lemmy: lemmy.hacktivism.ch behind Caddy :9026

2026/2026-07-16--container-autostart.md

@@ -19,6 +19,7 @@
 | `koopa-tor-relay`, `koopa-nym` |
 | `koopa-bonfire`, `koopa-bonfire-db` |
 | `koopa-castopod`, `koopa-castopod-mariadb`, `koopa-castopod-redis` |
+| `koopa-lemmy-proxy`, `koopa-lemmy`, `koopa-lemmy-ui`, `koopa-lemmy-pictrs`, `koopa-lemmy-db` |
 | `koopa-paivana`, `koopa-paivana-upstream` |
 | `koopa-tops-ng1` … `ng3` (+ `container-koopa-tops.service` ensure) |
 

2026/2026-08-17--lemmy.md

@@ -0,0 +1,13 @@
+# Lemmy — lemmy.hacktivism.ch (2026-08-17)
+
+Site: **https://lemmy.hacktivism.ch/**  
+Port **9026** → Caddy. Stack: `koopa-lemmy-proxy` (nginx) + `koopa-lemmy` + `koopa-lemmy-ui` + `koopa-lemmy-pictrs` + `koopa-lemmy-db`.
+
+Live: `~/koopa-lemmy/` (compose mirror `configs/lemmy/`). Secrets only on host (`.env`, `lemmy.hjson`).
+
+Instance name **hacktivism**. Example community `souveraenitaet`, post: https://lemmy.hacktivism.ch/post/1
+
+Admin user is on the host (`~/koopa-lemmy/users.env`), not in this repo.
+
+Caddy: `sudo /home/hernani/koopa-caddy/apply.sh` (already applied).  
+Boot: `scripts/lemmy/install-systemd.sh`.

SECRETS.md

@@ -18,6 +18,7 @@ Live passwords/keys live in sibling **`koopa-admin-secrets`**.
 | What | Mirror | Live |
 |------|--------|------|
 | Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` (+ compose mirror in admin-log `configs/castopod/`) | `~/koopa-castopod/` |
+| Lemmy | host-only `~/koopa-lemmy/{.env,lemmy.hjson}` (compose mirror in admin-log `configs/lemmy/`) | `~/koopa-lemmy/` |
 | Bonfire (`FEDERATE=true`) | `koopa/home-hernani/koopa-bonfire/{.env,users.env,compose.yml}` | `~/koopa-bonfire/` |
 | Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` |
 | Forgejo (**rootless**, git.hacktivism.ch) | `koopa/home-hernani/koopa-forgejo/{.env,users.env,compose.yml}` | `~/koopa-forgejo/` |

configs/caddy/Caddyfile

@@ -1,7 +1,7 @@
 # Internal only (not in the browser URL):
 # 9010 merchant API | 9011 exchange API | 9012 bank API
 # 9013 bank landing | 9014 exchange landing | 9015 merchant landing
-# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9200 forgejo-ssh
+# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9200 forgejo-ssh
 # 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
 
 {
@@ -300,7 +300,22 @@ paivana.hacktivism.ch {
     }
 }
 
-http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch {
+# 9026 lemmy (+ ui/pictrs via internal nginx)
+lemmy.hacktivism.ch {
+    header Alt-Svc "clear"
+    reverse_proxy 127.0.0.1:9026 {
+        header_up Host {host}
+        header_up X-Forwarded-For {remote_host}
+        header_up X-Forwarded-Proto {scheme}
+        flush_interval -1
+        transport http {
+            read_timeout 3600s
+            write_timeout 3600s
+        }
+    }
+}
+
+http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch {
     handle /.well-known/acme-challenge/* {
         root * /var/www/acme
         file_server

configs/lemmy/.env.example

@@ -0,0 +1,2 @@
+LEMMY_HOSTNAME=lemmy.hacktivism.ch
+POSTGRES_PASSWORD=@inline-secret@

configs/lemmy/README.md

@@ -0,0 +1,18 @@
+# Lemmy — lemmy.hacktivism.ch
+
+| Item | Value |
+|------|--------|
+| Live | `/home/hernani/koopa-lemmy/` |
+| Compose | `compose.yml` (mirror, no secrets) |
+| Port | **9026** → Caddy |
+| Site | https://lemmy.hacktivism.ch/ |
+| Images | `dessalines/lemmy:0.19.20` + `lemmy-ui:0.19.20` |
+
+Secrets: host `~/koopa-lemmy/{.env,lemmy.hjson}` (mode 600). Not in this repo.
+
+```bash
+cd ~/koopa-lemmy && set -a && source .env && set +a && podman-compose up -d
+scripts/lemmy/install-systemd.sh
+```
+
+Daylog: `2026/2026-08-17--lemmy.md`.

configs/lemmy/compose.yml

@@ -0,0 +1,109 @@
+# koopa-lemmy — Lemmy behind host Caddy on :9026
+# Docs: https://join-lemmy.org/docs/administration/install_docker.html
+# Images pinned from LemmyNet compose 0.19.20. No secrets in this file.
+
+x-logging: &default-logging
+  driver: "json-file"
+  options:
+    max-size: "50m"
+    max-file: "4"
+
+services:
+  proxy:
+    image: docker.io/library/nginx:1-alpine
+    container_name: koopa-lemmy-proxy
+    ports:
+      - "9026:8536"
+    volumes:
+      - ./nginx_internal.conf:/etc/nginx/nginx.conf:ro
+      - ./proxy_params:/etc/nginx/proxy_params:ro
+    restart: unless-stopped
+    logging: *default-logging
+    depends_on:
+      - pictrs
+      - lemmy-ui
+    labels:
+      org.hacktivism.service: lemmy
+      org.hacktivism.host_port: "9026"
+      org.hacktivism.site: lemmy.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+
+  lemmy:
+    image: docker.io/dessalines/lemmy:0.19.20
+    container_name: koopa-lemmy
+    hostname: lemmy
+    restart: unless-stopped
+    logging: *default-logging
+    environment:
+      - RUST_LOG=warn
+    volumes:
+      - ./lemmy.hjson:/config/config.hjson:ro
+    depends_on:
+      postgres:
+        condition: service_healthy
+      pictrs:
+        condition: service_started
+    labels:
+      org.hacktivism.service: lemmy
+      org.hacktivism.managed_by: koopa-admin
+
+  lemmy-ui:
+    image: docker.io/dessalines/lemmy-ui:0.19.20
+    container_name: koopa-lemmy-ui
+    environment:
+      - LEMMY_UI_LEMMY_INTERNAL_HOST=lemmy:8536
+      - LEMMY_UI_LEMMY_EXTERNAL_HOST=${LEMMY_HOSTNAME}
+      - LEMMY_UI_HTTPS=true
+    depends_on:
+      - lemmy
+    restart: unless-stopped
+    logging: *default-logging
+    labels:
+      org.hacktivism.service: lemmy
+      org.hacktivism.managed_by: koopa-admin
+
+  pictrs:
+    image: docker.io/asonix/pictrs:0.5.24
+    container_name: koopa-lemmy-pictrs
+    hostname: pictrs
+    environment:
+      - PICTRS__SERVER__API_KEY=${POSTGRES_PASSWORD}
+      - RUST_BACKTRACE=full
+      - PICTRS__MEDIA__VIDEO__VIDEO_CODEC=vp9
+      - PICTRS__MEDIA__ANIMATION__MAX_WIDTH=256
+      - PICTRS__MEDIA__ANIMATION__MAX_HEIGHT=256
+      - PICTRS__MEDIA__ANIMATION__MAX_FRAME_COUNT=400
+    user: "991:991"
+    volumes:
+      - lemmy-pictrs:/mnt
+    restart: unless-stopped
+    logging: *default-logging
+    labels:
+      org.hacktivism.service: lemmy
+      org.hacktivism.managed_by: koopa-admin
+
+  postgres:
+    image: docker.io/library/postgres:16-alpine
+    container_name: koopa-lemmy-db
+    hostname: postgres
+    environment:
+      - POSTGRES_USER=lemmy
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=lemmy
+    volumes:
+      - lemmy-db:/var/lib/postgresql/data
+    restart: unless-stopped
+    logging: *default-logging
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U lemmy -d lemmy"]
+      interval: 5s
+      timeout: 5s
+      retries: 12
+    labels:
+      org.hacktivism.service: lemmy
+      org.hacktivism.managed_by: koopa-admin
+
+volumes:
+  lemmy-db:
+  lemmy-pictrs:
+

configs/lemmy/container-koopa-lemmy-db.service

@@ -0,0 +1,21 @@
+# user systemd — Lemmy postgres
+[Unit]
+Description=Lemmy postgres (koopa-lemmy-db)
+Wants=network-online.target
+After=network-online.target
+RequiresMountsFor=%t/containers
+
+[Service]
+Environment=PODMAN_SYSTEMD_UNIT=%n
+Restart=on-failure
+RestartSec=20
+TimeoutStartSec=300
+TimeoutStopSec=120
+WorkingDirectory=/home/hernani/koopa-lemmy
+ExecStart=/usr/bin/podman-compose up -d postgres
+ExecStop=/usr/bin/podman stop -t 30 koopa-lemmy-db
+Type=oneshot
+RemainAfterExit=yes
+
+[Install]
+WantedBy=default.target

configs/lemmy/container-koopa-lemmy.service

@@ -0,0 +1,21 @@
+# user systemd — Lemmy stack (proxy + app + ui + pictrs)
+[Unit]
+Description=Lemmy stack (koopa-lemmy)
+Wants=network-online.target container-koopa-lemmy-db.service
+After=network-online.target container-koopa-lemmy-db.service
+RequiresMountsFor=%t/containers
+
+[Service]
+Environment=PODMAN_SYSTEMD_UNIT=%n
+Restart=on-failure
+RestartSec=20
+TimeoutStartSec=300
+TimeoutStopSec=120
+WorkingDirectory=/home/hernani/koopa-lemmy
+ExecStart=/bin/bash -lc 'set -a && source .env && set +a && /usr/bin/podman-compose up -d'
+ExecStop=/usr/bin/podman stop -t 30 koopa-lemmy-proxy koopa-lemmy koopa-lemmy-ui koopa-lemmy-pictrs
+Type=oneshot
+RemainAfterExit=yes
+
+[Install]
+WantedBy=default.target

configs/lemmy/lemmy.hjson.example

@@ -0,0 +1,11 @@
+{
+  database: {
+    host: postgres
+    password: "@inline-secret@"
+  }
+  hostname: "lemmy.hacktivism.ch"
+  pictrs: {
+    url: "http://pictrs:8080/"
+    api_key: "@inline-secret@"
+  }
+}

configs/lemmy/nginx_internal.conf

@@ -0,0 +1,44 @@
+worker_processes auto;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    # Podman default network DNS (not Docker 127.0.0.11).
+    resolver 10.89.0.1 valid=5s;
+
+    set_real_ip_from 10.0.0.0/8;
+    set_real_ip_from 172.16.0.0/12;
+    set_real_ip_from 192.168.0.0/16;
+
+    map "$request_method:$http_accept" $proxpass {
+        default "http://lemmy-ui:1234";
+        "~^(?:GET|HEAD):.*?application\/(?:activity|ld)\+json" "http://lemmy:8536";
+        "~^(?!(GET|HEAD)).*:" "http://lemmy:8536";
+    }
+
+    server {
+        set $lemmy_ui "lemmy-ui:1234";
+        set $lemmy "lemmy:8536";
+        listen 8536;
+        server_name localhost;
+        server_tokens off;
+        client_max_body_size 20M;
+        include proxy_params;
+
+        location / {
+            proxy_pass $proxpass;
+            rewrite ^(.+)/+$ $1 permanent;
+        }
+
+        location = /.well-known/security.txt {
+            proxy_pass "http://$lemmy_ui";
+        }
+
+        location ~ ^/(api|pictrs|feeds|nodeinfo|.well-known|version|sitemap.xml) {
+            proxy_pass "http://$lemmy";
+            include proxy_params;
+        }
+    }
+}

configs/lemmy/proxy_params

@@ -0,0 +1,6 @@
+proxy_set_header Host $http_host;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_http_version 1.1;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection "upgrade";

configs/ports.md

@@ -17,12 +17,13 @@
 | 9023 | podman qBittorrent → Caddy `bt.hacktivism.ch` |
 | **9024** | podman **`koopa-forgejo`** (HTTP) → Caddy **`git.hacktivism.ch`** |
 | **9025** | podman **`koopa-paivana`** (paivana-httpd) → Caddy **`paivana.hacktivism.ch`** |
+| **9026** | podman **`koopa-lemmy-proxy`** → Caddy **`lemmy.hacktivism.ch`** |
 | **9200** | podman **Forgejo git-SSH** (host-direct; not Caddy) |
 | 9090–9092 | podman `koopa-tops-ng1` … `ng3` → Caddy `tops.ng{1,2,3}.hacktivism.ch` |
 | 8080 | Tor ORPort |
 
 VeciGate: WAN **80→9000**, WAN **443→9001**.  
-Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9025, 9090–9092}.  
+Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9026, 9090–9092}.  
 Git SSH needs separate NAT/firewall **9200/tcp** if exposed to WAN.
 
 | **1789** | podman **`koopa-nym`** mixnet (nym.com nym-node) |

host/overview/LIVE.md

@@ -35,6 +35,7 @@ ss -lntp | grep -E '90[0-9]{2}|9200|8080|9080|1789'
 | `koopa-prime-qbittorrent` | `linuxserver/qbittorrent:5.0.4` | **9023**, **6881** | `bt.hacktivism.ch` |
 | `koopa-forgejo` (+ postgres) | `forgejo:11-rootless` | **9024**, **9200** | `git.hacktivism.ch` |
 | **`koopa-paivana`** (+ upstream) | `localhost/koopa-paivana:latest` | **9025** | `paivana.hacktivism.ch` |
+| `koopa-lemmy-proxy` (+ lemmy, ui, pictrs, db) | `lemmy:0.19.20` | **9026** | `lemmy.hacktivism.ch` |
 | **`koopa-tor-relay`** | `localhost/koopa-tor-relay:latest` | **8080**, **9051** (host net) | Tor OR (non-exit) |
 | **`koopa-nym`** | `localhost/koopa-nym:latest` | **9080**, **1789**, **1790** (+ opt. WG) | Nym mixnet node (nym.com) |
 | `koopa-tops-ng1` | `nginx` | **9090** | `tops.ng1.hacktivism.ch` |
@@ -59,6 +60,7 @@ Managed from **`/home/hernani/ansible-taler-exchange/`** (see `configs/taler-exc
 | `bt.hacktivism.ch` | 9023 |
 | `git.hacktivism.ch` | 9024 (HTTP); git-SSH **9200** host-direct |
 | `paivana.hacktivism.ch` | 9025 (paivana-httpd GOA paywall) |
+| `lemmy.hacktivism.ch` | 9026 |
 | `tops.ng1.hacktivism.ch` | 9090 |
 | `tops.ng2.hacktivism.ch` | 9091 |
 | `tops.ng3.hacktivism.ch` | 9092 |
@@ -71,6 +73,7 @@ Config: `/etc/caddy/Caddyfile` (mirror `configs/caddy/Caddyfile`).
 |------|------|
 | `~/ansible-taler-exchange/` | Ansible + scripts for exchange-ansible container |
 | `~/koopa-castopod/` | Castopod compose |
+| `~/koopa-lemmy/` | Lemmy compose |
 | `~/koopa-bonfire/` | Bonfire compose + gitbot |
 | `~/koopa-prime/` | Jellyfin + qBittorrent |
 | `~/koopa-forgejo/` | Forgejo rootless |

host/overview/services.md

@@ -36,6 +36,7 @@ flowchart TB
       BT["qbittorrent\n:9023"]
       Forgejo["koopa-forgejo ROOTLESS\n:9024 HTTP / :9200 SSH"]
       Paivana["koopa-paivana\n:9025"]
+      Lemmy["koopa-lemmy-proxy\n:9026"]
     end
 
     Tor["tor ORPort :8080"]
@@ -61,6 +62,7 @@ flowchart TB
   CaddyHTTPS -->|bt.hacktivism.ch| BT
   CaddyHTTPS -->|git.hacktivism.ch| Forgejo
   CaddyHTTPS -->|paivana.hacktivism.ch| Paivana
+  CaddyHTTPS -->|lemmy.hacktivism.ch| Lemmy
 ```
 
 ## Port table
@@ -81,6 +83,7 @@ flowchart TB
 | 9023 | podman | **qbittorrent** (bt) |
 | **9024** | podman | **forgejo** HTTP → `git.hacktivism.ch` |
 | **9025** | podman | **paivana** → `paivana.hacktivism.ch` |
+| **9026** | podman | **lemmy** → `lemmy.hacktivism.ch` |
 | **9200** | podman | **forgejo** git-SSH (host-direct) |
 | 9090–9092 | podman | **tops** `koopa-tops-ng1`…`ng3` |
 | 8080 | tor | ORPort |

scripts/lemmy/install-systemd.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Install Lemmy user systemd units on koopa (boot via linger).
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+UNIT_DIR="${HOME}/.config/systemd/user"
+
+mkdir -p "${UNIT_DIR}"
+cp "${ROOT}/configs/lemmy/container-koopa-lemmy-db.service" "${UNIT_DIR}/"
+cp "${ROOT}/configs/lemmy/container-koopa-lemmy.service" "${UNIT_DIR}/"
+
+systemctl --user daemon-reload
+systemctl --user enable \
+  container-koopa-lemmy-db.service \
+  container-koopa-lemmy.service
+
+if ! podman ps --format '{{.Names}}' | grep -qx koopa-lemmy-proxy; then
+  (cd "${HOME}/koopa-lemmy" && set -a && source .env && set +a && podman-compose up -d)
+fi
+
+systemctl --user start \
+  container-koopa-lemmy-db.service \
+  container-koopa-lemmy.service
+
+systemctl --user --no-pager --lines=0 status \
+  container-koopa-lemmy-db.service \
+  container-koopa-lemmy.service || true
+
+echo "OK. Public: https://lemmy.hacktivism.ch/"

scripts/lemmy/up.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -euo pipefail
+DIR="${HOME}/koopa-lemmy"
+cd "${DIR}"
+set -a
+# shellcheck disable=SC1091
+source .env
+set +a
+podman-compose up -d
+echo "== wait for :9026 =="
+ok=0
+for i in $(seq 1 40); do
+  code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 3 "http://127.0.0.1:9026/" || true)
+  echo "try $i: $code"
+  case "$code" in
+    2*|3*) ok=1; break ;;
+  esac
+  sleep 3
+done
+[[ "$ok" -eq 1 ]] || { echo "ERROR: no answer on 9026"; podman-compose ps; exit 1; }
+echo "local ok. public: https://lemmy.hacktivism.ch/"

scripts/login-health/koopa-login-health.sh

@@ -150,6 +150,7 @@ EXPECT_CONTAINERS=(
   taler-hacktivism-bank
   koopa-castopod
   koopa-bonfire
+  koopa-lemmy-proxy
   koopa-prime-jellyfin
   koopa-prime-qbittorrent
   koopa-forgejo
@@ -171,6 +172,7 @@ OPTIONAL_CONTAINERS=(
   koopa-tops-ng3
   koopa-castopod
   koopa-bonfire
+  koopa-lemmy-proxy
   koopa-paivana
 )
 
@@ -182,6 +184,7 @@ PROBES=(
   "forgejo|http://127.0.0.1:9024/|200,302,303"
   "castopod|http://127.0.0.1:9020/|200,302,303,307,308"
   "bonfire|http://127.0.0.1:9021/|200,302,303,307,308"
+  "lemmy|http://127.0.0.1:9026/|200,302,303,307,308"
   "prime|http://127.0.0.1:9022/|200,302,303,307,308"
   "bt|http://127.0.0.1:9023/|200,302,303,307,308,401"
   "paivana|http://127.0.0.1:9025/|200,302,303,307,308"
@@ -190,7 +193,7 @@ PROBES=(
   "tops-ng3|http://127.0.0.1:9092/|200,302,303"
 )
 
-OPTIONAL_PROBES=(castopod bonfire prime bt paivana tops-ng1 tops-ng2 tops-ng3)
+OPTIONAL_PROBES=(castopod bonfire lemmy prime bt paivana tops-ng1 tops-ng2 tops-ng3)
 
 C_OK=; C_WARN=; C_FAIL=; C_DIM=; C_RST=; C_BOLD=
 # colors only when writing for a tty later; snapshots are plain + optional ANSI if COLLECT_COLOR=1
@@ -283,7 +286,7 @@ do_collect() {
         record FAIL "nothing listening on :${port}"
       fi
     done
-    for port in 9020 9021 9022 9023 9025 9090 9091 9092 8080 9080; do
+    for port in 9020 9021 9022 9023 9025 9026 9090 9091 9092 8080 9080; do
       if printf '%s\n' "${listen_blob}" | grep -qE "[:.]${port}\$"; then
         record OK "listen :${port} (optional)"
       else
@@ -320,7 +323,7 @@ do_collect() {
         fi
       fi
     done
-    for dep in koopa-forgejo-db koopa-castopod-mariadb koopa-castopod-redis koopa-bonfire-db; do
+    for dep in koopa-forgejo-db koopa-castopod-mariadb koopa-castopod-redis koopa-bonfire-db koopa-lemmy-db; do
       if printf '%s\n' "${running_names}" | grep -qxF "${dep}"; then
         record INFO "dep ${dep} running"
       else