喺Ubuntu Server 16.04上面部署Mastodon! | 第三機關 TTO

For English Speaker who use Archlinux to deploy:https://gist.github.com/xatier/60894616c88695d2e5b7c9ddcb64305c

前言

如果你英文ok嘅話，呢度有更詳盡嘅介紹：[https://opensource.com/article/17/4/guide-to-mastodon
    (https://opensource.com/article/17/4/guide-to-mastodon)

或者直頭上佢嘅GitHub研究：https://github.com/tootsuite/mastodon

    #

    其實宜家喺可以透過Scalingo/Heroku等現成嘅Platform一鍵Deploy。好處固然喺方便，但喺，其實咁一鍵Deploy亦會引發好多Bug，例如唔用得Gif同個Timeline唔識Auto-Refresh——當然如果呢包容到嘅話，咁未嘗唔喺唔用得嘅。

    咁今次呢篇文章就喺直接喺乜柒都無，乾淨嘅Ubuntu Server 16.04上面透過Docker裝Mastodon。

    首先開始之前，你必須準備好：

    1.一部有Public IP嘅Ubuntu Server 16.04（當然唔喺Ubuntu都得，但喺唔保證步驟會否唔同，推介用Digital Ocean：[https://m.do.co/c/86456b880fed](https://m.do.co/c/86456b880fed)）

    2.SMTP 嘅賬戶（用來send activate mail，當然你一個人用咁可以慳返。下文最後會有點人手activate）

    3.一個自家Domain（無嘅可以喺度買返個：[https://www.name.com/referral/204a34](https://www.name.com/referral/204a34)）

    4.AMS S3帳號（如果你放喺個vps入面嘅話，可以跳過呢步）

    #

首先就梗係登入VPS，並更新系統（最好喺root啦）。

apt-get update && apt-get upgrade

跟住裝好一堆包

apt-get install -y python3-pip unzip docker.io nginx git letsencrypt

            pip3 install docker-compose

製作swapfile（唔係會電腦大爆炸）

fallocate -l 4G /swapfile chmod 600 /swapfile mkswap /swapfile swapon /swapfile echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

下載個mastodon嘅source code並進入目錄

git clone https://github.com/tootsuite/mastodon.git

            cd mastodon

用tag搵下最新版：

git tag -l

跟住選擇最新版：

git checkout <tag_name>

複製設定檔並編輯

 cp .env.production.sample .env.production

             nano .env.production

修改 Federation 部分

Federation LOCAL_DOMAIN=<your.domain> LOCAL_HTTPS=true

離開，跟住build：

docker-compose build

跟住gen 三條Key，並儲存好先（行1次1條，所以要行3次）：

docker-compose run –rm web rake secret

再打開設定檔：

nano .env.production

將key填入下面三行：

Application secrets # Generate each with the rake secret task (docker-compose run –rm web rake secret if you use docker compose) PAPERCLIP_SECRET=<key1> SECRET_KEY_BASE=<key2> OTP_SECRET=<key3>

（可選）如果您需要，請填入SMTP部分，最簡單嘅你可以註冊一個Gmail帳號然後問Google：

E-mail configuration

Note: Mailgun and SparkPost (https://sparkpo.st/smtp) each have good free tiers

            SMTP_SERVER=<smtp.domain.here>

            SMTP_PORT=587 SMTP_LOGIN=<login_id>

            SMTP_PASSWORD=<password>

            SMTP_FROM_ADDRESS=<FROM_ADDRESS> #啫係顯示喺收件人度嘅來源電郵 #SMTP_DELIVERY_METHOD=smtp

SMTP_AUTH_METHOD=plain

SMTP_OPENSSL_VERIFY_MODE=peer

SMTP_ENABLE_STARTTLS_AUTO=true

（可選）跟住喺AMS S3 嘅設定，若果你肯定你嘅VPS空間足夠嘅，或者唔知發生咩事嘅都可以跳過（你可以到 https://console.aws.amazon.com/iam/home?region=ap-northeast-1#/security_credential 生成Access Key）：

S3 (optional)

            S3_ENABLED=true

            S3_BUCKET=<bucket name>

            AWS_ACCESS_KEY_ID= <ACCESS_KEY>

            AWS_SECRET_ACCESS_KEY=<ACCESS_KEY_SECRET>

            S3_REGION=ap-northeast-1 #呢個喺日本東京，唔喺呢個嘅你要搵返係咩

            S3_PROTOCOL=https

跟住init個database：

sudo docker-compose run –rm web rails db:migrate

            sudo docker-compose run –rm web rails assets:precompile 

等佢行完之後推起個Mastodon：

sudo docker-compose up -d

咁佢就會喺yourip:3000度行。

#

咁3000port就好肉酸嘅，之後我哋嚟設定nginx同SSL，畀個domain佢（你包容到HTTP嘅可以跳過嘅）：

打開設定檔一號：

sudo nano /etc/nginx/sites-available/default

喺呢個function嘅內部：

server {

            listen 80 default_server;

            listen [::]:80 default_server;

            }

鍵入：

location ~ /.well-known { allow all; }

     

    測試有無錯：

nginx -t

    重開：

systemctl restart nginx

    之後開始set-up ssl：

letsencrypt certonly -a webroot –webroot-path=/var/www/html -d your.domain -d sub.your.domain

    跟住做，ok之後可以檢查下有無成功出到letsencrypt嘅key：

ls -l /etc/letsencrypt/live/your_domain_name

    出自己嘅ssl key：

openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

    跟住繼續改設定檔：

nano /etc/nginx/snippets/ssl-your.domain.conf

    加入兩行：

ssl_certificate /etc/letsencrypt/live/your.domain/fullchain.pem;

            ssl_certificate_key /etc/letsencrypt/live/your.domain/privkey.pem;

    再修改ssl 嘅 params conf：

sudo nano /etc/nginx/snippets/ssl-params.conf

    內文（原則上應該冇嘢要改嘅）：

from https://cipherli.st/

            # and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html

            ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

            ssl_prefer_server_ciphers on;

            ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";

            ssl_ecdh_curve secp384r1;

            ssl_session_cache shared:SSL:10m;

            ssl_session_tickets off;

            ssl_stapling on;

            ssl_stapling_verify on;

            resolver 8.8.8.8 8.8.4.4 valid=300s;

            resolver_timeout 5s;

            # Disable preloading HSTS for now.  You can use the commented out header line that includes

            # the "preload" directive if you understand the implications.

            #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";

            add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";

            add_header X-Frame-Options DENY;

            add_header X-Content-Type-Options nosniff;

            ssl_dhparam /etc/ssl/certs/dhparam.pem;

    之後開啓做port forwarding：

nano /etc/nginx/sites-enabled/mastodon_nginx.conf

    內文：

map $http_upgrade $connection_upgrade {

              default upgrade;

              ''      close;

            }

            server {

              listen 80;

              listen [::]:80;

              server_name your.domain;

              # Useful for Let's Encrypt

              location /.well-known/acme-challenge/ { allow all; }

              location / { return 301 https://$host$request_uri; }

            }

            server {

              listen 443 ssl;

              listen [::]:443 ssl;

              server_name your.domain;

              ssl_protocols TLSv1.2;

              ssl_ciphers EECDH+AESGCM:EECDH+AES;

              ssl_ecdh_curve prime256v1;

              ssl_prefer_server_ciphers on;

              ssl_session_cache shared:SSL:10m;

              ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;

              ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

              ssl_dhparam         /etc/ssl/certs/dhparam.pem;

              keepalive_timeout    70;

              sendfile             on;

              client_max_body_size 0;

              root /home/mastodon/live/public;

              gzip on;

              gzip_disable "msie6";

              gzip_vary on;

              gzip_proxied any;

              gzip_comp_level 6;

              gzip_buffers 16 8k;

              gzip_http_version 1.1;

              gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

              add_header Strict-Transport-Security "max-age=31536000";

              location / {

                try_files $uri @proxy;

              }

              location @proxy {

                proxy_set_header Host $host;

                proxy_set_header X-Real-IP $remote_addr;

                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

                proxy_set_header X-Forwarded-Proto https;

                proxy_set_header Proxy "";

                proxy_pass_header Server;

                proxy_pass http://127.0.0.1:3000;

                proxy_buffering off;

                proxy_redirect off;

                proxy_http_version 1.1;

                proxy_set_header Upgrade $http_upgrade;

                proxy_set_header Connection $connection_upgrade;

                tcp_nodelay on;

              }

              location /api/v1/streaming {

                proxy_set_header Host $host;

                proxy_set_header X-Real-IP $remote_addr;

                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

                proxy_set_header X-Forwarded-Proto https;

                proxy_set_header Proxy "";

                proxy_pass http://localhost:4000;

                proxy_buffering off;

                proxy_redirect off;

                proxy_http_version 1.1;

                proxy_set_header Upgrade $http_upgrade;

                proxy_set_header Connection $connection_upgrade;

                tcp_nodelay on;

              }

              error_page 500 501 502 503 504 /500.html;

            }

    記得set好你啲DNS record，跟住重開：

systemctl restart nginx

    就應該得架啦。

    之後打開網頁，註冊。

     如果你要人手驗證嘅話鍵入：

docker-compose run –rm web rails mastodon:confirm_email USER_EMAIL=<[email protected]>

    要變人做管理員鍵入：

sudo docker-compose run –rm web rails mastodon:make_admin USERNAME=<username>

    完，多謝收睇，以下喺常用Command嘅時間。

    #

    #下載最新嘅source code

git clone https://github.com/tootsuite/mastodon.git cd mastodon

    #del咗隻app

docker-compose down

    #重新部署隻app

docker-compose build

    #更新database

docker-compose run –rm web rails db:migrate docker-compose run –rm web rails assets:precompile

    #行隻app as deamon services

docker-compose up -d

    #開個docker app同時睇log（ctrl+C會熄咗隻app）

docker-compose up

    #將某人變做管理員

docker-compose run –rm web rails mastodon:make_admin USERNAME=<username>

    #人手驗證：

docker-compose run –rm web rails mastodon:confirm_email USER_EMAIL=<[email protected]>

    #

    Ref：

    [AWSのEC2で最小限の努力でmastodonを構築する – tsuitta_dayo@Qiita](http://qiita.com/tsuitta_dayo/items/dfd659ec68435653d16a)

    [DockerでMastodonをローカルで動かしてみた！ ので、その方法をご紹介。 – AKITA SOLUTION MAGAZINE](https://ai-create.net/magazine/2017/04/15/mastodonをdockerでローカルに構築してみた！-ので、その方/)

    [Deploying Mastodon on Digital Ocean – Ray Alez@Hackermoon](https://hackernoon.com/deploying-mastodon-on-digital-ocean-f54b94c7f5b8)

    [How To Secure Nginx with Let's Encrypt on Ubuntu 16.04 – Digital Ocean](https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-16-04)

    [Production Guide – Mastodon Docs](https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Production-guide.md)

    [xatier/Mastodon on GCE.md](https://gist.github.com/xatier/60894616c88695d2e5b7c9ddcb64305c)

    <your.domain><smtp.domain.here><[email protected]><[email protected]></[email protected]></[email protected]></smtp.domain.here></your.domain>