

109
configs/lemmy/compose.yml Normal file
View file

@ -0,0 +1,109 @@
# koopa-lemmy — Lemmy behind host Caddy on :9026
# Docs: https://join-lemmy.org/docs/administration/install_docker.html
# Images pinned from LemmyNet compose 0.19.20. No secrets in this file.
x-logging: &default-logging
driver: "json-file"
options:
max-size: "50m"
max-file: "4"
services:
proxy:
image: docker.io/library/nginx:1-alpine
container_name: koopa-lemmy-proxy
ports:
- "9026:8536"
volumes:
- ./nginx_internal.conf:/etc/nginx/nginx.conf:ro
- ./proxy_params:/etc/nginx/proxy_params:ro
restart: unless-stopped
logging: *default-logging
depends_on:
- pictrs
- lemmy-ui
labels:
org.hacktivism.service: lemmy
org.hacktivism.host_port: "9026"
org.hacktivism.site: lemmy.hacktivism.ch
org.hacktivism.managed_by: koopa-admin
lemmy:
image: docker.io/dessalines/lemmy:0.19.20
container_name: koopa-lemmy
hostname: lemmy
restart: unless-stopped
logging: *default-logging
environment:
- RUST_LOG=warn
volumes:
- ./lemmy.hjson:/config/config.hjson:ro
depends_on:
postgres:
condition: service_healthy
pictrs:
condition: service_started
labels:
org.hacktivism.service: lemmy
org.hacktivism.managed_by: koopa-admin
lemmy-ui:
image: docker.io/dessalines/lemmy-ui:0.19.20
container_name: koopa-lemmy-ui
environment:
- LEMMY_UI_LEMMY_INTERNAL_HOST=lemmy:8536
- LEMMY_UI_LEMMY_EXTERNAL_HOST=${LEMMY_HOSTNAME}
- LEMMY_UI_HTTPS=true
depends_on:
- lemmy
restart: unless-stopped
logging: *default-logging
labels:
org.hacktivism.service: lemmy
org.hacktivism.managed_by: koopa-admin
pictrs:
image: docker.io/asonix/pictrs:0.5.24
container_name: koopa-lemmy-pictrs
hostname: pictrs
environment:
- PICTRS__SERVER__API_KEY=${POSTGRES_PASSWORD}
- RUST_BACKTRACE=full
- PICTRS__MEDIA__VIDEO__VIDEO_CODEC=vp9
- PICTRS__MEDIA__ANIMATION__MAX_WIDTH=256
- PICTRS__MEDIA__ANIMATION__MAX_HEIGHT=256
- PICTRS__MEDIA__ANIMATION__MAX_FRAME_COUNT=400
user: "991:991"
volumes:
- lemmy-pictrs:/mnt
restart: unless-stopped
logging: *default-logging
labels:
org.hacktivism.service: lemmy
org.hacktivism.managed_by: koopa-admin
postgres:
image: docker.io/library/postgres:16-alpine
container_name: koopa-lemmy-db
hostname: postgres
environment:
- POSTGRES_USER=lemmy
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
- POSTGRES_DB=lemmy
volumes:
- lemmy-db:/var/lib/postgresql/data
restart: unless-stopped
logging: *default-logging
healthcheck:
test: ["CMD-SHELL", "pg_isready -U lemmy -d lemmy"]
interval: 5s
timeout: 5s
retries: 12
labels:
org.hacktivism.service: lemmy
org.hacktivism.managed_by: koopa-admin
volumes:
lemmy-db:
lemmy-pictrs:

21
configs/lemmy/container-koopa-lemmy-db.service Normal file
View file

@ -0,0 +1,21 @@
# user systemd — Lemmy postgres
[Unit]
Description=Lemmy postgres (koopa-lemmy-db)
Wants=network-online.target
After=network-online.target
RequiresMountsFor=%t/containers
[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=on-failure
RestartSec=20
TimeoutStartSec=300
TimeoutStopSec=120
WorkingDirectory=/home/hernani/koopa-lemmy
ExecStart=/usr/bin/podman-compose up -d postgres
ExecStop=/usr/bin/podman stop -t 30 koopa-lemmy-db
Type=oneshot
RemainAfterExit=yes
[Install]
WantedBy=default.target

21
configs/lemmy/container-koopa-lemmy.service Normal file
View file

@ -0,0 +1,21 @@
# user systemd — Lemmy stack (proxy + app + ui + pictrs)
[Unit]
Description=Lemmy stack (koopa-lemmy)
Wants=network-online.target container-koopa-lemmy-db.service
After=network-online.target container-koopa-lemmy-db.service
RequiresMountsFor=%t/containers
[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=on-failure
RestartSec=20
TimeoutStartSec=300
TimeoutStopSec=120
WorkingDirectory=/home/hernani/koopa-lemmy
ExecStart=/bin/bash -lc 'set -a && source .env && set +a && /usr/bin/podman-compose up -d'
ExecStop=/usr/bin/podman stop -t 30 koopa-lemmy-proxy koopa-lemmy koopa-lemmy-ui koopa-lemmy-pictrs
Type=oneshot
RemainAfterExit=yes
[Install]
WantedBy=default.target

11
configs/lemmy/lemmy.hjson.example Normal file
View file

@ -0,0 +1,11 @@
{
database: {
host: postgres
password: "@inline-secret@"
}
hostname: "lemmy.hacktivism.ch"
pictrs: {
url: "http://pictrs:8080/"
api_key: "@inline-secret@"
}
}

44
configs/lemmy/nginx_internal.conf Normal file
View file

@ -0,0 +1,44 @@
worker_processes auto;
events {
worker_connections 1024;
}
http {
# Podman default network DNS (not Docker 127.0.0.11).
resolver 10.89.0.1 valid=5s;
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.16.0.0/12;
set_real_ip_from 192.168.0.0/16;
map "$request_method:$http_accept" $proxpass {
default "http://lemmy-ui:1234";
"~^(?:GET|HEAD):.*?application\/(?:activity|ld)\+json" "http://lemmy:8536";
"~^(?!(GET|HEAD)).*:" "http://lemmy:8536";
}
server {
set $lemmy_ui "lemmy-ui:1234";
set $lemmy "lemmy:8536";
listen 8536;
server_name localhost;
server_tokens off;
client_max_body_size 20M;
include proxy_params;
location / {
proxy_pass $proxpass;
rewrite ^(.+)/+$ $1 permanent;
}
location = /.well-known/security.txt {
proxy_pass "http://$lemmy_ui";
}
location ~ ^/(api|pictrs|feeds|nodeinfo|.well-known|version|sitemap.xml) {
proxy_pass "http://$lemmy";
include proxy_params;
}
}
}

6
configs/lemmy/proxy_params Normal file
View file

@ -0,0 +1,6 @@
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

3
configs/ports.md
View file

@ -17,12 +17,13 @@
| 9023 | podman qBittorrent → Caddy `bt.hacktivism.ch` |
| **9024** | podman **`koopa-forgejo`** (HTTP) → Caddy **`git.hacktivism.ch`** |
| **9025** | podman **`koopa-paivana`** (paivana-httpd) → Caddy **`paivana.hacktivism.ch`** |
| **9026** | podman **`koopa-lemmy-proxy`** → Caddy **`lemmy.hacktivism.ch`** |
| **9200** | podman **Forgejo git-SSH** (host-direct; not Caddy) |
| 9090–9092 | podman `koopa-tops-ng1` … `ng3` → Caddy `tops.ng{1,2,3}.hacktivism.ch` |
| 8080 | Tor ORPort |
VeciGate: WAN **80→9000**, WAN **443→9001**.
Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9025, 9090–9092}.
Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9026, 9090–9092}.
Git SSH needs separate NAT/firewall **9200/tcp** if exposed to WAN.
| **1789** | podman **`koopa-nym`** mixnet (nym.com nym-node) |