techne/mastodon.org

#+title: Mastodon
#+setupfile: ../org-templates/page.org

** Full-text search with elasticsearch
*** Install ElasticSearch
#+begin_src shell
sudo apt install -y openjdk-17-jre-headless

wget -O /usr/share/keyrings/elasticsearch.asc https://artifacts.elastic.co/GPG-KEY-elasticsearch

echo "deb [signed-by=/usr/share/keyrings/elasticsearch.asc] https://artifacts.elastic.co/packages/7.x/apt stable main" > /etc/apt/sources.list.d/elastic-7.x.list

sudo apt update

sudo apt install -y elasticsearch
#+end_src

*** Edit ~/etc/elasticsearch/elasticsearch.yaml~
#+begin_src yaml
xpack.security.enabled: true
discovery.type: single-node
#+end_src

*** Create passwords for built-in users
#+begin_src shell
sudo -u elasticsearch /usr/share/elasticsearch/bin/elasticsearch
#+end_src

In a separate shell:
#+begin_src shell
sudo -u elasticsearch /usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto
#+end_src

Copy the generated password for the ~elastic~ user.

*** Create custom role for Mastodon to connect
As the mastodon user on the host:
#+begin_src shell
curl -X POST -u elastic:admin_password "localhost:9200/_security/role/mastodon_full_access?pretty" -H 'Content-Type: application/json' -d'
{
    "cluster": ["monitor"],
    "indices": [{
        "names": ["*"],
        "privileges": ["read", "monitor", "write", "manage"]
    }]
}
'
#+end_src

*** Create a user for Mastodon and assign it the custom role
#+begin_src shell
curl -X POST -u elastic:admin_password "localhost:9200/_security/user/mastodon?pretty" -H 'Content-Type: application/json' -d'
{
    "password": "l0ng-r4nd0m-p@ssw0rd",
    "roles": ["mastodon_full_access"]
}
'
#+end_src

*** Edit .env.production
#+begin_src shell
ES_ENABLED=true
ES_HOST=localhost
ES_PORT=9200
ES_PRESET=single_node_cluster
ES_USER=mastodon
ES_PASS=l0ng-r4ndom-p@ssw0rd
#+end_src

*** Populate the indices
#+begin_src shell
systemctl restart mastodon-sidekiq
systemctl reload mastodon-web
su - mastodon
cd live
RAILS_ENV=production bin/tootctl search deploy
#+end_src

** S3-compatible object storage with Minio
1. Install MinIO
2. Set the region for this instance to ~homelab~
3. Create 'mastodata' bucket
4. Setup Tailscale

Minio API endpoint: tailnet_ip_addr:9000

*** Caddy reverse proxy config
#+begin_quote
Ensure DNS resolves for assets.hyperreal.coffee
#+end_quote

#+begin_src caddy
assets.hyperreal.coffee {
    rewrite * /mastodata{path}
    reverse_proxy http://<tailnet_ip_addr>:9000 {
        header_up Host {upstream_hostport}
    }
}

fedi.hyperreal.coffee {
    @local {
        file
        not path /
    }
    @local_media {
        path_regexp /system/(.*)
    }

    redir @local_media https://assets.hyperreal.coffee/{http.regexp.1} permanent

    ...remainer of config
}
#+end_src

*** Set custom policy on mastodata bucket
#+begin_src json
{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Principal": {
           "AWS": "*"
         },
         "Action": "s3:GetObject",
         "Resource": "arn:aws:s3:::mastodata/*"
      }
   ]
}
#+end_src

*** Create mastodon-readwrite policy
#+begin_src json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::mastodata/*"
        }
    ]
}
#+end_src

*** Setup .env.production
#+begin_src shell
S3_ENABLED=true
S3_BUCKET=mastodata
AWS_ACCESS_KEY=<access key>
AWS_SECRET_ACCESS_KEY=<secret access key>
S3_REGION=homelab
S3_PROTOCOL=http
S3_ENDPOINT=http://<tailnet_ip_addr>:9000
S3_FORCE_SINGLE_REQUEST=true
S3_ALIAS_HOST=assets.hyperreal.coffee
#+end_src

*** Restart Caddy and Mastodon services
#+begin_src shell
sudo systemctl restart caddy.service mastodon-web.service mastodon-streaming.service mastodon-sidekiq.service
#+end_src