Solarpunk
/
funkwhale
6
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update funkwhale config for latest funkwhale (v1.3.1)

This commit is contained in:
Vivianne 2023-07-01 21:20:48 -04:00
parent 4491901f53
commit b72f2379d4
3 changed files with 29 additions and 157 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
docker-compose.yml
View File

@ -3,33 +3,33 @@ version: "3"
services:
postgres:
restart: unless-stopped
networks:
- default
env_file: .env
environment:
- "POSTGRES_HOST_AUTH_METHOD=trust"
image: postgres:11
image: postgres:15-alpine
networks:
- default
volumes:
- ./data/postgres:/var/lib/postgresql/data
redis:
restart: unless-stopped
env_file: .env
image: redis:7-alpine
networks:
- default
env_file: .env
image: redis:5
volumes:
- ./data/redis:/data
celeryworker:
restart: unless-stopped
image: funkwhale/funkwhale:${FUNKWHALE_VERSION:-latest}
networks:
- default
image: funkwhale/api:${FUNKWHALE_VERSION:-latest}
depends_on:
- postgres
- redis
env_file: .env
networks:
- default
# Celery workers handle background tasks (such file imports or federation
# messaging). The more processes a worker gets, the more tasks
# can be processed in parallel. However, more processes also means
@ -38,7 +38,12 @@ services:
# of CPUs. You can adjust this, by explicitly setting the --concurrency
# flag:
# celery -A funkwhale_api.taskapp worker -l INFO --concurrency=4
command: celery -A funkwhale_api.taskapp worker -l INFO --concurrency=${CELERYD_CONCURRENCY-0}
command:
- celery
- --app=funkwhale_api.taskapp
- worker
- --loglevel=INFO
- --concurrency=${CELERYD_CONCURRENCY-0}
environment:
- C_FORCE_ROOT=true
volumes:
@ -47,18 +52,22 @@ services:
celerybeat:
restart: unless-stopped
image: funkwhale/funkwhale:${FUNKWHALE_VERSION:-latest}
image: funkwhale/api:${FUNKWHALE_VERSION:-latest}
networks:
- default
command:
- celery
- --app=funkwhale_api.taskapp
- beat
- --loglevel=INFO
depends_on:
- postgres
- redis
env_file: .env
command: celery -A funkwhale_api.taskapp beat --pidfile= -l INFO
api:
restart: unless-stopped
image: funkwhale/funkwhale:${FUNKWHALE_VERSION:-latest}
image: funkwhale/api:${FUNKWHALE_VERSION:-latest}
networks:
default:
aliases:
@ -72,13 +81,10 @@ services:
- "${MUSIC_DIRECTORY_SERVE_PATH-/srv/funkwhale/data/music}:${MUSIC_DIRECTORY_PATH-/music}:ro"
- "${MEDIA_ROOT}:${MEDIA_ROOT}"
- "${STATIC_ROOT}:${STATIC_ROOT}"
- "${FUNKWHALE_FRONTEND_PATH}:/frontend"
ports:
- "5000"
nginx:
front:
restart: unless-stopped
image: nginx
image: funkwhale/front:${FUNKWHALE_VERSION:-latest}
networks:
- default
- httpsproxy
@ -93,19 +99,13 @@ services:
- "traefik.http.routers.funkwhale.tls.certresolver=leresolver"
- "traefik.http.routers.funkwhale.entrypoints=websecure"
environment:
# Override those variables in your .env file if needed
- "NGINX_MAX_BODY_SIZE=${NGINX_MAX_BODY_SIZE-100M}"
volumes:
- "./nginx/funkwhale.template:/etc/nginx/conf.d/funkwhale.template:ro"
- "./nginx/funkwhale_proxy.conf:/etc/nginx/funkwhale_proxy.conf:ro"
- "${MUSIC_DIRECTORY_SERVE_PATH-/srv/funkwhale/data/music}:${MUSIC_DIRECTORY_PATH-/music}:ro"
- "${MEDIA_ROOT}:${MEDIA_ROOT}:ro"
- "${STATIC_ROOT}:${STATIC_ROOT}:ro"
- "${FUNKWHALE_FRONTEND_PATH}:/frontend:ro"
command: >
sh -c "envsubst \"`env | awk -F = '{printf \" $$%s\", $$1}'`\"
< /etc/nginx/conf.d/funkwhale.template
> /etc/nginx/conf.d/default.conf
&& cat /etc/nginx/conf.d/default.conf
&& nginx -g 'daemon off;'"
- "${STATIC_ROOT}:/usr/share/nginx/html/staticfiles:ro"
networks:
mail:

112
nginx/funkwhale.template
View File

@ -1,111 +1 @@
upstream funkwhale-api {
# depending on your setup, you may want to update this
server funkwhale_api:5000;
}
# required for websocket support
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 80;
server_name ${FUNKWHALE_HOSTNAME};
# TLS
# Feel free to use your own configuration for SSL here or simply remove the
# lines and move the configuration to the previous server block if you
# don't want to run funkwhale behind https (this is not recommended)
# have a look here for let's encrypt configuration:
# https://certbot.eff.org/all-instructions/#debian-9-stretch-nginx
root /frontend;
# If you are using S3 to host your files, remember to add your S3 URL to the
# media-src and img-src headers (e.g. img-src 'self' https://<your-S3-URL> data:)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' https://*.digitaloceanspaces.com data:; font-src 'self' data:; object-src 'none'; media-src 'self' https://*.digitaloceanspaces.com data:";
add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header X-Frame-Options "SAMEORIGIN" always;
location / {
include /etc/nginx/funkwhale_proxy.conf;
# this is needed if you have file import via upload enabled
client_max_body_size ${NGINX_MAX_BODY_SIZE};
proxy_pass http://funkwhale-api/;
}
location /front/ {
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:";
add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header Service-Worker-Allowed "/";
alias /frontend/;
expires 30d;
add_header Pragma public;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
}
location /front/embed.html {
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:";
add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header X-Frame-Options "" always;
alias /frontend/embed.html;
expires 30d;
add_header Pragma public;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
}
location /federation/ {
include /etc/nginx/funkwhale_proxy.conf;
proxy_pass http://funkwhale-api/federation/;
}
# You can comment this if you do not plan to use the Subsonic API
location /rest/ {
include /etc/nginx/funkwhale_proxy.conf;
proxy_pass http://funkwhale-api/api/subsonic/rest/;
}
location /.well-known/ {
include /etc/nginx/funkwhale_proxy.conf;
proxy_pass http://funkwhale-api/.well-known/;
}
location /media/ {
alias ${MEDIA_ROOT}/;
}
# this is an internal location that is used to serve
# audio files once correct permission / authentication
# has been checked on API side
#location /_protected/media {
# internal;
# alias ${MEDIA_ROOT};
#}
# Comment the previous location and uncomment this one if you're storing
# media files in a S3 bucket
location ~ /_protected/media/(.+) {
internal;
# Needed to ensure DSub auth isn't forwarded to S3/Minio, see #932
proxy_set_header Authorization "";
proxy_pass $1;
}
location /_protected/music {
# this is an internal location that is used to serve
# audio files once correct permission / authentication
# has been checked on API side
# Set this to the same value as your MUSIC_DIRECTORY_PATH setting
internal;
alias ${MUSIC_DIRECTORY_PATH};
}
location /staticfiles/ {
# django static files
alias ${STATIC_ROOT}/;
}
}
../front/docker/funkwhale.conf.template

20
nginx/funkwhale_proxy.conf
View File

@ -1,19 +1 @@
# use this one if you put the nginx container behind another proxy
# you will have to set some headers on this proxy as well to ensure
# everything works correctly, you can use the ones from the funkwhale_proxy.conf file
# at https://dev.funkwhale.audio/funkwhale/funkwhale/blob/develop/deploy/funkwhale_proxy.conf
# your proxy will also need to support websockets
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
proxy_set_header X-Forwarded-Host $http_x_forwarded_host;
proxy_set_header X-Forwarded-Port $http_x_forwarded_port;
proxy_redirect off;
# websocket support
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
../front/docker/funkwhale_proxy.conf