90 lines
4.9 KiB
Markdown
90 lines
4.9 KiB
Markdown
# Fediverse VMs
|
|
|
|
This repo is, for now, an attempt to familiarize myself with NixOS options for Fediverse applications, and build up a configuration layer that will set most of the relevant options for you (in a semi-opinionated way) given some high-level configuration. The goal is something in the same vein as [nixos-mailserver](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver) but for fediversity.
|
|
|
|
Eventually, this will be tailored to high-throughput multi-machine setups. For now, it's just a small set of configurations to run in VMs.
|
|
|
|
## Running the VMs
|
|
|
|
you can build a VM using
|
|
|
|
```bash
|
|
nixos-rebuild build-vm --flake .#<vm_name>
|
|
```
|
|
|
|
where `<vm_name>` is one of `mastodon`, `peertube`, `pixelfed`, or `all`
|
|
|
|
and then run it with
|
|
```bash
|
|
./result/bin/run-nixos-vm
|
|
```
|
|
|
|
After the machine boots, you should be dropped into a root shell.
|
|
|
|
Note that state will be persisted in the `nixos.cqow2` file. Delete that and restart the VM to reset the state.
|
|
|
|
With the VM running, you can then access the apps on your local machine's web browser (using the magic of port forwarding) at the following addresses
|
|
|
|
NOTE: it sometimes takes a while for the services to start up, and in the meantime you will get 502 Bad Gateway.
|
|
|
|
- Mastodon: through the reverse proxy at <https://mastodon.localhost:8443> and directly at <http://mastodon.localhost:55001>
|
|
- You can create accounts on the machine itself by running `mastodon-tootctl accounts create test --email test@test.com --confirmed --approve`
|
|
- Account-related activities (logging in/out; preferences) can only be done on the insecure direct page <http://mastodon.localhost:55001>
|
|
- After you've logged in, you can go back to the secure page and you will remain logged in
|
|
- some operations may remove the port number from the URL. You'll have to add that back in manually
|
|
|
|
- PeerTube: <http://peertube.localhost:9000>
|
|
- The root account can be accessed with username "root". The password can be obtained by running the following command on the VM:
|
|
```bash
|
|
journalctl -u peertube | perl -ne '/password: (.*)/ && print $1'
|
|
```
|
|
- Creating other accounts has to be enabled via the admin interface. `Administration > Configuration > Basic > Enable Signup` or just add an account directly from `Administration > Create user`. But functionality can also be tested from the root account.
|
|
|
|
- Pixelfed: <http://pixelfed.localhost:8000>
|
|
- Account creation via the web interface won't work until we figure out email
|
|
- For now, they can be created on the VM command line
|
|
```bash
|
|
pixelfed-manage user:create --name=test --username=test --email=test@test.com --password=testtest --confirm_email=1
|
|
```
|
|
|
|
## debugging notes
|
|
|
|
- it is sometimes useful to `cat result/bin/run-nixos-vm` to see what's really going on (e.g. which ports are getting forwarded)
|
|
- relevant systemd services:
|
|
- mastodon-web.service
|
|
- peertube.service
|
|
- the `garage` CLI command gives information about garage storage, but cannot be used to actually inspect the contents. use `mc` (minio) for that
|
|
- in the chromium devtools, you can go to the networking tab and change things like response headers in a way that persists through reloads. this is much faster iteration time if that's what you need to epxeriment with.
|
|
|
|
# questions
|
|
|
|
- what is meant to be shared between instances?
|
|
- this is relevant to the security model. If garage is being shared between instances, we have to be careful having configurations depend on each other.
|
|
- they are to be shared, BUT the user will have no direct control over configuration.
|
|
|
|
# resources
|
|
|
|
- Tutorial for setting up better logging: https://krisztianfekete.org/self-hosting-mastodon-on-nixos-a-proof-of-concept/
|
|
- Setting up mastodon development environment: https://docs.joinmastodon.org/dev/setup/
|
|
|
|
- Tutorial for PeerTube that doesn't use `createLocally`: https://nixos.wiki/wiki/PeerTube
|
|
|
|
- garage settings for specific apps: https://garagehq.deuxfleurs.fr/documentation/connect/apps/
|
|
|
|
- pixelfed has terrible / mostly non-existent documentation)
|
|
|
|
- for when we start worry about scaling up: https://docs.joinmastodon.org/admin/scaling/
|
|
|
|
# notes
|
|
|
|
When mastodon is running in production mode, we have a few problems:
|
|
- you have to click "accept the security risk"
|
|
- it takes a while for the webpage to come online. Until then you see "502 Bad Gateway"
|
|
- email sent from the mastodon instance (e.g. for account confirmation) should be accessible at <https://mastodon.localhost:55001/letter_opener>, but it's not working.
|
|
- mastodon is trying to fetch `missing.png` without ssl (`http://`). This isn't allowed, and i'm not sure why it's doing it.
|
|
- mastodon is trying to fetch `custom.css` from https://mastodon.localhost (no port), which is not the configured `LOCAL_DOMAIN`, so it's unclear why.
|
|
|
|
NixOS tests do not take the configuration from `virtualisation.vmVariant`. This seems like an oversight since people don't tend to mix normal NixOS configurations with the ones they're using for tests. This should be pretty easy to rectify upstream.
|
|
|
|
|