Commit 7377a389 authored by Luc Didry's avatar Luc Didry

First import

parents
Pipeline #131861 passed with stages
in 1 minute and 18 seconds
peertube-pillar-generator/public/peertube.sls
*.swp
image: hatsoftwares/salt-peertube:latest
pages:
script:
- cp pillar/peertube.sls peertube-pillar-generator/public/peertube.sls
- cd peertube-pillar-generator/
- yarn install -s --pure-lockfile
- NODE_ENV=production yarn run build
- mv dist/ ../public/
artifacts:
paths:
- public
only:
- master
DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
Version 2, December 2004
Copyright (C) 2004 Sam Hocevar <sam@hocevar.net>
Everyone is permitted to copy and distribute verbatim or modified
copies of this license document, and changing it is allowed as long
as the name is changed.
DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. You just DO WHAT THE FUCK YOU WANT TO.
# Salt formula for PeerTube installation
## What does it do?
This formula:
- installs [PeerTube](https://joinpeertube.org) with all its dependencies (PostgreSQL, Redis, NodeJs, Yarn…)
- configures it
- launches it
- configures rsyslog to put all PeerTube logs to /var/log/peertube/peertube.log
- installs and configures Nginx to serve PeerTube
- creates a [Let’s encrypt](https://letsencrypt.org/) certificate and configures Nginx to use it
- creates a cron task to warn you about the certificate expiration (even if the certificate should be automatically renewed)
- sets up a backup system (with [borg](https://borgbackup.readthedocs.io/) and `pg_dump`)
- can install and configure [`apticron`](https://packages.debian.org/stretch/apticron)
## How to use it?
Put `salt/peertube/` into your Salt formulas directory, use <https://fiat-tux.frama.io/hat-softwares/salt-peertube> to create the needed pillar configuration, put it into your pillar configuration, then you’re good to go.
## How to use it with salt-ssh?
All commands have to be run with the `root` user.
Install `salt-ssh`:
```
apt install salt-ssh
```
Modify `/etc/salt/roster`:
```
# You will need to authorize root to use SSH
# For security, authorize it only with SSH keys (PermitRootLogin prohibit-password in /etc/ssh/sshd_config)
my_server:
host: serveur.example.org
user: root
# Alternatively, you can use a regular user with sudo privilege
#my_server:
# host: serveur.example.org
# user: foo
# sudo: True
```
Let `salt-ssh` creates a pair of SSH keys (answer no to the question that will be asked):
```
salt-ssh my_server test.ping
```
Put `/var/lib/salt/pki/master/ssh/salt-ssh.rsa.pub` content in `/root/.ssh/authorized_keys` (or `~.ssh/authorized_keys` of the user you choose)
Copy the formula
```
cp -r salt pillar /srv/
```
Use <https://fiat-tux.frama.io/hat-softwares/salt-peertube> to create the needed pillar, put it into your pillar configuration, then you’re good to go.
```
salt-ssh my_server state.sls peertube
```
.DS_Store
node_modules
/dist
# local env files
.env.local
.env.*.local
# Log files
npm-debug.log*
yarn-debug.log*
yarn-error.log*
# Editor directories and files
.idea
.vscode
*.suo
*.ntvs*
*.njsproj
*.sln
*.sw?
# pillar-conf-generator
## Project setup
```
yarn install
```
### Compiles and hot-reloads for development
```
yarn run serve
```
### Compiles and minifies for production
```
yarn run build
```
### Run your tests
```
yarn run test
```
### Lints and fixes files
```
yarn run lint
```
### Customize configuration
See [Configuration Reference](https://cli.vuejs.org/config/).
module.exports = {
presets: [
'@vue/app'
]
}
{
"name": "peertube-pillar-generator",
"version": "0.1.0",
"private": true,
"scripts": {
"serve": "vue-cli-service serve",
"build": "vue-cli-service build",
"lint": "vue-cli-service lint"
},
"dependencies": {
"axios": "^0.18.0",
"bulma": "^0.7.4",
"bulma-extensions": "^6.2.5",
"core-js": "^2.6.5",
"filesize": "^4.1.2",
"js-yaml": "^3.13.1",
"vue": "^2.6.10"
},
"devDependencies": {
"@vue/cli-plugin-babel": "^3.7.0",
"@vue/cli-plugin-eslint": "^3.7.0",
"@vue/cli-service": "^3.7.0",
"babel-eslint": "^10.0.1",
"eslint": "^5.16.0",
"eslint-plugin-vue": "^5.0.0",
"node-sass": "^4.12.0",
"sass-loader": "^7.1.0",
"vue-template-compiler": "^2.5.21"
},
"eslintConfig": {
"root": true,
"env": {
"node": true
},
"extends": [
"plugin:vue/essential",
"eslint:recommended"
],
"rules": {
"no-console": 0,
"no-irregular-whitespace": 0
},
"parserOptions": {
"parser": "babel-eslint"
}
},
"postcss": {
"plugins": {
"autoprefixer": {}
}
},
"browserslist": [
"> 1%",
"last 2 versions"
]
}
<!DOCTYPE html>
<html lang="fr">
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width,initial-scale=1.0">
<link rel="icon" href="<%= BASE_URL %>favicon.ico">
<title>PeerTube pillar generator</title>
</head>
<body>
<noscript>
<strong>We're sorry but PeerTube pillar generator doesn't work properly without JavaScript enabled. Please enable it to continue.</strong>
</noscript>
<div id="app"></div>
<!-- built files will be auto injected -->
</body>
</html>
<template>
<section class="container content" id="app">
<h1 class="h1">Peertube pillar generator</h1>
<Form/>
<footer class="has-text-centered is-size-7">
Créé par <a href="https://fiat-tux.fr" target="_blank" rel="noreferrer">Luc Didry</a>
<a href="https://framagit.org/fiat-tux/hat-softwares/salt-peertube" target="_blank" rel="noreferrer">Source</a>
</footer>
</section>
</template>
<script>
import Form from './components/Form.vue'
export default {
name: 'app',
components: {
Form
}
}
</script>
<style lang="sass">
@import '../node_modules/bulma/sass/utilities/_all.sass'
@import '../node_modules/bulma/sass/base/_all.sass'
@import '../node_modules/bulma/sass/layout/section.sass'
@import '../node_modules/bulma/sass/grid/columns.sass'
@import '../node_modules/bulma/sass/elements/content.sass'
@import '../node_modules/bulma/sass/elements/container.sass'
@import '../node_modules/bulma/sass/elements/button.sass'
@import '../node_modules/bulma/sass/elements/tag.sass'
@import '../node_modules/bulma/sass/elements/form.sass'
@import '../node_modules/bulma-extensions/bulma-accordion/dist/css/bulma-accordion.sass'
.container
margin-top: 20px
margin-left: auto
margin-right: auto
max-width: 960px
footer
margin-top: 10px
</style>
This diff is collapsed.
import Vue from 'vue'
import App from './App.vue'
Vue.config.productionTip = false
new Vue({
render: h => h(App),
}).$mount('#app')
module.exports = {
publicPath: process.env.NODE_ENV === 'production' ? '/hat-softwares/salt-peertube/' : '/',
}
This diff is collapsed.
hosts:
my_server:
db_password: ''
apticron:
enabled: false
email: root
hostname: peertube.example.com
admin:
email: admin@example.com
smtp:
hostname: ''
port: 465
username: ''
password: ''
tls: true
disable_starttls: false
ca_file: ''
from_address: admin@example.com
search:
remote_uri:
users: true
anonymous: false
trending:
videos:
interval_days: 7
contact_form:
enabled: true
signup:
enabled: false
limit: 10
requires_email_verification: false
user:
video_quota: -1
video_quota_daily: -1
transcoding:
enabled: true
allow_additional_extensions: true
threads: 1
resolutions:
240p: false
360p: false
480p: false
720p: false
1080p: false
import:
videos:
http:
enabled: false
torrent:
enabled: false
instance:
name: 'PeerTube'
short_description: 'PeerTube, a federated (ActivityPub) video streaming platform using P2P (BitTorrent) directly in the web browser with WebTorrent and Angular.'
description: ''
terms: ''
default_client_route: '/videos/trending'
default_nsfw_policy: 'do_not_list'
base:
'*':
- peertube
#!/bin/bash
export BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK=yes
borg='/usr/bin/borg'
target='/var/www/peertube/daily_backups/borg/'
src='/var/www/peertube/'
exclude='-e /var/www/peertube/daily_backups/borg/ -e /var/www/peertube/storage/tmp/ -e /var/www/peertube/storage/cache/'
## Show me the backups
$borg list $target
## Backup Peertube
$borg create -v --stats $exclude $target::peertube-{now:%Y-%m-%d_%H-%M} $src
## Check the backups
$borg check $target
## Prune old backups
$borg prune -v --list --save-space -w 4 -d 10 --prefix='peertube' $target
#!/bin/bash
cd /var/www/peertube/versions
VERSION=$(curl -s https://api.github.com/repos/chocobozzz/peertube/releases/latest | grep tag_name | cut -d '"' -f 4) && echo "Latest Peertube version is $VERSION"
wget -q "https://github.com/Chocobozzz/PeerTube/releases/download/${VERSION}/peertube-${VERSION}.zip"
unzip -q peertube-${VERSION}.zip && rm peertube-${VERSION}.zip
cd /var/www/peertube/
ln -s versions/peertube-${VERSION} ./peertube-latest
cd ./peertube-latest && yarn install --production --pure-lockfile
/var/log/peertube/*log
{
rotate 52
dateext
weekly
missingok
notifempty
compress
sharedscripts
postrotate
invoke-rc.d rsyslog rotate > /dev/null
/bin/systemctl reload peertube.service
endscript
}
server {
listen 80;
listen [::]:80;
server_name {{settings.hostname}};
access_log /var/log/nginx/{{settings.hostname}}.access.log;
error_log /var/log/nginx/{{settings.hostname}}.error.log;
location /.well-known/acme-challenge/ {
default_type "text/plain";
root /var/www/certbot;
}
location / { return 301 https://$host$request_uri; }
}
#server {
# listen 443 ssl http2;
# listen [::]:443 ssl http2;
# server_name {{settings.hostname}};
#
# # For example with certbot (you need a certificate to run https)
# ssl_certificate /etc/letsencrypt/live/{{settings.hostname}}/fullchain.pem;
# ssl_certificate_key /etc/letsencrypt/live/{{settings.hostname}}/privkey.pem;
#
# # Security hardening (as of 11/02/2018)
# ssl_protocols TLSv1.2; # TLSv1.3, TLSv1.2 if nginx >= 1.13.0
# ssl_prefer_server_ciphers on;
# ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
# # ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0, not compatible with import-videos script
# ssl_session_timeout 10m;
# ssl_session_cache shared:SSL:10m;
# ssl_session_tickets off; # Requires nginx >= 1.5.9
# ssl_stapling on; # Requires nginx >= 1.3.7
# ssl_stapling_verify on; # Requires nginx => 1.3.7
#
# # Configure with your resolvers
# # resolver $DNS-IP-1 $DNS-IP-2 valid=300s;
# # resolver_timeout 5s;
#
# # Enable compression for JS/CSS/HTML bundle, for improved client load times.
# # It might be nice to compress JSON, but leaving that out to protect against potential
# # compression+encryption information leak attacks like BREACH.
# gzip on;
# gzip_types text/css text/html application/javascript;
# gzip_vary on;
#
# # Enable HSTS
# # Tells browsers to stick with HTTPS and never visit the insecure HTTP
# # version. Once a browser sees this header, it will only visit the site over
# # HTTPS for the next 2 years: (read more on hstspreload.org)
# #add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
#
# access_log /var/log/nginx/{{settings.hostname}}.access.log;
# error_log /var/log/nginx/{{settings.hostname}}.error.log;
#
# location ^~ '/.well-known/acme-challenge' {
# default_type "text/plain";
# root /var/www/certbot;
# }
#
# # Bypass PeerTube for performance reasons. Could be removed
# location ~ ^/client/(.*\.(js|css|woff2|otf|ttf|woff|eot))$ {
# add_header Cache-Control "public, max-age=31536000, immutable";
#
# alias /var/www/peertube/peertube-latest/client/dist/$1;
# }
#
# # Bypass PeerTube for performance reasons. Could be removed
# location ~ ^/static/(thumbnails|avatars)/ {
# if ($request_method = 'OPTIONS') {
# add_header 'Access-Control-Allow-Origin' '*';
# add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
# add_header 'Access-Control-Allow-Headers' 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
# add_header 'Access-Control-Max-Age' 1728000;
# add_header 'Content-Type' 'text/plain charset=UTF-8';
# add_header 'Content-Length' 0;
# return 204;
# }
#
# add_header 'Access-Control-Allow-Origin' '*';
# add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
# add_header 'Access-Control-Allow-Headers' 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
#
# # Cache 2 hours
# add_header Cache-Control "public, max-age=7200";
#
# root /var/www/peertube/storage;
#
# rewrite ^/static/(thumbnails|avatars)/(.*)$ /$1/$2 break;
# try_files $uri /;
# }
#
# location / {
# proxy_pass http://localhost:9000;
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header Host $host;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#
# # This is the maximum upload size, which roughly matches the maximum size of a video file
# # you can send via the API or the web interface. By default this is 8GB, but administrators
# # can increase or decrease the limit. Currently there's no way to communicate this limit
# # to users automatically, so you may want to leave a note in your instance 'about' page if
# # you change this.
# #
# # Note that temporary space is needed equal to the total size of all concurrent uploads.
# # This data gets stored in /var/lib/nginx by default, so you may want to put this directory
# # on a dedicated filesystem.
# #
# client_max_body_size 8G;
#
# proxy_connect_timeout 600;
# proxy_send_timeout 600;
# proxy_read_timeout 600;
# send_timeout 600;
# }
#
# # Bypass PeerTube for performance reasons. Could be removed
# location ~ ^/static/(webseed|redundancy)/ {
# # Clients usually have 4 simultaneous webseed connections, so the real limit is 3MB/s per client
# limit_rate 800k;
#
# if ($request_method = 'OPTIONS') {
# add_header 'Access-Control-Allow-Origin' '*';
# add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
# add_header 'Access-Control-Allow-Headers' 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
# add_header 'Access-Control-Max-Age' 1728000;
# add_header 'Content-Type' 'text/plain charset=UTF-8';
# add_header 'Content-Length' 0;
# return 204;
# }
#
# if ($request_method = 'GET') {
# add_header 'Access-Control-Allow-Origin' '*';
# add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
# add_header 'Access-Control-Allow-Headers' 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
#
# # Don't spam access log file with byte range requests
# access_log off;
# }
#
# root /var/www/peertube/storage;
#
# rewrite ^/static/webseed/(.*)$ /videos/$1 break;
# rewrite ^/static/redundancy/(.*)$ /redundancy/$1 break;
#
# try_files $uri /;
# }
#
# # Websocket tracker
# location /tracker/socket {
# # Peers send a message to the tracker every 15 minutes
# # Don't close the websocket before this time
# proxy_read_timeout 1200s;
# proxy_set_header Upgrade $http_upgrade;
# proxy_set_header Connection "upgrade";
# proxy_http_version 1.1;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# proxy_set_header Host $host;
# proxy_pass http://localhost:9000;
# }
#
# location /socket.io {
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# proxy_set_header Host $host;
#
# proxy_pass http://localhost:9000;
#
# # enable WebSockets
# proxy_http_version 1.1;
# proxy_set_header Upgrade $http_upgrade;
# proxy_set_header Connection "upgrade";
# }
#}
listen:
hostname: 'localhost'
port: 9000
# Correspond to your reverse proxy server_name/listen configuration
webserver:
https: true
hostname: '{{ settings.hostname }}'
port: 443
# Proxies to trust to get real client IP
# If you run PeerTube just behind a local proxy (nginx), keep 'loopback'
# If you run PeerTube behind a remote proxy, add the proxy IP address (or subnet)
trust_proxy:
- 'loopback'
# Your database name will be "peertube"+database.suffix
database:
hostname: 'localhost'
port: 5432
suffix: '_prod'
username: 'peertube'
password: '{{ settings.db_password }}'
pool:
max: 5
# Redis server for short time storage
# You can also specify a 'socket' path to a unix socket but first need to
# comment out hostname and port
redis:
hostname: 'localhost'
port: 6379
auth: null
db: 0
# SMTP server to send emails
smtp:
hostname: {{ settings.smtp.hostname|default('null') }}
port: {{ settings.smtp.port|default('465') }} # If you use StartTLS: 587
username: {{ settings.smtp.username|default('null') }}
password: {{ settings.smtp.password|default('null') }}
tls: {{ settings.smtp.tls|default('true') }} # If you use StartTLS: false
disable_starttls: {{ settings.smtp.disable_starttls|default('false') }}
ca_file: {{ settings.smtp.ca_file|default('null') }} # Used for self signed certificates
from_address: '{{ settings.smtp.from_address|default('admin@example.com') }}'
# From the project root directory
storage:
tmp: '/var/www/peertube/storage/tmp/' # Used to download data (imports etc), store uploaded files before processing...
avatars: '/var/www/peertube/storage/avatars/'
videos: '/var/www/peertube/storage/videos/'
redundancy: '/var/www/peertube/storage/videos/'
logs: '/var/www/peertube/storage/logs/'
previews: '/var/www/peertube/storage/previews/'
thumbnails: '/var/www/peertube/storage/thumbnails/'
torrents: '/var/www/peertube/storage/torrents/'
captions: '/var/www/peertube/storage/captions/'
cache: '/var/www/peertube/storage/cache/'
log:
level: 'info' # debug/info/warning/error
search:
# Add ability to fetch remote videos/actors by their URI, that may not be federated with your instance
# If enabled, the associated group will be able to "escape" from the instance follows
# That means they will be able to follow channels, watch videos, list videos of non followed instances
remote_uri:
users: {{ settings.search.remote_uri.users|default('true') }}
anonymous: {{ settings.search.remote_uri.anonymous|default('false') }}
trending:
videos:
interval_days: {{ settings.trending.videos.interval_days|default('7') }} # Compute trending videos for the last x days
# Cache remote videos on your server, to help other instances to broadcast the video
# You can define multiple caches using different sizes/strategies
# Once you have defined your strategies, choose which instances you want to cache in admin -> manage follows -> following
redundancy:
videos:
check_interval: '1 hour' # How often you want to check new videos to cache
strategies: # Just uncomment strategies you want
# -
# size: '10GB'
# # Minimum time the video must remain in the cache. Only accept values > 10 hours (to not overload remote instances)
# min_lifetime: '48 hours'
# strategy: 'most-views' # Cache videos that have the most views
# -
# size: '10GB'
# # Minimum time the video must remain in the cache. Only accept values > 10 hours (to not overload remote instances)
# min_lifetime: '48 hours'
# strategy: 'trending' # Cache trending videos
# -
# size: '10GB'
# # Minimum time the video must remain in the cache. Only accept values > 10 hours (to not overload remote instances)
# min_lifetime: '48 hours'
# strategy: 'recently-added' # Cache recently added videos
# min_views: 10 # Having at least x views
###############################################################################
#
# From this point, all the following keys can be overridden by the web interface
# (local-production.json file). If you need to change some values, prefer to
# use the web interface because the configuration will be automatically
# reloaded without any need to restart PeerTube.
#
# /!\ If you already have a local-production.json file, the modification of the
# following keys will have no effect /!\.
#
###############################################################################
cache:
previews:
size: 500 # Max number of previews you want to cache
captions:
size: 500 # Max number of video captions/subtitles you want to cache
admin:
# Used to generate the root user at first startup
# And to receive emails from the contact form
email: '{{ settings.admin.email|default('admin@example.com') }}'
contact_form:
enabled: {{ settings.contact_form.enabled|default('true') }}
signup:
enabled: {{ settings.signup.enabled|default('false') }}
limit: {{ settings.signup.limit|default('10') }} # When the limit is reached, registrations are disabled. -1 == unlimited
requires_email_verification: {{ settings.signup.requires_email_verification|default('false') }}
filters:
cidr: # You can specify CIDR ranges to whitelist (empty = no filtering) or blacklist
whitelist: []
blacklist: []
user:
# Default value of maximum video BYTES the user can upload (does not take into account transcoded files).
# -1 == unlimited
video_quota: {{ settings.user.video_quota|default('-1') }}
video_quota_daily: {{ settings.user.video_quota_daily|default('-1') }}
# If enabled, the video will be transcoded to mp4 (x264) with "faststart" flag
# In addition, if some resolutions are enabled the mp4 video file will be transcoded to these new resolutions.
# Please, do not disable transcoding since many uploaded videos will not work
transcoding:
enabled: {{ settings.transcoding.enabled|default('true') }}
# Allow your users to upload .mkv, .mov, .avi, .flv videos
allow_additional_extensions: {{ settings.transcoding.allow_additional_extensions|default('true') }}
threads: {{ settings.transcoding.threads|default('1') }}
resolutions: # Only created if the original video has a higher resolution, uses more storage!
240p: {{ settings.transcoding.resolutions['240p']|default('false') }}
360p: {{ settings.transcoding.resolutions['360p']|default('false') }}
480p: {{ settings.transcoding.resolutions['480p']|default('false') }}
720p: {{ settings.transcoding.resolutions['720p']|default('false') }}
1080p: {{ settings.transcoding.resolutions['1080p']|default('false') }}
import:
# Add ability for your users to import remote videos (from YouTube, torrent...)
videos:
http: # Classic HTTP or all sites supported by youtube-dl https://rg3.github.io/youtube-dl/supportedsites.html
enabled: {{ settings.import.videos.http.enabled|default('false') }}
torrent: # Magnet URI or torrent file (use classic TCP/UDP/WebSeed to download the file)
enabled: {{ settings.import.videos.torrent.enabled|default('false') }}
# Instance settings
instance:
name: '{{ settings.instance.name|default('PeerTube') }}'
short_description: '{{ settings.instance.short_description|default('PeerTube, a federated (ActivityPub) video streaming platform using P2P (BitTorrent) directly in the web browser with WebTorrent and Angular.') }}'
description: '{{ settings.instance.description }}' # Support markdown
terms: '{{ settings.instance.terms }}' # Support markdown
default_client_route: '{{ settings.instance.default_client_route|default('/videos/trending')}}'
# By default, "do_not_list" or "blur" or "display" NSFW videos
# Could be overridden per user with a setting
default_nsfw_policy: '{{ settings.instance.default_nsfw_policy|default('do_not_list') }}'
customizations:
javascript: '' # Directly your JavaScript code (without <script> tags). Will be eval at runtime
css: '' # Directly your CSS code (without <style> tags). Will be injected at runtime