hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

lemmy: lemmy.hacktivism.ch behind Caddy :9026

Browse source
This commit is contained in:
Hernâni Marques 2026-08-17 13:53:59 +02:00
parent 0ab4b08aac
commit 66dbf417f8
No known key found for this signature in database
GPG key ID: CB5738652768F7E9
18 changed files with 327 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

1
2026/2026-07-16--container-autostart.md
View file

@ -19,6 +19,7 @@
| `koopa-tor-relay`, `koopa-nym` |
| `koopa-bonfire`, `koopa-bonfire-db` |
| `koopa-castopod`, `koopa-castopod-mariadb`, `koopa-castopod-redis` |
| `koopa-lemmy-proxy`, `koopa-lemmy`, `koopa-lemmy-ui`, `koopa-lemmy-pictrs`, `koopa-lemmy-db` |
| `koopa-paivana`, `koopa-paivana-upstream` |
| `koopa-tops-ng1` … `ng3` (+ `container-koopa-tops.service` ensure) |

13
2026/2026-08-17--lemmy.md Normal file
View file

@ -0,0 +1,13 @@
# Lemmy — lemmy.hacktivism.ch (2026-08-17)
Site: **https://lemmy.hacktivism.ch/**
Port **9026** → Caddy. Stack: `koopa-lemmy-proxy` (nginx) + `koopa-lemmy` + `koopa-lemmy-ui` + `koopa-lemmy-pictrs` + `koopa-lemmy-db`.
Live: `~/koopa-lemmy/` (compose mirror `configs/lemmy/`). Secrets only on host (`.env`, `lemmy.hjson`).
Instance name **hacktivism**. Example community `souveraenitaet`, post: https://lemmy.hacktivism.ch/post/1
Admin user is on the host (`~/koopa-lemmy/users.env`), not in this repo.
Caddy: `sudo /home/hernani/koopa-caddy/apply.sh` (already applied).
Boot: `scripts/lemmy/install-systemd.sh`.

1
SECRETS.md
View file

@ -18,6 +18,7 @@ Live passwords/keys live in sibling **`koopa-admin-secrets`**.
| What | Mirror | Live |
|------|--------|------|
| Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` (+ compose mirror in admin-log `configs/castopod/`) | `~/koopa-castopod/` |
| Lemmy | host-only `~/koopa-lemmy/{.env,lemmy.hjson}` (compose mirror in admin-log `configs/lemmy/`) | `~/koopa-lemmy/` |
| Bonfire (`FEDERATE=true`) | `koopa/home-hernani/koopa-bonfire/{.env,users.env,compose.yml}` | `~/koopa-bonfire/` |
| Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` |
| Forgejo (**rootless**, git.hacktivism.ch) | `koopa/home-hernani/koopa-forgejo/{.env,users.env,compose.yml}` | `~/koopa-forgejo/` |

19
configs/caddy/Caddyfile
View file

@ -1,7 +1,7 @@
# Internal only (not in the browser URL):
# 9010 merchant API | 9011 exchange API | 9012 bank API
# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9200 forgejo-ssh
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9200 forgejo-ssh
# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
{
@ -300,7 +300,22 @@ paivana.hacktivism.ch {
}
}
http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch {
# 9026 lemmy (+ ui/pictrs via internal nginx)
lemmy.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9026 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch {
handle /.well-known/acme-challenge/* {
root * /var/www/acme
file_server

2
configs/lemmy/.env.example Normal file
View file

@ -0,0 +1,2 @@
LEMMY_HOSTNAME=lemmy.hacktivism.ch
POSTGRES_PASSWORD=@inline-secret@

18
configs/lemmy/README.md Normal file
View file

@ -0,0 +1,18 @@
# Lemmy — lemmy.hacktivism.ch
| Item | Value |
|------|--------|
| Live | `/home/hernani/koopa-lemmy/` |
| Compose | `compose.yml` (mirror, no secrets) |
| Port | **9026** → Caddy |
| Site | https://lemmy.hacktivism.ch/ |
| Images | `dessalines/lemmy:0.19.20` + `lemmy-ui:0.19.20` |
Secrets: host `~/koopa-lemmy/{.env,lemmy.hjson}` (mode 600). Not in this repo.
```bash
cd ~/koopa-lemmy && set -a && source .env && set +a && podman-compose up -d
scripts/lemmy/install-systemd.sh
```
Daylog: `2026/2026-08-17--lemmy.md`.

109
configs/lemmy/compose.yml Normal file
View file

@ -0,0 +1,109 @@
# koopa-lemmy — Lemmy behind host Caddy on :9026
# Docs: https://join-lemmy.org/docs/administration/install_docker.html
# Images pinned from LemmyNet compose 0.19.20. No secrets in this file.
x-logging: &default-logging
driver: "json-file"
options:
max-size: "50m"
max-file: "4"
services:
proxy:
image: docker.io/library/nginx:1-alpine
container_name: koopa-lemmy-proxy
ports:
- "9026:8536"
volumes:
- ./nginx_internal.conf:/etc/nginx/nginx.conf:ro
- ./proxy_params:/etc/nginx/proxy_params:ro
restart: unless-stopped
logging: *default-logging
depends_on:
- pictrs
- lemmy-ui
labels:
org.hacktivism.service: lemmy
org.hacktivism.host_port: "9026"
org.hacktivism.site: lemmy.hacktivism.ch
org.hacktivism.managed_by: koopa-admin
lemmy:
image: docker.io/dessalines/lemmy:0.19.20
container_name: koopa-lemmy
hostname: lemmy
restart: unless-stopped
logging: *default-logging
environment:
- RUST_LOG=warn
volumes:
- ./lemmy.hjson:/config/config.hjson:ro
depends_on:
postgres:
condition: service_healthy
pictrs:
condition: service_started
labels:
org.hacktivism.service: lemmy
org.hacktivism.managed_by: koopa-admin
lemmy-ui:
image: docker.io/dessalines/lemmy-ui:0.19.20
container_name: koopa-lemmy-ui
environment:
- LEMMY_UI_LEMMY_INTERNAL_HOST=lemmy:8536
- LEMMY_UI_LEMMY_EXTERNAL_HOST=${LEMMY_HOSTNAME}
- LEMMY_UI_HTTPS=true
depends_on:
- lemmy
restart: unless-stopped
logging: *default-logging
labels:
org.hacktivism.service: lemmy
org.hacktivism.managed_by: koopa-admin
pictrs:
image: docker.io/asonix/pictrs:0.5.24
container_name: koopa-lemmy-pictrs
hostname: pictrs
environment:
- PICTRS__SERVER__API_KEY=${POSTGRES_PASSWORD}
- RUST_BACKTRACE=full
- PICTRS__MEDIA__VIDEO__VIDEO_CODEC=vp9
- PICTRS__MEDIA__ANIMATION__MAX_WIDTH=256
- PICTRS__MEDIA__ANIMATION__MAX_HEIGHT=256
- PICTRS__MEDIA__ANIMATION__MAX_FRAME_COUNT=400
user: "991:991"
volumes:
- lemmy-pictrs:/mnt
restart: unless-stopped
logging: *default-logging
labels:
org.hacktivism.service: lemmy
org.hacktivism.managed_by: koopa-admin
postgres:
image: docker.io/library/postgres:16-alpine
container_name: koopa-lemmy-db
hostname: postgres
environment:
- POSTGRES_USER=lemmy
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
- POSTGRES_DB=lemmy
volumes:
- lemmy-db:/var/lib/postgresql/data
restart: unless-stopped
logging: *default-logging
healthcheck:
test: ["CMD-SHELL", "pg_isready -U lemmy -d lemmy"]
interval: 5s
timeout: 5s
retries: 12
labels:
org.hacktivism.service: lemmy
org.hacktivism.managed_by: koopa-admin
volumes:
lemmy-db:
lemmy-pictrs:

21
configs/lemmy/container-koopa-lemmy-db.service Normal file
View file

@ -0,0 +1,21 @@
# user systemd — Lemmy postgres
[Unit]
Description=Lemmy postgres (koopa-lemmy-db)
Wants=network-online.target
After=network-online.target
RequiresMountsFor=%t/containers
[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=on-failure
RestartSec=20
TimeoutStartSec=300
TimeoutStopSec=120
WorkingDirectory=/home/hernani/koopa-lemmy
ExecStart=/usr/bin/podman-compose up -d postgres
ExecStop=/usr/bin/podman stop -t 30 koopa-lemmy-db
Type=oneshot
RemainAfterExit=yes
[Install]
WantedBy=default.target

21
configs/lemmy/container-koopa-lemmy.service Normal file
View file

@ -0,0 +1,21 @@
# user systemd — Lemmy stack (proxy + app + ui + pictrs)
[Unit]
Description=Lemmy stack (koopa-lemmy)
Wants=network-online.target container-koopa-lemmy-db.service
After=network-online.target container-koopa-lemmy-db.service
RequiresMountsFor=%t/containers
[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=on-failure
RestartSec=20
TimeoutStartSec=300
TimeoutStopSec=120
WorkingDirectory=/home/hernani/koopa-lemmy
ExecStart=/bin/bash -lc 'set -a && source .env && set +a && /usr/bin/podman-compose up -d'
ExecStop=/usr/bin/podman stop -t 30 koopa-lemmy-proxy koopa-lemmy koopa-lemmy-ui koopa-lemmy-pictrs
Type=oneshot
RemainAfterExit=yes
[Install]
WantedBy=default.target

11
configs/lemmy/lemmy.hjson.example Normal file
View file

@ -0,0 +1,11 @@
{
database: {
host: postgres
password: "@inline-secret@"
}
hostname: "lemmy.hacktivism.ch"
pictrs: {
url: "http://pictrs:8080/"
api_key: "@inline-secret@"
}
}

44
configs/lemmy/nginx_internal.conf Normal file
View file

@ -0,0 +1,44 @@
worker_processes auto;
events {
worker_connections 1024;
}
http {
# Podman default network DNS (not Docker 127.0.0.11).
resolver 10.89.0.1 valid=5s;
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.16.0.0/12;
set_real_ip_from 192.168.0.0/16;
map "$request_method:$http_accept" $proxpass {
default "http://lemmy-ui:1234";
"~^(?:GET|HEAD):.*?application\/(?:activity|ld)\+json" "http://lemmy:8536";
"~^(?!(GET|HEAD)).*:" "http://lemmy:8536";
}
server {
set $lemmy_ui "lemmy-ui:1234";
set $lemmy "lemmy:8536";
listen 8536;
server_name localhost;
server_tokens off;
client_max_body_size 20M;
include proxy_params;
location / {
proxy_pass $proxpass;
rewrite ^(.+)/+$ $1 permanent;
}
location = /.well-known/security.txt {
proxy_pass "http://$lemmy_ui";
}
location ~ ^/(api|pictrs|feeds|nodeinfo|.well-known|version|sitemap.xml) {
proxy_pass "http://$lemmy";
include proxy_params;
}
}
}

6
configs/lemmy/proxy_params Normal file
View file

@ -0,0 +1,6 @@
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

3
configs/ports.md
View file

@ -17,12 +17,13 @@
| 9023 | podman qBittorrent → Caddy `bt.hacktivism.ch` |
| **9024** | podman **`koopa-forgejo`** (HTTP) → Caddy **`git.hacktivism.ch`** |
| **9025** | podman **`koopa-paivana`** (paivana-httpd) → Caddy **`paivana.hacktivism.ch`** |
| **9026** | podman **`koopa-lemmy-proxy`** → Caddy **`lemmy.hacktivism.ch`** |
| **9200** | podman **Forgejo git-SSH** (host-direct; not Caddy) |
| 9090–9092 | podman `koopa-tops-ng1` … `ng3` → Caddy `tops.ng{1,2,3}.hacktivism.ch` |
| 8080 | Tor ORPort |
VeciGate: WAN **80→9000**, WAN **443→9001**.
Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9025, 9090–9092}.
Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9026, 9090–9092}.
Git SSH needs separate NAT/firewall **9200/tcp** if exposed to WAN.
| **1789** | podman **`koopa-nym`** mixnet (nym.com nym-node) |

3
host/overview/LIVE.md
View file

@ -35,6 +35,7 @@ ss -lntp | grep -E '90[0-9]{2}|9200|8080|9080|1789'
| `koopa-prime-qbittorrent` | `linuxserver/qbittorrent:5.0.4` | **9023**, **6881** | `bt.hacktivism.ch` |
| `koopa-forgejo` (+ postgres) | `forgejo:11-rootless` | **9024**, **9200** | `git.hacktivism.ch` |
| **`koopa-paivana`** (+ upstream) | `localhost/koopa-paivana:latest` | **9025** | `paivana.hacktivism.ch` |
| `koopa-lemmy-proxy` (+ lemmy, ui, pictrs, db) | `lemmy:0.19.20` | **9026** | `lemmy.hacktivism.ch` |
| **`koopa-tor-relay`** | `localhost/koopa-tor-relay:latest` | **8080**, **9051** (host net) | Tor OR (non-exit) |
| **`koopa-nym`** | `localhost/koopa-nym:latest` | **9080**, **1789**, **1790** (+ opt. WG) | Nym mixnet node (nym.com) |
| `koopa-tops-ng1` | `nginx` | **9090** | `tops.ng1.hacktivism.ch` |
@ -59,6 +60,7 @@ Managed from **`/home/hernani/ansible-taler-exchange/`** (see `configs/taler-exc
| `bt.hacktivism.ch` | 9023 |
| `git.hacktivism.ch` | 9024 (HTTP); git-SSH **9200** host-direct |
| `paivana.hacktivism.ch` | 9025 (paivana-httpd GOA paywall) |
| `lemmy.hacktivism.ch` | 9026 |
| `tops.ng1.hacktivism.ch` | 9090 |
| `tops.ng2.hacktivism.ch` | 9091 |
| `tops.ng3.hacktivism.ch` | 9092 |
@ -71,6 +73,7 @@ Config: `/etc/caddy/Caddyfile` (mirror `configs/caddy/Caddyfile`).
|------|------|
| `~/ansible-taler-exchange/` | Ansible + scripts for exchange-ansible container |
| `~/koopa-castopod/` | Castopod compose |
| `~/koopa-lemmy/` | Lemmy compose |
| `~/koopa-bonfire/` | Bonfire compose + gitbot |
| `~/koopa-prime/` | Jellyfin + qBittorrent |
| `~/koopa-forgejo/` | Forgejo rootless |

3
host/overview/services.md
View file

@ -36,6 +36,7 @@ flowchart TB
BT["qbittorrent\n:9023"]
Forgejo["koopa-forgejo ROOTLESS\n:9024 HTTP / :9200 SSH"]
Paivana["koopa-paivana\n:9025"]
Lemmy["koopa-lemmy-proxy\n:9026"]
end
Tor["tor ORPort :8080"]
@ -61,6 +62,7 @@ flowchart TB
CaddyHTTPS -->|bt.hacktivism.ch| BT
CaddyHTTPS -->|git.hacktivism.ch| Forgejo
CaddyHTTPS -->|paivana.hacktivism.ch| Paivana
CaddyHTTPS -->|lemmy.hacktivism.ch| Lemmy
```
## Port table
@ -81,6 +83,7 @@ flowchart TB
| 9023 | podman | **qbittorrent** (bt) |
| **9024** | podman | **forgejo** HTTP → `git.hacktivism.ch` |
| **9025** | podman | **paivana** → `paivana.hacktivism.ch` |
| **9026** | podman | **lemmy** → `lemmy.hacktivism.ch` |
| **9200** | podman | **forgejo** git-SSH (host-direct) |
| 9090–9092 | podman | **tops** `koopa-tops-ng1`…`ng3` |
| 8080 | tor | ORPort |

28
scripts/lemmy/install-systemd.sh Executable file
View file

@ -0,0 +1,28 @@
#!/usr/bin/env bash
# Install Lemmy user systemd units on koopa (boot via linger).
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
UNIT_DIR="${HOME}/.config/systemd/user"
mkdir -p "${UNIT_DIR}"
cp "${ROOT}/configs/lemmy/container-koopa-lemmy-db.service" "${UNIT_DIR}/"
cp "${ROOT}/configs/lemmy/container-koopa-lemmy.service" "${UNIT_DIR}/"
systemctl --user daemon-reload
systemctl --user enable \
container-koopa-lemmy-db.service \
container-koopa-lemmy.service
if ! podman ps --format '{{.Names}}' | grep -qx koopa-lemmy-proxy; then
(cd "${HOME}/koopa-lemmy" && set -a && source .env && set +a && podman-compose up -d)
fi
systemctl --user start \
container-koopa-lemmy-db.service \
container-koopa-lemmy.service
systemctl --user --no-pager --lines=0 status \
container-koopa-lemmy-db.service \
container-koopa-lemmy.service || true
echo "OK. Public: https://lemmy.hacktivism.ch/"

21
scripts/lemmy/up.sh Executable file
View file

@ -0,0 +1,21 @@
#!/usr/bin/env bash
set -euo pipefail
DIR="${HOME}/koopa-lemmy"
cd "${DIR}"
set -a
# shellcheck disable=SC1091
source .env
set +a
podman-compose up -d
echo "== wait for :9026 =="
ok=0
for i in $(seq 1 40); do
code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 3 "http://127.0.0.1:9026/" || true)
echo "try $i: $code"
case "$code" in
2*|3*) ok=1; break ;;
esac
sleep 3
done
[[ "$ok" -eq 1 ]] || { echo "ERROR: no answer on 9026"; podman-compose ps; exit 1; }
echo "local ok. public: https://lemmy.hacktivism.ch/"

9
scripts/login-health/koopa-login-health.sh
View file

@ -150,6 +150,7 @@ EXPECT_CONTAINERS=(
taler-hacktivism-bank
koopa-castopod
koopa-bonfire
koopa-lemmy-proxy
koopa-prime-jellyfin
koopa-prime-qbittorrent
koopa-forgejo
@ -171,6 +172,7 @@ OPTIONAL_CONTAINERS=(
koopa-tops-ng3
koopa-castopod
koopa-bonfire
koopa-lemmy-proxy
koopa-paivana
)
@ -182,6 +184,7 @@ PROBES=(
"forgejo|http://127.0.0.1:9024/|200,302,303"
"castopod|http://127.0.0.1:9020/|200,302,303,307,308"
"bonfire|http://127.0.0.1:9021/|200,302,303,307,308"
"lemmy|http://127.0.0.1:9026/|200,302,303,307,308"
"prime|http://127.0.0.1:9022/|200,302,303,307,308"
"bt|http://127.0.0.1:9023/|200,302,303,307,308,401"
"paivana|http://127.0.0.1:9025/|200,302,303,307,308"
@ -190,7 +193,7 @@ PROBES=(
"tops-ng3|http://127.0.0.1:9092/|200,302,303"
)
OPTIONAL_PROBES=(castopod bonfire prime bt paivana tops-ng1 tops-ng2 tops-ng3)
OPTIONAL_PROBES=(castopod bonfire lemmy prime bt paivana tops-ng1 tops-ng2 tops-ng3)
C_OK=; C_WARN=; C_FAIL=; C_DIM=; C_RST=; C_BOLD=
# colors only when writing for a tty later; snapshots are plain + optional ANSI if COLLECT_COLOR=1
@ -283,7 +286,7 @@ do_collect() {
record FAIL "nothing listening on :${port}"
fi
done
for port in 9020 9021 9022 9023 9025 9090 9091 9092 8080 9080; do
for port in 9020 9021 9022 9023 9025 9026 9090 9091 9092 8080 9080; do
if printf '%s\n' "${listen_blob}" | grep -qE "[:.]${port}\$"; then
record OK "listen :${port} (optional)"
else
@ -320,7 +323,7 @@ do_collect() {
fi
fi
done
for dep in koopa-forgejo-db koopa-castopod-mariadb koopa-castopod-redis koopa-bonfire-db; do
for dep in koopa-forgejo-db koopa-castopod-mariadb koopa-castopod-redis koopa-bonfire-db koopa-lemmy-db; do
if printf '%s\n' "${running_names}" | grep -qxF "${dep}"; then
record INFO "dep ${dep} running"
else