Commit graph

15814 commits

Author SHA1 Message Date
Floatingghost 9d2c558f64 remove unused import 2024-10-26 07:42:43 +01:00
Floatingghost ac25b051ae remove previous "allow user routes" functionality 2024-10-26 07:28:43 +01:00
Floatingghost c5a44a59db remove unneeded index 2024-10-26 07:00:38 +01:00
Floatingghost 58d5d9d7bf fix tests, contain object 2024-10-26 06:58:47 +01:00
Floatingghost b6e8fde4dd Merge branch 'develop' into keys-extraction 2024-10-26 06:11:29 +01:00
Floatingghost bee10eab5e correct minor zip behaviour 2024-10-26 06:11:12 +01:00
Floatingghost 13215f5f06 remove public key field 2024-10-26 05:28:55 +01:00
Floatingghost 430b376ded mix format 2024-10-26 05:05:48 +01:00
Floatingghost ccf1007883 Fix about a million tests 2024-10-26 05:05:48 +01:00
Floatingghost 6da783b84d Fix http signature plug tests 2024-10-26 05:05:48 +01:00
Floatingghost 8f322456a0 Allow unsigned fetches of a user's public key 2024-10-26 05:05:48 +01:00
Floatingghost 9c876cea21 Fix some tests 2024-10-26 05:05:48 +01:00
Floatingghost 9728e2f8f7 adjust logic to use relation :signing_key 2024-10-26 05:05:47 +01:00
Floatingghost b0f7da9ce0 remove now-unused Keys module 2024-10-26 05:05:28 +01:00
Floatingghost fc99c694e6 Add signing key modules 2024-10-26 05:05:28 +01:00
Floatingghost fbb13fde76 Merge branch 'develop' of akkoma.dev:AkkomaGang/akkoma into develop 2024-10-26 05:04:27 +01:00
Floatingghost cbd236aeb5 mix format 2024-10-26 05:04:20 +01:00
floatingghost 71d3bbd7be Merge pull request 'Fix wrong type when importing emojis' (#841) from tudbut/akkomafixes:emojis into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/841
2024-10-26 04:00:12 +00:00
floatingghost 98a3dab10a Merge pull request 'Fix fs error while unpacking frontends' (#839) from tudbut/akkomafixes:frontends into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/839
2024-10-26 03:58:40 +00:00
TudbuT 661b7fedb6
fix wrong type when importing emojis 2024-10-18 14:57:31 +02:00
TudbuT 8b5aca9619
fix fs error while unpacking frontends 2024-10-18 14:50:28 +02:00
floatingghost f101886709 Merge pull request 'Federate emoji as anonymous objects' (#815) from Oneric/akkoma:emoji-id into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/815
2024-10-16 14:58:46 +00:00
floatingghost 09fa7227f6 Merge pull request 'Tweak fetch security checks' (#819) from Oneric/akkoma:id-refetch into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/819
2024-10-16 14:16:14 +00:00
Oneric d5b0720596 Allow cross-domain redirects on AP requests
Since we now remember the final location redirects lead to
and use it for all further checks since
3e134b07fa, these redirects
can no longer be exploited to serve counterfeit objects.

This fixes:
 - display URLs from independent webapp clients
   redirecting to the canonical domain
 - Peertube display URLs for remote content
   (acting like the above)
2024-10-14 01:42:51 +02:00
Oneric 940792f8ba Refetch on AP ID mismatch
As hinted at in the commit message when strict checking
was added in 8684964c5d,
refetching is more robust than display URL comparison
but in exchange is harder to implement correctly.

A similar refetch approach is also employed by
e.g. Mastodon, IceShrimp and FireFish.

To make sure no checks can be bypassed by forcing
a refetch, id checking is placed at the very end.

This will fix:
 - Peertube display URL arrays our transmogrifier fails to normalise
 - non-canonical display URLs from alternative frontends
   (theoretical; we didnt’t get any actual reports about this)

It will also be helpful in the planned key handling overhaul.

The modified user collision test was introduced in
https://git.pleroma.social/pleroma/pleroma/-/merge_requests/461
and unfortunately the issues this fixes aren’t public.
Afaict it was just meant to guard against someone serving
faked data belonging to an unrelated domain. Since we now
refetch and the id actually is mocked, lookup now succeeds
but will use the real data from the authorative server
making it unproblematic. Instead modify the fake data further
and make sure we don’t end up using the spoofed version.
2024-10-14 01:42:43 +02:00
floatingghost 3c72b48a05 Merge pull request 'Fix busywait on docker-entrypoint script' (#832) from cevado/akkoma:fix-busy-wait-docker-entrypoint into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/832
2024-09-24 23:52:07 +00:00
floatingghost 6475cf127e Merge pull request 'Overhaul OpenRC service file and disable busy wait by default' (#834) from Oneric/akkoma:openrc-upd into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/834
2024-09-24 23:50:48 +00:00
Oneric a8a231c5b2 Don't busy wait in default from-source service files 2024-09-24 17:36:54 +02:00
Oneric 2901fda29c openrc: recompile with lower CPU prio 2024-09-24 16:58:54 +02:00
Oneric bd14440386 openrc: overhaul service file
- pass env vars the proper™ way
- write log to file
- drop superfluous command_background
- make settings easily overwritable via conf.d
  to avoid needing to edit the service file directly
  if e.g. Akkoma was installed to another location
2024-09-24 16:58:35 +02:00
cevado b312edac4c
Fix busywait on docker-entrypoint script 2024-08-20 19:29:11 -03:00
floatingghost 3bb31117e6 Merge pull request 'Handle domain mutes on the backend' (#804) from domain-mute-backend-processing into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/804
2024-08-20 10:32:47 +00:00
Floatingghost 2c5c531c35 readd comment about domain mutes 2024-08-20 11:05:36 +01:00
floatingghost 3ff0f46b9f Merge pull request 'Docs: Improve backup restore + fix warnings' (#554) from ilja/akkoma:docs_db_create_in_separate_commands into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/554
2024-06-25 21:33:42 +00:00
Oneric 4ff5293093 Federate emoji as anonymous objects
Usually an id should point to another AP object
and the image file isn’t an AP object. We currently
do not provide standalone AP objects for emoji and
don't keep track of remote emoji at all.
Thus just federate them as anonymous objects,
i.e. objects only existing within a parent context
and using an explicit null id.

IceShrimp.NET previously adopted anonymous objects
for remote emoji without any apparent issues. See:
333611f65e

Fixes: https://akkoma.dev/AkkomaGang/akkoma/issues/694
2024-06-23 20:46:59 +02:00
floatingghost 4f0cb61782 Merge pull request 'Move prune changelog entries to correct version' (#808) from norm/akkoma:prune-changelog into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/808
2024-06-23 02:20:36 +00:00
floatingghost 5fdb5d69d2 Merge pull request 'Update Caddyfile' (#809) from norm/akkoma:caddyfile-update into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/809
2024-06-23 02:20:24 +00:00
floatingghost f66135ed08 Merge pull request 'Avoid accumulation of stale data in websockets' (#806) from Oneric/akkoma:websocket_fullsweep into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/806
Reviewed-by: floatingghost <hannah@coffee-and-dreams.uk>
2024-06-23 02:19:36 +00:00
floatingghost dc34328f15 Merge pull request 'Fix elixir 1.17 and migration lock warnings' (#810) from Oneric/akkoma:ex1.17-warnings into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/810
2024-06-23 02:18:41 +00:00
Oneric 13e2a811ec Avoid accumulation of stale data in websockets
We’ve received reports of some specific instances slowly accumulating
more and more binary data over time up to OOMs and globally setting
ERL_FULLSWEEP_AFTER=0 has proven to be an effective countermeasure.
However, this incurs increased cpu perf costs everywhere and is
thus not suitable to apply out of the box.

Apparently long-lived Phoenix websocket processes are known to
often cause exactly this by getting into a state unfavourable
for the garbage collector.
Therefore it seems likely affected instances are using timeline
streaming and do so in just the right way to trigger this. We
can tune the garbage collector just for websocket processes
and use a more lenient value of 20 to keep the added perf cost
in check.

Testing on one affected instance appears to confirm this theory

Ref.:
  https://www.erlang.org/doc/man/erlang#ghlink-process_flag-2-idp226
  https://blog.guzman.codes/using-phoenix-channels-high-memory-usage-save-money-with-erlfullsweepafter
  https://git.pleroma.social/pleroma/pleroma/-/merge_requests/4060

Tested-by: bjo
2024-06-22 22:22:33 +02:00
Oneric 1a4238bf98 cosmetic: fix concurrent index creation warnings
Since those old migrations will now most likely only run during db init,
there’s not much point in running them in the background concurrently
anyway, so just drop the cncurrent setting rather than disabling
migration locks.
2024-06-19 02:25:23 +02:00
Oneric c3069b9478 cosmetic: fix elixir 1.17 compiler warnings in main application 2024-06-19 01:49:59 +02:00
Norm 51f09531c4 Disable gzip compression in Caddyfile
Currently Akkoma doesn't have any proper mitigations against BREACH,
which exploits the use of HTTP compression to exfiltrate sensitive data.
(see: https://akkoma.dev/AkkomaGang/akkoma/pulls/721#issuecomment-11487)

To err on the side of caution, disable gzip compression for now until we
can confirm that there's some sort of mitigation in place (whether that
would be Heal-The-Breach on the Caddy side or any Akkoma-side
mitigations).
2024-06-17 23:13:55 -04:00
Norm 962847fdc3 Uncomment media subdomain settings in Caddyfile
Now that a media subdomain is strongly recommended for security reasons,
there is no reason for them to be commented out by default.
2024-06-17 23:12:55 -04:00
Norm 83aab0859a Move prune changelog entries to correct version 2024-06-17 22:41:40 -04:00
Weblate eb2b0d26e4 Update translation files
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Co-authored-by: Weblate <noreply@weblate.org>
Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/
Translation: Pleroma fe/Akkoma Backend (Config Descriptions)
2024-06-17 21:53:04 +00:00
Weblate 91870590ec Update translation files
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Co-authored-by: Weblate <noreply@weblate.org>
Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/
Translation: Pleroma fe/Akkoma Backend (Config Descriptions)
2024-06-17 21:53:04 +00:00
Weblate c442877c25 Update translation files
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Co-authored-by: Weblate <noreply@weblate.org>
Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/
Translation: Pleroma fe/Akkoma Backend (Config Descriptions)
2024-06-17 21:53:04 +00:00
Weblate 16af0bad55 Update translation files
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Co-authored-by: Weblate <noreply@weblate.org>
Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/
Translation: Pleroma fe/Akkoma Backend (Config Descriptions)
2024-06-17 21:53:04 +00:00
Weblate 16ee6ed500 Update translation files
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Co-authored-by: Weblate <noreply@weblate.org>
Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/
Translation: Pleroma fe/Akkoma Backend (Config Descriptions)
2024-06-17 21:53:04 +00:00