mastodon

WikiEducator Notes: OERu's course feed aggregation and messaging system

dave — Wed, 23 Aug 2017 21:21:04 +0000

WikiEducator Notes: OERu's course feed aggregation and messaging system

Blog tags

wenotes

couchdb

faye

javascript

node.js

docker

docker compose

mastodon

hypothesis

oeru

lida101

mediawiki

wikieducator

wordpress

dave Thu 24/08/2017 - 09:21

Here at the OERu, we provide a service, attached to all of our online courses (and available to all of our partners - or anyone else for that matter) which allows anyone involved in those courses to communicate with their peers from any one of a dazzling array of online "places" with WikiEducator Notes (aka WEnotes). The entire system is free and open source software (FOSS).

The magic glue is "tags" - most social media and online systems support "tagging" in one way or another. Tools like Twitter, Mastodon, and G+ support "hashtags" like "#OERu" as shorthand. Other tools like blog engines (Medium, WordPress, and others), forums (like Discourse), content annotation services (like Hypothesis), social bookmarking services (like Semantic Scuttle), and instant messaging services (like Rocket.Chat, Riot + Synapse, Zulip, and Mattermost, among others) support adding "tags", "labels" or "categories" to any given post. WEnotes is sensitive to those tags, and thanks to the modern trend towards services providing feeds, it can happily "harvest" relevant content from all over the web, in real time (or nearly, depending on the technology).

How WEnotes components fit together

WEnotes is a collection of a significant number of separate FOSS components. See the graphical diagram of WEnotes alongside this article for an overview of the WEnotes component architecture. To provide further explanation, WEnotes is made up of several functional components:

A set of feed harvesting scripts that are part of the WEnotes-tools project (written in Javascript and Python, for those interested in that sort of detail, the former ideal for those sites producing JSON feeds and real time updates, the latter our choice for periodic scans - every 10 minutes by default at the moment - of RSS and ATOM feeds)
A central CouchDB instance, which stores all posts harvested, along with metadata like their source, a unique ID (to ensure we don't re-harvest it) and some useful info to ensure we can push the messages to subscribers effectively.
The WEnotes client for MediaWiki or WordPress, part of the WEnotes project, which provides a real-time feed of posts, either a full feed (for example this one) or specific to a tag (for example a specific OERu Course). The client also offers a posting interface, allowing logged in users to post new posts (up to 300 characters) automatically tagged in the relevant context. See two screenshots attached.
A "publish-subscribe" or "Pub-Sub" service, WEnotes-server project, a Node.JS based Faye implementation of the Bayeux protocol. It uses websockets to push out real-time updates to subscribed WEnotes clients.
The "couchwatch.js" script, also part of the WEnotes-tools project, watches the CouchDB and alerts Faye whenever a new post is received, which in turn pushes it out to subscribed WENote clients.

Whence WEnotes posts come

Here are three scenarios which outline the process by which a WEnote post is created.

Handy WEnotes post form

The most obvious way to create a WEnotes post is to go to a WEnote feed page - for instance - and log into the system (assuming you have authentication credentials or can create some). If you're logged in, you should see a simple form as illustrated in the two attached screen shots. The system then knows who you are so that your post can be properly attributed, and it knows the "context" for the feed you're looking at (namely the associated tag). You can enter a message of up to 300 characters, and hit the "Post a WEnote" button, and this will send - direct from your browser - a suitably formatted post (a simple JSON object - example below) into the WEnotes CouchDB where it is then available for inclusion in relevant feed displays.

Personal blog post, appropriately tagged

If you register for our Course site, or any course on that site, you have the option of adding a "Blog URL" - that's the web address of your blog (the address of this blog is https://tech.oeru.org, for instance). Because most widely used blogging platforms, like the open source WordPress platform (which is the most widely use web platform in the world, the basis for 25% of all websites!! For the record, this website uses Drupal, which is the 3rd biggest web platform, and is also open source), and proprietary cloud blogging platforms like Blogger and Medium, provide both "tagging" of posts and a built-in RSS feed. When you know what to look for, you'll start to see them all over the place (this blog has one - the logo is the little grey icon on the bottom left corner of this page).

When you create a blog post on your registered blog and tag it with a course-specific tag (each course we run has one, it's usually the short code immediately after the main course website URL: https://course.oeru.org/[course code here]/...) the WEnotes feed harvesters will periodically visit your blog's RSS feed and look for new posts tagged with a course tag. If it finds one, it will create a new post in CouchDB with all the necessary info to provide an informative post in the WEnotes feed, proper author attribution (and an "avatar" picture of you where available!), and a way for interested readers to get to your original post.

Tagged/Hashtagged social media reference

Because the attention of many people is heavily focused on social media - dominated by "network effect" companies like Twitter and Facebook, for better or worse, but also by an array of more open and egalitarian services (which we, on principle, prefer, but recognise that they're far less well marketed due mostly to not taking anyone's money) - we also provide a variety of social media specific "feed harvesters". Some of these periodically scan specific social media technologies for new relevant posts, others perpetually monitor their sources providing instant updates.

If you

Toot including a relevant hashtag (e.g. #oeru or #lida101 for the "Learning in a Digital Age 101" course),
use Hypothesis to annotate a web page, tagging it appropriately (e.g. oeru or lida101),
add a Semantic Scuttle "Bookmark" to a web reference of interest, tagging it appropriately,
add a topic or reply on our Community or Forums Discourse instances also suitably tagged, or
create a Moodle post on a Moodle site running a suitable "student bot",

the WEnotes feed harvesters will find it and create a suitable post in the CouchDB.

How WEnotes feeds are made

Once you have a bunch of WEnotes posts stored in CouchDB, how do we create a feed? At present, we have "WEnotes client" scripts that run either on MediaWiki instances, like Wikieducator, or on WordPress sites, like our Course multisite, for which content is usually provisioned per-course using our "Snapshot" toolchain. In both cases, the client is invoked via the inclusion of a "Widget" in the MediaWiki content that will either be viewed on the MediaWiki instance itself, or on a target WordPress course subsite.

After you log into the Wikieducator site, and create or find a page on which you want a feed, you "Edit source" and you can add both a WEnotes Post template and WEnotes Feed template two simple one line recipes like this:

{{#widget:WEnotesPost|tag=lida101}} {{#widget:WEnotes|tag=lida101|count=20}}

This invocation will create a page showing a WEnotes Post Widget, where any submitted post will automatically be tagged by "lida101", and directly below that, a feed showing up to 20 posts from the CouchDB tagged with "lida101". Note, any new suitably tagged posts will pop into the feed in realtime as they're added to CouchDB thanks to couchwatch.js and Faye - invoking a WEnotes Feed Widget automatically subscribes you to realtime updates for that tag.

You can also create a cross-tag feed using the magic "_" designator. WEnotes Posts require a tag (the default, if none is specified, is "wikieducator"):

{{#widget:WEnotes|tag=_|count=20}}

WEnotes technical details

This is a tech-blog, so I'm not going to shy away from the technical details. Here're some useful bits and pieces for folks wanting to get a better understanding of this system. If you're scared of technical details, you can stop reading here.

WEnotes technology infrastructure

We implement the services making up the WEnotes stack using a set of three Docker containers as well as our main MediaWiki implementation, WikiEducator, and our main WordPress multisite implementation, the OERu Course multisite (we also maintain development instance of each of these). The Docker containers are managed with Docker Compose and the roles are divided We've created a separate code repository on GitHub for our evolving WEnotes stack to facilitate others making use of some or all of it! The three containers currently being deployed do the following:

run CouchDB version 2.0 or later, as well as its "Fauxton" interactive web front-end.
run the Faye Pub-Sub websocket destination for realtime feed updates, implemented as a Node.JS service running under pm2.
run the Javascript (using pm2) and Python-based (using cron to run periodically) feed harvesters and the Javascript "couchwatch.js" script which alerts Faye to the addition of new posts.

Once configured (we're working on making that a straight forward "out-of-the-box" experience, although it's not quite there yet), the three containers can be deployed together with a single invocation of Docker Compose - at the moment, though, this system is quite dependent on a properly configured "options.json" file, the format of which is still in a state of flux.

WENotes JSON object

A WEnotes post is stored in our CouchDB as a JSON object (JSON = JavaScript Object Notation). This is an example of a Post as it's stored in our CouchDB:

{
"_id": "3e1c16eb1c99ae59899761a680006f4a",
"_rev": "1-7462f14a0515d98b5985b9f4b8c39dd5",
"media_attachments": [
 {
 "url": "https://mastodon.oeru.org/system/media_attachments/files/000/000/017/or…",
 "text_url": "https://mastodon.oeru.org/media/jvUoIpj6OAt-e5t-H8k",
 "preview_url": "https://mastodon.oeru.org/system/media_attachments/files/000/000/017/sm…",
 "meta": {
 "small": {
 "width": 400,
 "size": "400x321",
 "aspect": 1.2461059190031152,
 "height": 321
 },
 "original": {
 "width": 1148,
 "size": "1148x921",
 "aspect": 1.246471226927253,
 "height": 921
 }
 },
 "type": "image",
 "id": 17,
 "remote_url": ""
 }
],
"truncated": true,
"reblog": null,
"id": 21,
"in_reply_to_id": null,
"content": "Productive weekend fixing hashtags and instructions for <a href=\"https://mastodon.oeru.org/tags/lida101\" class=\"mention hashtag\" rel=\"tag\">#LiDA101</a> photo challenges . Super cool to see mastodon.oeru,org toots in the course feed. <a href=\"https://mastodon.oeru.org/tags/lida101photo\" class=\"mention hashtag\" rel=\"tag\">#lida101photo</a> <a href=\"https://mastodon.oeru.org/media/jvUoIpj6OAt-e5t-H8k\" rel=\"nofollow noopener\" target=\"_blank\">https://mastodon.oeru.org/media/jvUoIpj6OAt-e5t-H8k</a>",
"application": null,
"text": "Productive weekend fixing hashtags and instructions for #LiDA101 photo challenges . Super cool to see mastodon.oeru,org toots in the course feed. #lida101photo...",
"profile_url": "https://mastodon.oeru.org/@mackiwg",
"tags": [
 {
 "url": "https://mastodon.oeru.org/tags/lida101",
 "name": "lida101"
 },
 {
 "url": "https://mastodon.oeru.org/tags/lida101photo",
 "name": "lida101photo"
 }
],
"visibility": "public",
"we_tags": [
 "lida101"
],
"user": {
 "screen_name": "mackiwg",
 "profile_image_url": "https://mastodon.oeru.org/system/accounts/avatars/000/000/002/original/…",
 "name": "Wayne Mackintosh"
},
"spoiler_text": "",
"we_timestamp": "2017-09-10T04:09:05.000Z",
"account": {
 "username": "mackiwg",
 "display_name": "Wayne Mackintosh",
 "statuses_count": 10,
 "following_count": 1,
 "url": "https://mastodon.oeru.org/@mackiwg",
 "locked": false,
 "created_at": "2017-04-30T01:51:59.778Z",
 "avatar_static": "https://mastodon.oeru.org/system/accounts/avatars/000/000/002/original/…",
 "note": "Open sourcing education at OERu",
 "header": "https://mastodon.oeru.org/headers/original/missing.png",
 "followers_count": 1,
 "avatar": "https://mastodon.oeru.org/system/accounts/avatars/000/000/002/original/…",
 "header_static": "https://mastodon.oeru.org/headers/original/missing.png",
 "acct": "mackiwg",
 "id": 2
},
"favourites_count": 0,
"language": "en",
"url": "https://mastodon.oeru.org/@mackiwg/21",
"we_source": "mastodon",
"in_reply_to_account_id": null,
"uri": "tag:mastodon.oeru.org,2017-09-10:objectId=21:objectType=Status",
"reblogs_count": 0,
"sensitive": false,
"mentions": [],
"created_at": "2017-09-10T04:09:58.197Z"
}

The most crucial things for WEnotes are the values that start with 'we_'. They are used by the system which filters and displays WEnotes posts.

The OERu Tag List

The list of tags which OERu's WEnotes looks for changes from time-to-time, usually growing as we add new course tags or other tags of business. Currently, the list is being updated manually, but it is available as a web feed in JSON format. We intend to provide both a simple editing interface for this list and to provide an API to automate adding new tags. Eventually, when we create a new course on our Course multisite, we expect to be able to automatically register the new course "tag" with the tag list.

Credits

The entire underlying mechanics and most of the cleverness of WikiEducator Notes are thanks to the ingenuity and hard work of Jim Tittsler, my predecessor as OER Foundation Technical Lead.

Add new comment

Installing Mastodon with Docker-Compose on Ubuntu 16.04

dave — Fri, 02 Jun 2017 03:02:31 +0000

Installing Mastodon with Docker-Compose on Ubuntu 16.04

Blog tags

mastodon

ubuntu linux

16.04

nginx

let's encrypt

ruby on rails

docker

docker compose

dave Fri 02/06/2017 - 15:02

Not long ago, Mastodon, an open source, federated alternative to the proprietary network-effect wunderkind, Twitter, came out of no where. Actually, it came out of an insane amount of work done by free and open source powerhouse Eugen Rochko aka Gargron and a small elite developer community, and many predecessors who are part of the GNU Social Fediverse (kudos to Danyl Strype for compiling that excellent history).

Mastodon, unlike Twitter, is entirely community driven - there are no ads, there are no privacy threats, there are no corporate Terms and Conditions to blindly "I Accept". And your Mastodon "persona" can be on a server you control (or that is controlled by someone you trust). Despite being distributed, you're still part of a global network, but one made resilient by its federated, decoupled nature.

Instead of "Tweeting" in 140 characters like on Twitter, your "Toots" are limited to 500 characters (a lot more information can usefully be passed). You can follow people (and they you) by learning their handle - which looks like an email. I've got a couple Mastodon accounts, but my main one right now is lightweight@mastodon.social (I set it up quite a while back, before I set up my first couple Mastodon servers). Actually, Mastodon's biggest problem (in my opinion) right now is that you can't easily migrate your "main" persona from one server to another without losing a lot of its value (historical toots, followers, those you follow, etc.). You can migrate some things, like those you're following, and any users you've "blocked" but it's still fairly rudimentary.

Mastodon includes a nice web interface which will look somewhat familiar to anyone who's used Twitter's "Tweetdeck" web application. Similarly, the GNU Social community has rallied to provide at least 2 separate open source mobile apps (I run Tusky on my LineageOS powered phone at the moment) - I think there're some for iOS, too, although Apple's not as amenable to open source apps.

There's a useful Mastodon FAQ.

Running with the Mastodon Herd

The way I implement a complex Ruby on Rails app like Mastodon is to do as much as possible to keep it at arms length (and stop it from getting anything gooey on my virtual machine). To achieve that comforting isolation, I employ Docker Compose on Ubuntu Linux 16.04. See our Docker Compose article on how to install it (and its dependencies, like Docker itself).

Once you've got Docker Compose running, you can do what I did.

A couple notes:

I have an unprivileged user on my server, "ubuntu". You can use any unprivileged users - I'd encourage you to use sudo rather than login as root.
I use "vim" as my terminal-based text editor below. I think it's a great tool, but it does have a learning curve. If you're daunted (no shame in that), I recommend using "nano" instead - it'll probably installed on most Ubuntu 16.04 instances. If someone suggests you use "emacs" instead, they're jerkin' yer chain (I used emacs for over a decade, I know what I'm talking about).
make sure you have the "git" VCS system installed... sudo apt install git should do it.
you'll need nginx installed, too... sudo apt install nginx-full will do that for you.

After logging into my server (via SSH remotely) as the ubuntu user (you might have different non-privileged user name, that's ok), I did the following (to avoid permissions problems later on, we'll create a "mastodon" group and user with the id 991, used by the Mastodon app by default, on the hosting platform):

groupadd -g 991 mastodon useradd -u 991 -g 991 -c "Mastodon User" -s /usr/bin/nologin -d /home/data/mastodon mastodon
sudo mkdir -p /home/docker /home/data/mastodon sudo chown -R ubuntu:ubuntu /home/docker sudo chown -R mastodon:mastodon /home/data/mastodon
cd /home/docker git clone https://github.com/tootsuite/mastodon.git docker-mastodon cd docker-mastodon

What you then need to do is ensure you're using the current "tagged" release (it'll make your life easiest). You can find out what tags are available:

git tag -l

At present, the latest tag is "v1.4.7" - to use it do this:

git checkout tags/v1.4.7

Obviously, replace this with the most recent tag (note, you might have to look through the whole list to find it!). Then you're using the specific collection of files corresponding to the v1.4.7 tagged release. We can carry on...

cp .env.production.sample .env.production vim .env.production

Edit this file to look like the .env.production sample below, but replacing the [tokens] with your values. Then run this:

vim docker-compose.yml

Edit this file to look like docker-compose.yml below.

docker-compose run --rm web rake secret

Run this last command 3 times - to get 3 secrets - long random strings - for .env.production! Copy and paste your 3 secrets into your .env.production file with your preferred editor as shown below.

docker-compose build docker-compose up

That should download the required Docker images (might take quite a while depending on how fast your server's network connection is) and result in starting 5 different Docker containers, and you'll be able to watch them put out status (and error) messages as they boot and find their various dependencies. If there're no obvious errors, you can hit CTRL-C to shut them down again and restart them in a mode that keeps them running after you log out

docker-compose up -d

Note, you can always stop the containers by running docker-compose stop in that directory. You can check their status by running

docker ps

which should show you something like this:

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES c6be9f3eef1e gargron/mastodon "bundle exec rails s " 13 days ago Up 13 days 127.0.0.1:3000->3000/tcp, 4000/tcp dockermastodon_web_1 6a123d9b1843 gargron/mastodon "bundle exec sidekiq " 13 days ago Up 13 days 3000/tcp, 4000/tcp dockermastodon_sidekiq_1 f06c4a9bc479 gargron/mastodon "npm run start" 13 days ago Up 13 days 3000/tcp, 127.0.0.1:4000->4000/tcp dockermastodon_streaming_1 6dbfad0669f8 postgres:alpine "docker-entrypoint.sh" 2 weeks ago Up 13 days 5432/tcp dockermastodon_postgres_1 8026b79e976d redis:alpine "docker-entrypoint.sh" 4 weeks ago Up 13 days 6379/tcp dockermastodon_redis_1

You can use the 12 digit IDs to run other Docker commands, like docker inspect [ID] or docker exec -it [ID] bash to log into the container itself and get a bash prompt. After all that's running, you can do some final housekeeping:

docker-compose run --rm web rails db:migrate docker-compose run --rm web rails assets:precompile sudo vim /etc/nginx/sites-available/mastodon

Edit this to look like the mastodon nginx config file below.

sudo cd /etc/nginx/sites-enabled sudo ln -sf ../sites-available/mastodon .

to enable the new configuration...

sudo nginx -t

To check for typos in you file. If you get no errors, you can restart nginx:

sudo service nginx restart

When that's done, to [your domain] in your browser, which should take you to https://[your domain] and create a new user. If your email is set up properly, you'll get an email confirmation, and this will allow you to log in. If that works, I'd encourage you to modify your configuration to use a Let's Encrypt SSL certificate to protect your users' (and your server's) security. We provide this dedicated howto! The .env.production template below assumes you've done this, so if your Mastodon isn't working, that might be why (you can try turning LOCAL_HTTPS=false temporarily if that's helpful).

You will want to create an admin user - create the user first through the web interface, and then on the command line run (replacing [admin username] with the username you set up:

cd /home/docker/docker-mastodon docker-compose run --rm web rails mastodon:make_admin USERNAME=[admin username]

Then go to that user's Mastodon preferences and define the relevant info for your instance (see the administration options).

Debugging

If you run in to problems, a very useful Docker Compose option to use (from within the docker-mastodon directory) is

docker-compose logs -f

It will provide you with the automatically updating integrated logs of all the containers you've unleashed!

Sample .env.production

Here's a sample with (hopefully obviously named) [placeholders]

# Service dependencies REDIS_HOST=redis REDIS_PORT=6379 DB_HOST=postgres DB_USER=postgres DB_NAME=postgres DB_PASS= DB_PORT=5432

# Federation LOCAL_DOMAIN=[your domain] LOCAL_HTTPS=true

# Application secrets # Generate each with the `rake secret` task (`docker-compose run --rm web rake secret` if you use docker compose) PAPERCLIP_SECRET=[first secret] SECRET_KEY_BASE=[second secret] OTP_SECRET=[third secret]

# Registrations # Single user mode will disable registrations and redirect frontpage to the first profile # SINGLE_USER_MODE=true # Prevent registrations with following e-mail domains # EMAIL_DOMAIN_BLACKLIST=example1.com|example2.de|etc

# E-mail configuration SMTP_SERVER=[smtp server domain name] SMTP_PORT=587 SMTP_LOGIN=[smtp user name] SMTP_PASSWORD=[smtp user password] SMTP_FROM_ADDRESS=[sender address for outgoing mastodon emails] SMTP_DOMAIN=[your site's base domain] SMTP_OPENSSL_VERIFY_MODE=none

# Optional asset host for multi-server setups # CDN_HOST=assets.example.com

# S3 (optional) # S3_ENABLED=true # S3_BUCKET= # AWS_ACCESS_KEY_ID= # AWS_SECRET_ACCESS_KEY= # S3_REGION= # S3_PROTOCOL=http # S3_HOSTNAME=192.168.1.123:9000

# Optional alias for S3 if you want to use Cloudfront or Cloudflare in front # S3_CLOUDFRONT_HOST=

# Streaming API integration # STREAMING_API_BASE_URL=

Sample docker-compose.yml

Here's a sample with [placeholders]. Note - this generates five Docker containers. Yeah, like I said, this is a serious, complex app.

version: '2' services: postgres:     restart: unless-stopped     image: postgres:alpine     volumes:      - /home/data/mastodon/postgres:/var/lib/postgresql/data redis:     restart: unless-stopped     image: redis:alpine     volumes:      - /home/data/mastodon/redis:/data web:     restart: unless-stopped     build: .     image: gargron/mastodon     env_file: .env.production     command: bundle exec rails s -p 3000 -b '0.0.0.0'     ports:       - "127.0.0.1:3000:3000"     depends_on:       - postgres       - redis     volumes:       - /home/data/mastodon/packs:/mastodon/public/packs
      - /home/data/mastodon/assets:/mastodon/public/assets
      - /home/data/mastodon/system:/mastodon/public/system streaming:     restart: unless-stopped     build: .     image: gargron/mastodon     env_file: .env.production     command: npm run start     ports:       - "127.0.0.1:4000:4000"     depends_on:       - postgres       - redis sidekiq:     restart: unless-stopped     build: .     image: gargron/mastodon     env_file: .env.production     command: bundle exec sidekiq -q default -q mailers -q pull -q push     depends_on:       - postgres       - redis     volumes:       - /home/data/mastodon/system:/mastodon/public/system

Sample nginx mastodon config file

Here's a copy of the nginx configuration file I use (with [placeholders], obviously) - it's the result of quite a lot of tweaking. Have fun!

map $http_upgrade $connection_upgrade { default upgrade; '' close; }

server { listen 80; # listen [::]:80; server_name [your domain]; root /var/www/html;

# for let's encrypt renewals! location /.well-known/acme-challenge/ { default_type text/plain; root /var/www/html; }

# redirect all HTTP traffic to HTTPS. location / { return 302 https://[your domain]$request_uri; } }

server { listen 443 ssl; # listen [::]:443 ssl; server_name [your domain];

ssl_certificate /etc/letsencrypt/live/[your domain]/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/[your domain]/privkey.pem; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # from https://0x39b.fr/post/nginx_security/ ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; #ssl_session_tickets off; ssl_prefer_server_ciphers on; ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256'; # OCSP Stapling --- # fetch OCSP records from URL in ssl_certificate and cache them ssl_stapling on; ssl_stapling_verify on; # to create this, see https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html ssl_dhparam /etc/ssl/certs/dhparam.pem;

# for let's encrypt renewals! location /.well-known/acme-challenge/ { default_type text/plain; root /var/www/html; }

keepalive_timeout 70; sendfile on; client_max_body_size 0; # update from https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Production-guide.md gzip on; gzip_vary on; gzip_proxied any; gzip_comp_level 6; gzip_buffers 16 8k; gzip_http_version 1.1; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

location / { try_files $uri @proxy; }

location ~ ^/(packs|system/media_attachments/files|system/accounts/avatars) { add_header Cache-Control "public, max-age=31536000, immutable"; try_files $uri @proxy; }

    location @proxy {         proxy_set_header Host $host;         proxy_set_header X-Real-IP $remote_addr;         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;         proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Proxy "";
        proxy_pass_header Server;         proxy_pass http://localhost:3000;         proxy_buffering off;         proxy_redirect off;         proxy_http_version 1.1;         proxy_set_header Upgrade $http_upgrade;         proxy_set_header Connection $connection_upgrade;         tcp_nodelay on;     }

location /api/v1/streaming { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; proxy_set_header Proxy ""; proxy_pass http://localhost:4000; proxy_buffering off; proxy_redirect off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; tcp_nodelay on; }

error_page 500 501 502 503 504 /500.html; # this should give you an A+ rating on https://instances.mastodon.xyz/ add_header X-XSS-Protection "1; mode=block"; add_header Content-Security-Policy "default-src 'none'; font-src 'self'; media-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; img-src 'self' data: blob:; connect-src 'self' wss://[your domain]"; }

Enjoy!

Keeping Mastodon up to date

To ensure your Mastodon doesn't become a run down abandoned trailerpark node bit rotting quietly in the ether, I recommend you keep it up to date! There is a useful Mastodon Administrator's guide for Docker instances that I consult every time I want to update. Note, if the "git stash" part of it is too hard, I recommend that any time you change your docker-compose.yml file, you copy it to

cp docker-compose.yml docker-compose.yml-backup

That way, you can simply remove docker-compose.yml (double check your docker-compose.yml-backup is up-to-date first!), do the git checkout TAG_NAME, and then

cp docker-compose.yml-backup docker-compose.yml

and you're done. Welcome the Fediverse!