From 0df277f1bf4d72ba5a41e35673caaf4e0f394d55 Mon Sep 17 00:00:00 2001 From: "Simon R. - fantomitechno" Date: Tue, 30 Jun 2026 11:55:02 +0200 Subject: [PATCH] =?UTF-8?q?=E2=9C=A8=20docker=20composes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gitignore | 3 +- docker/fant0mib0t/cryptpad/config.js | 302 ++++++++ docker/fant0mib0t/cryptpad/docker-compose.yml | 32 + docker/fant0mib0t/hold/config.yaml | 9 + docker/fant0mib0t/hold/docker-compose.yml | 20 + docker/fant0mib0t/immich/docker-compose.yml | 63 ++ docker/fant0mib0t/immich/hwaccel.ml.yml | 57 ++ .../fant0mib0t/immich/hwaccel.transcoding.yml | 55 ++ docker/fant0mib0t/kiwix/docker-compose.yml | 10 + docker/fant0mib0t/tranquill-pds/config.toml | 662 ++++++++++++++++++ .../tranquill-pds/docker-compose.yml | 52 ++ flake.nix | 7 +- modules/codium/settings.json | 5 +- 13 files changed, 1269 insertions(+), 8 deletions(-) create mode 100644 docker/fant0mib0t/cryptpad/config.js create mode 100644 docker/fant0mib0t/cryptpad/docker-compose.yml create mode 100644 docker/fant0mib0t/hold/config.yaml create mode 100644 docker/fant0mib0t/hold/docker-compose.yml create mode 100644 docker/fant0mib0t/immich/docker-compose.yml create mode 100644 docker/fant0mib0t/immich/hwaccel.ml.yml create mode 100644 docker/fant0mib0t/immich/hwaccel.transcoding.yml create mode 100644 docker/fant0mib0t/kiwix/docker-compose.yml create mode 100644 docker/fant0mib0t/tranquill-pds/config.toml create mode 100644 docker/fant0mib0t/tranquill-pds/docker-compose.yml diff --git a/.gitignore b/.gitignore index 346c954..1edd4c6 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ -pswd \ No newline at end of file +pswd +.env \ No newline at end of file diff --git a/docker/fant0mib0t/cryptpad/config.js b/docker/fant0mib0t/cryptpad/config.js new file mode 100644 index 0000000..72d5134 --- /dev/null +++ b/docker/fant0mib0t/cryptpad/config.js @@ -0,0 +1,302 @@ +module.exports = { +/* httpUnsafeOrigin is the URL that clients will enter to load your instance. + * Any other URL that somehow points to your instance is supposed to be blocked. + * The default provided below assumes you are loading CryptPad from a server + * which is running on the same machine, using port 3000. + * + * In a production instance this should be available ONLY over HTTPS + * using the default port for HTTPS (443) ie. https://cryptpad.fr + * In such a case this should be also handled by NGINX, as documented in + * cryptpad/docs/example.nginx.conf (see the $main_domain variable) + * + */ + httpUnsafeOrigin: 'https://drive.renoux.dev', + +/* httpSafeOrigin is the URL used for the 'sandbox' described above. + * If you're testing or developing with CryptPad on your local machine then + * it is appropriate to leave this blank. The default behaviour is to serve + * the main domain over port 3000 and to serve the sandbox content over port 3001. + * + * This is not appropriate in a production environment where invasive networks + * may filter traffic going over abnormal ports. + * To correctly configure your production instance you must provide a URL + * with a different domain (a subdomain is sufficient). + * It will be used to load the UI in our 'sandbox' system. + * + * This value corresponds to the $sandbox_domain variable + * in the example nginx file. + * + * Note that in order for the sandboxing system to be effective + * httpSafeOrigin must be different from httpUnsafeOrigin. + * + * CUSTOMIZE AND UNCOMMENT THIS FOR PRODUCTION INSTALLATIONS. + */ + httpSafeOrigin: "https://drive.s.renoux.dev", + +/* httpAddress specifies the address on which the nodejs server + * should be accessible. By default it will listen on localhost + * (IPv4 & IPv6 if enabled). If you want it to listen on + * a specific address, specify it here. e.g '192.168.0.1' + * + */ + httpAddress: '127.0.0.1', + +/* httpPort specifies on which port the nodejs server should listen. + * By default it will serve content over port 3000, which is suitable + * for both local development and for use with the provided nginx example, + * which will proxy websocket traffic to your node server. + * + */ + httpPort: 4020, + +/* httpSafePort purpose is to emulate another origin for the sandbox when + * you don't have two domains at hand (i.e. when httpSafeOrigin not defined). + * It is meant to be used only in case where you are working on a local + * development instance. The default value is your httpPort + 1. + * + */ + //httpSafePort: 3001, + +/* Websockets need to be exposed on a separate port from the rest of + * the platform's HTTP traffic. Port 3003 is used by default. + * You can change this to a different port if it is in use by a + * different service, but under most circumstances you can leave this + * commented and it will work. + * + * In production environments, your reverse proxy (usually NGINX) + * will need to forward websocket traffic (/cryptpad_websocket) + * to this port. + * + */ + websocketPort: 4021, + +/* CryptPad will launch a child process for every core available + * in order to perform CPU-intensive tasks in parallel. + * Some host environments may have a very large number of cores available + * or you may want to limit how much computing power CryptPad can take. + * If so, set 'maxWorkers' to a positive integer. + */ + // maxWorkers: 4, + + /* ===================== + * Sessions + * ===================== */ + + /* Accounts can be protected with an OTP (One Time Password) system + * to add a second authentication layer. Such accounts use a session + * with a given lifetime after which they are logged out and need + * to be re-authenticated. You can configure the lifetime of these + * sessions here. + * + * defaults to 7 days + */ + //otpSessionExpiration: 7*24, // hours + + /* Registered users can be forced to protect their account + * with a Multi-factor Authentication (MFA) tool like a TOTP + * authenticator application. + * + * defaults to false + */ + //enforceMFA: false, + + /* ===================== + * Privacy + * ===================== */ + + /* Depending on where your instance is hosted, you may be required to log IP + * addresses of the users who make a change to a document. This setting allows you + * to do so. You can configure the logging system below in this config file. + * Setting this value to true will include a log for each websocket connection + * including this connection's unique ID, the user public key and the IP. + * NOTE: this option requires a log level of "info" or below. + * + * defaults to false + */ + //logIP: false, + + /* ===================== + * Admin + * ===================== */ + + /* + * CryptPad contains an administration panel. Its access is restricted to specific + * users using the following list and the management interface on the instance. + * To give access to the admin panel to a user account, just add their public signing + * key, which can be found on the settings page for registered users. Access can be + * revoked directly from the interface, unless you added the key below. + * Entries should be strings separated by a comma. + * adminKeys: [ + * "[cryptpad-user1@my.awesome.website/YZgXQxKR0Rcb6r6CmxHPdAGLVludrAF2lEnkbx1vVOo=]", + * "[cryptpad-user2@my.awesome.website/jA-9c5iNuG7SyxzGCjwJXVnk5NPfAOO8fQuQ0dC83RE=]", + * ] + * + */ + adminKeys: [ + + ], + + /* ===================== + * STORAGE + * ===================== */ + + /* Pads that are not 'pinned' by any registered user can be set to expire + * after a configurable number of days of inactivity (default 90 days). + * The value can be changed or set to false to remove expiration. + * Expired pads can then be removed using a cron job calling the + * `evict-inactive.js` script with node + * + * defaults to 90 days if nothing is provided + */ + //inactiveTime: 90, // days + + /* CryptPad archives some data instead of deleting it outright. + * This archived data still takes up space and so you'll probably still want to + * remove these files after a brief period. + * + * cryptpad/scripts/evict-archived.js is intended to be run daily + * from a crontab or similar scheduling service. + * + * The intent with this feature is to provide a safety net in case of accidental + * deletion. Set this value to the number of days you'd like to retain + * archived data before it's removed permanently. + * + * defaults to 15 days if nothing is provided + */ + //archiveRetentionTime: 15, + + /* It's possible to configure your instance to remove data + * stored on behalf of inactive accounts. Set 'accountRetentionTime' + * to the number of days an account can remain idle before its + * documents and other account data is removed. + * + * Leave this value commented out to preserve all data stored + * by user accounts regardless of inactivity. + */ + //accountRetentionTime: 365, + + /* Starting with CryptPad 3.23.0, the server automatically runs + * the script responsible for removing inactive data according to + * your configured definition of inactivity. Set this value to `true` + * if you prefer not to remove inactive data, or if you prefer to + * do so manually using `scripts/evict-inactive.js`. + */ + //disableIntegratedEviction: true, + + + /* Max Upload Size (bytes) + * this sets the maximum size of any one file uploaded to the server. + * anything larger than this size will be rejected + * defaults to 20MB if no value is provided + */ + //maxUploadSize: 20 * 1024 * 1024, + + /* Users with premium accounts (those with a plan included in their customLimit) + * can benefit from an increased upload size limit. By default they are restricted to the same + * upload size as any other registered user. + * + */ + //premiumUploadSize: 100 * 1024 * 1024, + + /* ===================== + * DATABASE VOLUMES + * ===================== */ + + /* + * CryptPad stores each document in an individual file on your hard drive. + * Specify a directory where files should be stored. + * It will be created automatically if it does not already exist. + */ + filePath: './datastore/', + + /* CryptPad offers the ability to archive data for a configurable period + * before deleting it, allowing a means of recovering data in the event + * that it was deleted accidentally. + * + * To set the location of this archive directory to a custom value, change + * the path below: + */ + archivePath: './data/archive', + + /* CryptPad allows logged in users to request that the server + * store particular documents indefinitely. This is called 'pinning'. + * Pin requests are stored in a pin-store. The location of this store is + * defined here. + */ + pinPath: './data/pins', + + /* if you would like the list of scheduled tasks to be stored in + a custom location, change the path below: + */ + taskPath: './data/tasks', + + /* if you would like users' authenticated blocks to be stored in + a custom location, change the path below: + */ + blockPath: './block', + + /* CryptPad allows logged in users to upload encrypted files. Files/blobs + * are stored in a 'blob-store'. Set its location here. + */ + blobPath: './blob', + + /* CryptPad stores incomplete blobs in a 'staging' area until they are + * fully uploaded. Set its location here. + */ + blobStagingPath: './data/blobstage', + + decreePath: './data/decrees', + + /* CryptPad supports logging events directly to the disk in a 'logs' directory + * Set its location here, or set it to false (or nothing) if you'd rather not log + */ + logPath: './data/logs', + + /* ===================== + * Debugging + * ===================== */ + + /* CryptPad can log activity to stdout + * This may be useful for debugging + */ + logToStdout: false, + + /* CryptPad can be configured to log more or less + * the various settings are listed below by order of importance + * + * silly, verbose, debug, feedback, info, warn, error + * + * Choose the least important level of logging you wish to see. + * For example, a 'silly' logLevel will display everything, + * while 'info' will display 'info', 'warn', and 'error' logs + * + * This will affect both logging to the console and the disk. + */ + logLevel: 'info', + + /* clients can use the /settings/ app to opt out of usage feedback + * which informs the server of things like how much each app is being + * used, and whether certain clientside features are supported by + * the client's browser. The intent is to provide feedback to the admin + * such that the service can be improved. Enable this with `true` + * and ignore feedback with `false` or by commenting the attribute + * + * You will need to set your logLevel to include 'feedback'. Set this + * to false if you'd like to exclude feedback from your logs. + */ + logFeedback: false, + + /* CryptPad supports verbose logging + * (false by default) + */ + verbose: false, + + /* Surplus information: + * + * 'installMethod' is included in server telemetry to voluntarily + * indicate how many instances are using unofficial installation methods + * such as Docker. + * + */ + installMethod: 'nuhuh', +}; \ No newline at end of file diff --git a/docker/fant0mib0t/cryptpad/docker-compose.yml b/docker/fant0mib0t/cryptpad/docker-compose.yml new file mode 100644 index 0000000..9bb1045 --- /dev/null +++ b/docker/fant0mib0t/cryptpad/docker-compose.yml @@ -0,0 +1,32 @@ +services: + cryptpad: + image: "cryptpad/cryptpad:version-2026.5.1" + hostname: cryptpad + + environment: + - CPAD_MAIN_DOMAIN=https://drive.renoux.dev + - CPAD_SANDBOX_DOMAIN=https://drive.s.renoux.dev + - CPAD_CONF=/cryptpad/config/config.js + + # Read and accept the license before uncommenting the following line: + # https://github.com/ONLYOFFICE/web-apps/blob/master/LICENSE.txt + - CPAD_INSTALL_ONLYOFFICE=yes + + volumes: + - /nas/cryptpad/blob:/cryptpad/blob + - /nas/cryptpad/block:/cryptpad/block + - /nas/cryptpad/customize:/cryptpad/customize + - /nas/cryptpad/data:/cryptpad/data + - /nas/cryptpad/files:/cryptpad/datastore + - /nas/cryptpad/onlyoffice-dist:/cryptpad/www/common/onlyoffice/dist + - /nas/cryptpad/onlyoffice-conf:/cryptpad/onlyoffice-conf + - ./config.js:/cryptpad/config/config.js + + ports: + - "127.0.0.1:3000:3000" + - "127.0.0.1:3003:3003" + + ulimits: + nofile: + soft: 1000000 + hard: 1000000 diff --git a/docker/fant0mib0t/hold/config.yaml b/docker/fant0mib0t/hold/config.yaml new file mode 100644 index 0000000..e015ee0 --- /dev/null +++ b/docker/fant0mib0t/hold/config.yaml @@ -0,0 +1,9 @@ +storage: + bucket: "garage" + endpoint: "http://s3.fantom.internal" + +server: + public_url: "https://hold.fantomitechno.dev" + +registration: + owner_did: "did:plc:q2leouakch2kg4ruldreunip" \ No newline at end of file diff --git a/docker/fant0mib0t/hold/docker-compose.yml b/docker/fant0mib0t/hold/docker-compose.yml new file mode 100644 index 0000000..135f69d --- /dev/null +++ b/docker/fant0mib0t/hold/docker-compose.yml @@ -0,0 +1,20 @@ +services: + tranquil-pds: + image: atcr.io/seamark.cr/appview:v0.1.2-arm64 + restart: unless-stopped + command: ["serve", "--config", "/config.yaml"] + environment: + SERVER_HOST: "[::]" + ports: + - "127.0.0.1:4010:8080" + volumes: + - ./config.yaml:/config.yaml:ro + - /nas/atcr/hold:/var/lib/atcr-hold + env_file: + - .env + healthcheck: + test: ["CMD", "/healthcheck", "http://localhost:8080/xrpc/_health"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 30s diff --git a/docker/fant0mib0t/immich/docker-compose.yml b/docker/fant0mib0t/immich/docker-compose.yml new file mode 100644 index 0000000..2f180c4 --- /dev/null +++ b/docker/fant0mib0t/immich/docker-compose.yml @@ -0,0 +1,63 @@ +services: + immich-server: + container_name: immich_server + image: ghcr.io/immich-app/immich-server:v2.7.5 + # extends: + # file: hwaccel.transcoding.yml + # service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding + volumes: + - /nas/immich/library:/data + - /etc/localtime:/etc/localtime:ro + env_file: + - .env + ports: + - "127.0.0.1:4040:2283" + depends_on: + - redis + - database + restart: always + healthcheck: + disable: false + + immich-machine-learning: + container_name: immich_machine_learning + # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag. + # Example tag: v2.7.5-cuda + image: ghcr.io/immich-app/immich-machine-learning:v2.7.5 + # extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration + # file: hwaccel.ml.yml + # service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable + volumes: + - model-cache:/cache + env_file: + - .env + restart: always + healthcheck: + disable: false + + redis: + container_name: immich_redis + image: docker.io/valkey/valkey:9@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9 + healthcheck: + test: redis-cli ping || exit 1 + restart: always + + database: + container_name: immich_postgres + image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23 + environment: + POSTGRES_PASSWORD: ${DB_PASSWORD} + POSTGRES_USER: ${DB_USERNAME} + POSTGRES_DB: ${DB_DATABASE_NAME} + POSTGRES_INITDB_ARGS: "--data-checksums" + # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs + DB_STORAGE_TYPE: "HDD" + volumes: + - /nas/immich/pg_data:/var/lib/postgresql/data + shm_size: 128mb + restart: always + healthcheck: + disable: false + +volumes: + model-cache: diff --git a/docker/fant0mib0t/immich/hwaccel.ml.yml b/docker/fant0mib0t/immich/hwaccel.ml.yml new file mode 100644 index 0000000..c95ac7e --- /dev/null +++ b/docker/fant0mib0t/immich/hwaccel.ml.yml @@ -0,0 +1,57 @@ +# Configurations for hardware-accelerated machine learning + +# If using Unraid or another platform that doesn't allow multiple Compose files, +# you can inline the config for a backend by copying its contents +# into the immich-machine-learning service in the docker-compose.yml file. + +# See https://docs.immich.app/features/ml-hardware-acceleration for info on usage. + +services: + armnn: + devices: + - /dev/mali0:/dev/mali0 + volumes: + - /lib/firmware/mali_csffw.bin:/lib/firmware/mali_csffw.bin:ro # Mali firmware for your chipset (not always required depending on the driver) + - /usr/lib/libmali.so:/usr/lib/libmali.so:ro # Mali driver for your chipset (always required) + + rknn: + security_opt: + - systempaths=unconfined + - apparmor=unconfined + devices: + - /dev/dri:/dev/dri + + cpu: {} + + cuda: + deploy: + resources: + reservations: + devices: + - driver: nvidia + count: 1 + capabilities: + - gpu + + rocm: + group_add: + - video + devices: + - /dev/dri:/dev/dri + - /dev/kfd:/dev/kfd + + openvino: + device_cgroup_rules: + - 'c 189:* rmw' + devices: + - /dev/dri:/dev/dri + volumes: + - /dev/bus/usb:/dev/bus/usb + + openvino-wsl: + devices: + - /dev/dri:/dev/dri + - /dev/dxg:/dev/dxg + volumes: + - /dev/bus/usb:/dev/bus/usb + - /usr/lib/wsl:/usr/lib/wsl diff --git a/docker/fant0mib0t/immich/hwaccel.transcoding.yml b/docker/fant0mib0t/immich/hwaccel.transcoding.yml new file mode 100644 index 0000000..0857faf --- /dev/null +++ b/docker/fant0mib0t/immich/hwaccel.transcoding.yml @@ -0,0 +1,55 @@ +# Configurations for hardware-accelerated transcoding + +# If using Unraid or another platform that doesn't allow multiple Compose files, +# you can inline the config for a backend by copying its contents +# into the immich-microservices service in the docker-compose.yml file. + +# See https://docs.immich.app/features/hardware-transcoding for more info on using hardware transcoding. + +services: + cpu: {} + + nvenc: + deploy: + resources: + reservations: + devices: + - driver: nvidia + count: 1 + capabilities: + - gpu + - compute + - video + + quicksync: + devices: + - /dev/dri:/dev/dri + + rkmpp: + security_opt: # enables full access to /sys and /proc, still far better than privileged: true + - systempaths=unconfined + - apparmor=unconfined + group_add: + - video + devices: + - /dev/rga:/dev/rga + - /dev/dri:/dev/dri + - /dev/dma_heap:/dev/dma_heap + - /dev/mpp_service:/dev/mpp_service + #- /dev/mali0:/dev/mali0 # only required to enable OpenCL-accelerated HDR -> SDR tonemapping + volumes: + #- /etc/OpenCL:/etc/OpenCL:ro # only required to enable OpenCL-accelerated HDR -> SDR tonemapping + #- /usr/lib/aarch64-linux-gnu/libmali.so.1:/usr/lib/aarch64-linux-gnu/libmali.so.1:ro # only required to enable OpenCL-accelerated HDR -> SDR tonemapping + + vaapi: + devices: + - /dev/dri:/dev/dri + + vaapi-wsl: # use this for VAAPI if you're running Immich in WSL2 + devices: + - /dev/dri:/dev/dri + - /dev/dxg:/dev/dxg + volumes: + - /usr/lib/wsl:/usr/lib/wsl + environment: + - LIBVA_DRIVER_NAME=d3d12 diff --git a/docker/fant0mib0t/kiwix/docker-compose.yml b/docker/fant0mib0t/kiwix/docker-compose.yml new file mode 100644 index 0000000..c7ab114 --- /dev/null +++ b/docker/fant0mib0t/kiwix/docker-compose.yml @@ -0,0 +1,10 @@ +services: + kiwix-serve: + container_name: kiwix + image: ghcr.io/kiwix/kiwix-serve:latest + volumes: + - /nas/kiwix:/data + command: + - "*.zim" + ports: + - "127.0.0.1:4030:8080" diff --git a/docker/fant0mib0t/tranquill-pds/config.toml b/docker/fant0mib0t/tranquill-pds/config.toml new file mode 100644 index 0000000..fc90e60 --- /dev/null +++ b/docker/fant0mib0t/tranquill-pds/config.toml @@ -0,0 +1,662 @@ +[server] +# Public hostname of the PDS, such as `pds.example.com`. +# +# Can also be specified via environment variable `PDS_HOSTNAME`. +# +# Required! This value must be specified. +hostname = "pds.fantomitechno.dev" + +# Address to bind the HTTP server to. +# +# Can also be specified via environment variable `SERVER_HOST`. +# +# Default value: "127.0.0.1" +host = "127.0.0.1" + +# Port to bind the HTTP server to. +# +# Can also be specified via environment variable `SERVER_PORT`. +# +# Default value: 3000 + +# List of domains for user handles. +# Defaults to the PDS hostname when not set. +# +# Can also be specified via environment variable `PDS_USER_HANDLE_DOMAINS`. +#user_handle_domains = + +# Enable PDS-hosted did:web identities. Hosting did:web requires a +# long-term commitment to serve DID documents; opt-in only. +# +# Can also be specified via environment variable `ENABLE_PDS_HOSTED_DID_WEB`. +# +# Default value: false +#enable_pds_hosted_did_web = false + +# When set to true, skip age-assurance birthday prompt for all accounts. +# +# Can also be specified via environment variable `PDS_AGE_ASSURANCE_OVERRIDE`. +# +# Default value: false +age_assurance_override = true + +# Require an invite code for new account registration. +# +# Can also be specified via environment variable `INVITE_CODE_REQUIRED`. +# +# Default value: true +invite_code_required = true + +# Allow HTTP (non-TLS) proxy requests. Only useful during development. +# +# Can also be specified via environment variable `ALLOW_HTTP_PROXY`. +# +# Default value: false +#allow_http_proxy = false + +# Disable all rate limiting. Should only be used in testing. +# +# Can also be specified via environment variable `DISABLE_RATE_LIMITING`. +# +# Default value: false +#disable_rate_limiting = false + +# Skip the verified-comms-channel gate for login and record writes. +# Please keep this off unless you're an invite-only PDS! +# +# Can also be specified via environment variable `DISABLE_ACCOUNT_VERIFICATION_GATE`. +# +# Default value: false +#disable_account_verification_gate = false + +# List of additional banned words for handle validation. +# +# Can also be specified via environment variable `PDS_BANNED_WORDS`. +#banned_words = + +# URL to a privacy policy page. +# +# Can also be specified via environment variable `PRIVACY_POLICY_URL`. +#privacy_policy_url = + +# URL to terms of service page. +# +# Can also be specified via environment variable `TERMS_OF_SERVICE_URL`. +#terms_of_service_url = + +# Operator contact email address. +# +# Can also be specified via environment variable `CONTACT_EMAIL`. +contact_email = "me@fantomitechno.dev" + +# Maximum allowed blob size in bytes (default 10 GiB). +# +# Can also be specified via environment variable `MAX_BLOB_SIZE`. +# +# Default value: 10737418240 +#max_blob_size = 10737418240 + +# Maximum allowed number of preferences +# +# Can also be specified via environment variable `MAX_PREFERENCES_COUNT`. +# +# Default value: 1000 +#max_preferences_count = 1000 + +# If you're not altering TLS config, you don't have to worry about this. +# This is the number of trusted reverse proxies in front of Tranquil. +# We read the client IP used for rate limiting and device records this many hops +# from the right of the X-Forwarded-For header. +# When left unset, Tranquil will assume: +# - 0, if the TLS termination is happening here on Tranquil via the TLS config +# - 1, if the TLS termination *isn't* happening here. +# +# Can also be specified via environment variable `TRUSTED_PROXY_COUNT`. +#trusted_proxy_count = + +[server.tls] +# The path to the TLS cert chain. +# If you set both this and `key_path`, the server terminates TLS itself rather than expecting +# a reverse proxy to do it. The certificate and key reload on SIGHUP. +# +# Can also be specified via environment variable `TLS_CERT_PATH`. +#cert_path = + +# Path to the TLS private key. +# +# Can also be specified via environment variable `TLS_KEY_PATH`. +#key_path = + +# Serve HTTP/3 over QUIC on the same UDP port as the TCP listener. +# Requires cert_path and key_path. +# +# Can also be specified via environment variable `TLS_HTTP3`. +# +# Default value: false +#http3 = false + +[frontend] +# Whether to enable the built in serving of the frontend. +# +# Can also be specified via environment variable `FRONTEND_ENABLED`. +# +# Default value: true +enabled = true + +# Directory to serve as the frontend. The oauth_client_metadata.json will have any references to +# the frontend hostname replaced by the configured frontend hostname. +# +# Can also be specified via environment variable `FRONTEND_DIR`. +# +# Default value: "/var/lib/tranquil-pds/frontend" +#dir = "/var/lib/tranquil-pds/frontend" + +[database] +# PostgreSQL connection URL. +# +# Can also be specified via environment variable `DATABASE_URL`. +# +# Required! This value must be specified. +#url = + +# Maximum number of connections in the pool. +# +# Can also be specified via environment variable `DATABASE_MAX_CONNECTIONS`. +# +# Default value: 100 +#max_connections = 100 + +# Minimum number of idle connections kept in the pool. +# +# Can also be specified via environment variable `DATABASE_MIN_CONNECTIONS`. +# +# Default value: 10 +#min_connections = 10 + +# Timeout in seconds when acquiring a connection from the pool. +# +# Can also be specified via environment variable `DATABASE_ACQUIRE_TIMEOUT_SECS`. +# +# Default value: 10 +#acquire_timeout_secs = 10 + +[secrets] +# Secret used for signing JWTs. Must be at least 32 characters in +# production. +# +# Can also be specified via environment variable `JWT_SECRET`. +#jwt_secret = + +# Secret used for DPoP proof validation. Must be at least 32 characters +# in production. +# +# Can also be specified via environment variable `DPOP_SECRET`. +#dpop_secret = + +# Master key used for key-encryption and HKDF derivation. Must be at +# least 32 characters in production. +# +# Can also be specified via environment variable `MASTER_KEY`. +#master_key = + +# Optional operator-held PLC recovery key, as a public `did:key`. The PDS +# continues to sign PLC operations with the per-account signing key, which +# always remains in `rotationKeys`. +# +# Can also be specified via environment variable `PLC_ROTATION_KEY`. +#plc_rotation_key = + +# Allow insecure/test secrets. NEVER enable in production. +# +# Can also be specified via environment variable `TRANQUIL_PDS_ALLOW_INSECURE_SECRETS`. +# +# Default value: false +#allow_insecure = false + +[storage] +# Storage backend: `filesystem` or `s3`. +# +# Can also be specified via environment variable `BLOB_STORAGE_BACKEND`. +# +# Default value: "filesystem" +#backend = "filesystem" + +# Path on disk for the filesystem blob backend. +# +# Can also be specified via environment variable `BLOB_STORAGE_PATH`. +# +# Default value: "/var/lib/tranquil-pds/blobs" +#path = "/var/lib/tranquil-pds/blobs" + +# S3 bucket name for blob storage. +# +# Can also be specified via environment variable `S3_BUCKET`. +#s3_bucket = + +# Custom S3 endpoint URL. +# +# Can also be specified via environment variable `S3_ENDPOINT`. +#s3_endpoint = + +# Repository backend: `postgres` by default, or `tranquil-store`, our embedded db. +# tranquil-store is EXPERIMENTAL!!!! RISK OF TOTAL DATA LOSS. +# +# Can also be specified via environment variable `REPO_BACKEND`. +# +# Default value: "postgres" +#repo_backend = "postgres" + +[tranquil_store] +# Directory for tranquil-store data: the metastore, eventlog, and blockstore. +# +# Can also be specified via environment variable `TRANQUIL_STORE_DATA_DIR`. +# +# Default value: "/var/lib/tranquil-pds/store" +#data_dir = "/var/lib/tranquil-pds/store" + +# Fjall block cache size in megabytes. Defaults to 20% of system RAM when unset. +# +# Can also be specified via environment variable `TRANQUIL_STORE_MEMORY_BUDGET_MB`. +#memory_budget_mb = + +# Number of handler threads. Defaults to available_parallelism / 2. +# +# Can also be specified via environment variable `TRANQUIL_STORE_HANDLER_THREADS`. +#handler_threads = + +# Maximum total bytes of pending (unsynced) eventlog payloads. Appenders block +# once this budget is exhausted until in-flight events drain via fsync. Set to +# 0 to disable backpressure. Default: 1 GiB. +# +# Can also be specified via environment variable `TRANQUIL_STORE_EVENTLOG_PENDING_BYTES_BUDGET`. +# +# Default value: 1073741824 +#eventlog_pending_bytes_budget = 1073741824 + +# Maximum size of an individual eventlog payload in bytes. Single events +# larger than this are rejected at append time. Default: 256 MiB. +# +# Can also be specified via environment variable `TRANQUIL_STORE_EVENTLOG_MAX_EVENT_PAYLOAD`. +# +# Default value: 268435456 +#eventlog_max_event_payload = 268435456 + +# Maximum size of an individual blockstore data file in bytes. When the +# active data file reaches this size it is rolled over and becomes +# eligible for compaction. Default: 256 MiB. +# +# Can also be specified via environment variable `TRANQUIL_STORE_MAX_BLOCKSTORE_FILE_SIZE`. +# +# Default value: 268435456 +#max_blockstore_file_size = 268435456 + +# Maximum size of an individual eventlog segment file in bytes. When the +# active segment reaches this size it is sealed and a new one is created. +# Safe to change on a running instance. Default: 256 MiB. +# +# Can also be specified via environment variable `TRANQUIL_STORE_MAX_EVENTLOG_SEGMENT_SIZE`. +# +# Default value: 268435456 +#max_eventlog_segment_size = 268435456 + +[cache] +# Cache backend: `ripple` by default, or `valkey`. +# +# Can also be specified via environment variable `CACHE_BACKEND`. +# +# Default value: "ripple" +#backend = "ripple" + +# Valkey / Redis connection URL. Required when `backend = "valkey"`. +# +# Can also be specified via environment variable `VALKEY_URL`. +#valkey_url = + +[cache.ripple] +# Address to bind the Ripple gossip protocol listener. With the default +# value and no cluster_key or peers configured, the listener binds +# loopback instead and runs as a single node. +# +# Can also be specified via environment variable `RIPPLE_BIND`. +# +# Default value: "0.0.0.0:0" +#bind_addr = "0.0.0.0:0" + +# List of seed peer addresses. +# +# Can also be specified via environment variable `RIPPLE_PEERS`. +#peers = + +# Unique machine identifier. Auto-derived from hostname when not set. +# +# Can also be specified via environment variable `RIPPLE_MACHINE_ID`. +#machine_id = + +# Gossip protocol interval in milliseconds. +# +# Can also be specified via environment variable `RIPPLE_GOSSIP_INTERVAL_MS`. +# +# Default value: 200 +#gossip_interval_ms = 200 + +# Maximum cache size in megabytes. +# +# Can also be specified via environment variable `RIPPLE_CACHE_MAX_MB`. +# +# Default value: 256 +#cache_max_mb = 256 + +# Pre-shared cluster key authenticating ripple peers. Every node in the +# cluster must set the same value. When unset, peers are unauthenticated. +# +# Can also be specified via environment variable `RIPPLE_CLUSTER_KEY`. +#cluster_key = + +# Allow ripple to bind a non-loopback address without a cluster key. +# Peers will be unauthenticated. Intended for trusted private networks. +# +# Can also be specified via environment variable `RIPPLE_ALLOW_INSECURE`. +# +# Default value: false +#allow_insecure = false + +[plc] +# Base URL of the PLC directory. +# +# Can also be specified via environment variable `PLC_DIRECTORY_URL`. +# +# Default value: "https://plc.directory" +#directory_url = "https://plc.directory" + +# HTTP request timeout in seconds. +# +# Can also be specified via environment variable `PLC_TIMEOUT_SECS`. +# +# Default value: 10 +#timeout_secs = 10 + +# TCP connect timeout in seconds. +# +# Can also be specified via environment variable `PLC_CONNECT_TIMEOUT_SECS`. +# +# Default value: 5 +#connect_timeout_secs = 5 + +# Seconds to cache DID documents in memory. +# +# Can also be specified via environment variable `DID_CACHE_TTL_SECS`. +# +# Default value: 300 +#did_cache_ttl_secs = 300 + +[firehose] +# Size of the in-memory broadcast buffer for firehose events. +# +# Can also be specified via environment variable `FIREHOSE_BUFFER_SIZE`. +# +# Default value: 10000 +#buffer_size = 10000 + +# How many hours of historical events to replay for cursor-based +# firehose connections. +# +# Can also be specified via environment variable `FIREHOSE_BACKFILL_HOURS`. +# +# Default value: 72 +#backfill_hours = 72 + +# Maximum concurrent full-repo exports, eg. getRepo without `since`. +# +# Can also be specified via environment variable `MAX_CONCURRENT_REPO_EXPORTS`. +# +# Default value: 4 +#max_concurrent_repo_exports = 4 + +# List of relay / crawler notification URLs. +# +# Can also be specified via environment variable `CRAWLERS`. +#crawlers = + +[email] +# Sender email address. When unset, email sending is disabled. +# +# Can also be specified via environment variable `MAIL_FROM_ADDRESS`. +from_address = "me@no-reply.fantomitechno.dev" + +# Display name used in the `From` header. +# +# Can also be specified via environment variable `MAIL_FROM_NAME`. +# +# Default value: "Tranquil PDS" +#from_name = "Tranquil PDS" + +# HELO/EHLO name announced to remote SMTP servers. Applies to both +# smarthost and direct-MX modes. Defaults to the server hostname. +# +# Can also be specified via environment variable `MAIL_HELO_NAME`. +#helo_name = + +[email.smarthost] +# SMTP relay host. When set, mail is delivered through this host +# instead of resolving recipient MX records directly. +# +# environment variable `MAIL_SMARTHOST_HOST`. + +# SMTP relay port. +# +# environment variable `MAIL_SMARTHOST_PORT`. + +# SMTP authentication username. +# +# environment variable `MAIL_SMARTHOST_USERNAME`. + +# SMTP authentication password. +# +# environment variable `MAIL_SMARTHOST_PASSWORD`. + +# TLS mode. Valid values: "implicit", "starttls", "none". Setting "none" +# alongside a password is rejected at startup to prevent transmitting +# credentials in plaintext. +# +# Can also be specified via environment variable `MAIL_SMARTHOST_TLS`. +# +# Default value: "starttls" +#tls = "starttls" + +# Max size of the connection pool. +# +# Can also be specified via environment variable `MAIL_SMARTHOST_POOL_SIZE`. +# +# Default value: 4 +#pool_size = 4 + +# Per-command SMTP timeout in seconds. Bounds the security handshake. +# +# Can also be specified via environment variable `MAIL_SMARTHOST_COMMAND_TIMEOUT_SECS`. +# +# Default value: 30 +#command_timeout_secs = 30 + +# Total per-message timeout in seconds. Wraps the entire send so a +# stuck relay cannot stall the comms queue. +# +# Can also be specified via environment variable `MAIL_SMARTHOST_TOTAL_TIMEOUT_SECS`. +# +# Default value: 60 +#total_timeout_secs = 60 + +[email.direct_mx] +# Per-command SMTP timeout in seconds. +# +# Can also be specified via environment variable `MAIL_COMMAND_TIMEOUT_SECS`. +# +# Default value: 30 +#command_timeout_secs = 30 + +# Total per-message timeout across all MX attempts in seconds. +# +# Can also be specified via environment variable `MAIL_TOTAL_TIMEOUT_SECS`. +# +# Default value: 60 +#total_timeout_secs = 60 + +# Max number of concurrent direct-MX sends. Limits the load placed +# on any single recipient MX during a backlog drain. +# +# Can also be specified via environment variable `MAIL_MAX_CONCURRENT_SENDS`. +# +# Default value: 8 +#max_concurrent_sends = 8 + +# Require STARTTLS on every MX hop. When false, TLS is +# attempted opportunistically and the session falls back to plaintext +# if the remote does not advertise STARTTLS. Set true to refuse +# plaintext delivery, at the cost of failing sends to MX hosts that +# do not support TLS. +# +# Can also be specified via environment variable `MAIL_REQUIRE_TLS`. +# +# Default value: false +#require_tls = false + +[email.dkim] +# DKIM selector. When unset, outgoing mail is not signed. +# +# Can also be specified via environment variable `MAIL_DKIM_SELECTOR`. +#selector = + +# DKIM signing domain. +# +# Can also be specified via environment variable `MAIL_DKIM_DOMAIN`. +#domain = + +# Path to the DKIM private key in PEM format. Supports RSA and +# Ed25519 keys. +# +# Can also be specified via environment variable `MAIL_DKIM_KEY_PATH`. +#private_key_path = + +[notifications] +# Polling interval in milliseconds for the comms queue. +# +# Can also be specified via environment variable `NOTIFICATION_POLL_INTERVAL_MS`. +# +# Default value: 1000 +#poll_interval_ms = 1000 + +# Number of notifications to process per batch. +# +# Can also be specified via environment variable `NOTIFICATION_BATCH_SIZE`. +# +# Default value: 100 +#batch_size = 100 + +[moderation] +# External report-handling service URL. +# +# Can also be specified via environment variable `REPORT_SERVICE_URL`. +#report_service_url = + +# DID of the external report-handling service. +# +# Can also be specified via environment variable `REPORT_SERVICE_DID`. +#report_service_did = + +[import] +# Whether the PDS accepts repo imports. +# +# Can also be specified via environment variable `ACCEPTING_REPO_IMPORTS`. +# +# Default value: true +#accepting = true + +# Maximum allowed import archive size in bytes (default 1 GiB). +# +# Can also be specified via environment variable `MAX_IMPORT_SIZE`. +# +# Default value: 1073741824 +#max_size = 1073741824 + +# Maximum number of blocks allowed in an import. +# +# Can also be specified via environment variable `MAX_IMPORT_BLOCKS`. +# +# Default value: 500000 +#max_blocks = 500000 + +# Skip CAR verification during import. Only for development/debugging. +# +# Can also be specified via environment variable `SKIP_IMPORT_VERIFICATION`. +# +# Default value: false +#skip_verification = false + +[scheduled] +# Interval in seconds between scheduled delete checks. +# +# Can also be specified via environment variable `SCHEDULED_DELETE_CHECK_INTERVAL_SECS`. +# +# Default value: 3600 +#delete_check_interval_secs = 3600 + +# Interval in seconds between data file compaction scans (tranquil-store only). +# Set to 0 to disable. +# +# Can also be specified via environment variable `COMPACTION_INTERVAL_SECS`. +# +# Default value: 3600 +#compaction_interval_secs = 3600 + +# Liveness ratio threshold below which a data file is compacted (0.0-1.0). +# +# Can also be specified via environment variable `COMPACTION_LIVENESS_THRESHOLD`. +# +# Default value: 0.7 +#compaction_liveness_threshold = 0.7 + +# Grace period in milliseconds before a zero-refcount block can be removed by compaction. +# +# Can also be specified via environment variable `COMPACTION_GRACE_PERIOD_MS`. +# +# Default value: 600000 +#compaction_grace_period_ms = 600000 + +# Interval in seconds between reachability walk runs (tranquil-store only). +# Set to 0 to disable. Default: weekly. +# +# Can also be specified via environment variable `REACHABILITY_WALK_INTERVAL_SECS`. +# +# Default value: 604800 +#reachability_walk_interval_secs = 604800 + +# Interval in seconds between continuous archival passes (tranquil-store only). +# Sealed eventlog segments are copied to the archival destination each tick. +# Set to 0 to disable. Default: 60 seconds. +# +# Can also be specified via environment variable `ARCHIVAL_INTERVAL_SECS`. +# +# Default value: 60 +#archival_interval_secs = 60 + +# Archival destination directory for sealed eventlog segments. +# If unset, archival is disabled. +# +# Can also be specified via environment variable `ARCHIVAL_DEST_DIR`. +#archival_dest_dir = + +# Maximum age of events retained in the eventlog before pruning. +# Per the atproto firehose spec, the relay backfill window only needs +# to cover "hours or days". +# +# Can also be specified via environment variable `EVENT_RETENTION_MAX_AGE_SECS`. +# +# Default value: 604800 +#event_retention_max_age_secs = 604800 + +# Interval in seconds between event retention prune passes. +# Set to 0 to disable. +# +# Can also be specified via environment variable `EVENT_RETENTION_INTERVAL_SECS`. +# +# Default value: 3600 +#event_retention_interval_secs = 3600 diff --git a/docker/fant0mib0t/tranquill-pds/docker-compose.yml b/docker/fant0mib0t/tranquill-pds/docker-compose.yml new file mode 100644 index 0000000..9a0eec2 --- /dev/null +++ b/docker/fant0mib0t/tranquill-pds/docker-compose.yml @@ -0,0 +1,52 @@ +services: + tranquil-pds: + image: atcr.io/tranquil.farm/tranquil-pds:91999819c616afbb26586dce4e1ab70f767684de + # tag: 0.6.5 + restart: unless-stopped + environment: + SERVER_HOST: "[::]" + ports: + - "127.0.0.1:6166:3000" + volumes: + - ./config.toml:/etc/tranquil-pds/config.toml:ro + # In memory of @olaren.dev's blobs when lewis forgot to update /tranquil to /tranquil-pds :( + - /nas/tranquil-pds/blob:/var/lib/tranquil-pds/blobs + - /nas/tranquil-pds/store:/var/lib/tranquil-pds/store + env_file: + - .env + depends_on: + db: + condition: service_healthy + healthcheck: + test: ["CMD", "/usr/local/bin/tranquil-pds", "healthcheck"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 10s + deploy: + resources: + limits: + memory: 1G + reservations: + memory: 256M + + db: + image: postgres:18-alpine + restart: unless-stopped + env_file: + - .env + volumes: + # In memory of @mrrp.lol when Lewis had "/data" here and the account got nuked on restart including rotation key :( + - /nas/tranquil-pds/pg_data:/var/lib/postgresql + healthcheck: + test: ["CMD-SHELL", "pg_isready -U tranquil_pds -d pds"] + interval: 10s + timeout: 5s + retries: 5 + start_period: 10s + deploy: + resources: + limits: + memory: 512M + reservations: + memory: 128M diff --git a/flake.nix b/flake.nix index 454689f..ee0e37f 100644 --- a/flake.nix +++ b/flake.nix @@ -49,11 +49,6 @@ inputs.lucide-src.follows = ""; inputs.mermaid-src.follows = ""; }; - - inputs.tranquil = { - url = "git+https://tangled.org/tranquil.farm/tranquil-pds"; - inputs.nixpkgs.follows = "nixpkgs"; - }; }; outputs = @@ -100,7 +95,7 @@ fantomitechno-msi = commonSystem "msi"; # Servers - conseil = commonSystem "conseil"; + Conseil = commonSystem "conseil"; fant0mib0t = commonSystem "fant0mib0t"; # Installer diff --git a/modules/codium/settings.json b/modules/codium/settings.json index 3415a19..6b362ec 100644 --- a/modules/codium/settings.json +++ b/modules/codium/settings.json @@ -49,5 +49,8 @@ "https://github.com": true }, "editor.fontFamily": "'JetBrainsMono Nerd Font Propo', monospace", - "clangd.path": "/home/fantomitechno/.config/VSCodium/User/globalStorage/llvm-vs-code-extensions.vscode-clangd/install/22.1.0/clangd_22.1.0/bin/clangd" + "clangd.path": "/home/fantomitechno/.config/VSCodium/User/globalStorage/llvm-vs-code-extensions.vscode-clangd/install/22.1.0/clangd_22.1.0/bin/clangd", + "[markdown]": { + "editor.defaultFormatter": "esbenp.prettier-vscode" + } } \ No newline at end of file -- 2.51.2