lemmy: lemmy.hacktivism.ch behind Caddy :9026

configs/lemmy/.env.example

@@ -0,0 +1,2 @@
+LEMMY_HOSTNAME=lemmy.hacktivism.ch
+POSTGRES_PASSWORD=@inline-secret@

configs/lemmy/README.md

@@ -0,0 +1,18 @@
+# Lemmy — lemmy.hacktivism.ch
+
+| Item | Value |
+|------|--------|
+| Live | `/home/hernani/koopa-lemmy/` |
+| Compose | `compose.yml` (mirror, no secrets) |
+| Port | **9026** → Caddy |
+| Site | https://lemmy.hacktivism.ch/ |
+| Images | `dessalines/lemmy:0.19.20` + `lemmy-ui:0.19.20` |
+
+Secrets: host `~/koopa-lemmy/{.env,lemmy.hjson}` (mode 600). Not in this repo.
+
+```bash
+cd ~/koopa-lemmy && set -a && source .env && set +a && podman-compose up -d
+scripts/lemmy/install-systemd.sh
+```
+
+Daylog: `2026/2026-08-17--lemmy.md`.

configs/lemmy/compose.yml

@@ -0,0 +1,109 @@
+# koopa-lemmy — Lemmy behind host Caddy on :9026
+# Docs: https://join-lemmy.org/docs/administration/install_docker.html
+# Images pinned from LemmyNet compose 0.19.20. No secrets in this file.
+
+x-logging: &default-logging
+  driver: "json-file"
+  options:
+    max-size: "50m"
+    max-file: "4"
+
+services:
+  proxy:
+    image: docker.io/library/nginx:1-alpine
+    container_name: koopa-lemmy-proxy
+    ports:
+      - "9026:8536"
+    volumes:
+      - ./nginx_internal.conf:/etc/nginx/nginx.conf:ro
+      - ./proxy_params:/etc/nginx/proxy_params:ro
+    restart: unless-stopped
+    logging: *default-logging
+    depends_on:
+      - pictrs
+      - lemmy-ui
+    labels:
+      org.hacktivism.service: lemmy
+      org.hacktivism.host_port: "9026"
+      org.hacktivism.site: lemmy.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+
+  lemmy:
+    image: docker.io/dessalines/lemmy:0.19.20
+    container_name: koopa-lemmy
+    hostname: lemmy
+    restart: unless-stopped
+    logging: *default-logging
+    environment:
+      - RUST_LOG=warn
+    volumes:
+      - ./lemmy.hjson:/config/config.hjson:ro
+    depends_on:
+      postgres:
+        condition: service_healthy
+      pictrs:
+        condition: service_started
+    labels:
+      org.hacktivism.service: lemmy
+      org.hacktivism.managed_by: koopa-admin
+
+  lemmy-ui:
+    image: docker.io/dessalines/lemmy-ui:0.19.20
+    container_name: koopa-lemmy-ui
+    environment:
+      - LEMMY_UI_LEMMY_INTERNAL_HOST=lemmy:8536
+      - LEMMY_UI_LEMMY_EXTERNAL_HOST=${LEMMY_HOSTNAME}
+      - LEMMY_UI_HTTPS=true
+    depends_on:
+      - lemmy
+    restart: unless-stopped
+    logging: *default-logging
+    labels:
+      org.hacktivism.service: lemmy
+      org.hacktivism.managed_by: koopa-admin
+
+  pictrs:
+    image: docker.io/asonix/pictrs:0.5.24
+    container_name: koopa-lemmy-pictrs
+    hostname: pictrs
+    environment:
+      - PICTRS__SERVER__API_KEY=${POSTGRES_PASSWORD}
+      - RUST_BACKTRACE=full
+      - PICTRS__MEDIA__VIDEO__VIDEO_CODEC=vp9
+      - PICTRS__MEDIA__ANIMATION__MAX_WIDTH=256
+      - PICTRS__MEDIA__ANIMATION__MAX_HEIGHT=256
+      - PICTRS__MEDIA__ANIMATION__MAX_FRAME_COUNT=400
+    user: "991:991"
+    volumes:
+      - lemmy-pictrs:/mnt
+    restart: unless-stopped
+    logging: *default-logging
+    labels:
+      org.hacktivism.service: lemmy
+      org.hacktivism.managed_by: koopa-admin
+
+  postgres:
+    image: docker.io/library/postgres:16-alpine
+    container_name: koopa-lemmy-db
+    hostname: postgres
+    environment:
+      - POSTGRES_USER=lemmy
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=lemmy
+    volumes:
+      - lemmy-db:/var/lib/postgresql/data
+    restart: unless-stopped
+    logging: *default-logging
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U lemmy -d lemmy"]
+      interval: 5s
+      timeout: 5s
+      retries: 12
+    labels:
+      org.hacktivism.service: lemmy
+      org.hacktivism.managed_by: koopa-admin
+
+volumes:
+  lemmy-db:
+  lemmy-pictrs:
+

configs/lemmy/container-koopa-lemmy-db.service

@@ -0,0 +1,21 @@
+# user systemd — Lemmy postgres
+[Unit]
+Description=Lemmy postgres (koopa-lemmy-db)
+Wants=network-online.target
+After=network-online.target
+RequiresMountsFor=%t/containers
+
+[Service]
+Environment=PODMAN_SYSTEMD_UNIT=%n
+Restart=on-failure
+RestartSec=20
+TimeoutStartSec=300
+TimeoutStopSec=120
+WorkingDirectory=/home/hernani/koopa-lemmy
+ExecStart=/usr/bin/podman-compose up -d postgres
+ExecStop=/usr/bin/podman stop -t 30 koopa-lemmy-db
+Type=oneshot
+RemainAfterExit=yes
+
+[Install]
+WantedBy=default.target

configs/lemmy/container-koopa-lemmy.service

@@ -0,0 +1,21 @@
+# user systemd — Lemmy stack (proxy + app + ui + pictrs)
+[Unit]
+Description=Lemmy stack (koopa-lemmy)
+Wants=network-online.target container-koopa-lemmy-db.service
+After=network-online.target container-koopa-lemmy-db.service
+RequiresMountsFor=%t/containers
+
+[Service]
+Environment=PODMAN_SYSTEMD_UNIT=%n
+Restart=on-failure
+RestartSec=20
+TimeoutStartSec=300
+TimeoutStopSec=120
+WorkingDirectory=/home/hernani/koopa-lemmy
+ExecStart=/bin/bash -lc 'set -a && source .env && set +a && /usr/bin/podman-compose up -d'
+ExecStop=/usr/bin/podman stop -t 30 koopa-lemmy-proxy koopa-lemmy koopa-lemmy-ui koopa-lemmy-pictrs
+Type=oneshot
+RemainAfterExit=yes
+
+[Install]
+WantedBy=default.target

configs/lemmy/lemmy.hjson.example

@@ -0,0 +1,11 @@
+{
+  database: {
+    host: postgres
+    password: "@inline-secret@"
+  }
+  hostname: "lemmy.hacktivism.ch"
+  pictrs: {
+    url: "http://pictrs:8080/"
+    api_key: "@inline-secret@"
+  }
+}

configs/lemmy/nginx_internal.conf

@@ -0,0 +1,44 @@
+worker_processes auto;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    # Podman default network DNS (not Docker 127.0.0.11).
+    resolver 10.89.0.1 valid=5s;
+
+    set_real_ip_from 10.0.0.0/8;
+    set_real_ip_from 172.16.0.0/12;
+    set_real_ip_from 192.168.0.0/16;
+
+    map "$request_method:$http_accept" $proxpass {
+        default "http://lemmy-ui:1234";
+        "~^(?:GET|HEAD):.*?application\/(?:activity|ld)\+json" "http://lemmy:8536";
+        "~^(?!(GET|HEAD)).*:" "http://lemmy:8536";
+    }
+
+    server {
+        set $lemmy_ui "lemmy-ui:1234";
+        set $lemmy "lemmy:8536";
+        listen 8536;
+        server_name localhost;
+        server_tokens off;
+        client_max_body_size 20M;
+        include proxy_params;
+
+        location / {
+            proxy_pass $proxpass;
+            rewrite ^(.+)/+$ $1 permanent;
+        }
+
+        location = /.well-known/security.txt {
+            proxy_pass "http://$lemmy_ui";
+        }
+
+        location ~ ^/(api|pictrs|feeds|nodeinfo|.well-known|version|sitemap.xml) {
+            proxy_pass "http://$lemmy";
+            include proxy_params;
+        }
+    }
+}

configs/lemmy/proxy_params

@@ -0,0 +1,6 @@
+proxy_set_header Host $http_host;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_http_version 1.1;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection "upgrade";