From bf215d889117800f14a7159cef15b72a817a02b8 Mon Sep 17 00:00:00 2001 From: Dan Anglin Date: Fri, 17 Nov 2023 21:48:54 +0000 Subject: [PATCH] chore: upgrade GTS to v0.12.0 and update config --- config | 2 +- templates/gotosocial/config.yaml.gotmpl | 83 ++++++++++++++++++++----- 2 files changed, 70 insertions(+), 15 deletions(-) diff --git a/config b/config index 508d804..2e25386 160000 --- a/config +++ b/config @@ -1 +1 @@ -Subproject commit 508d80446baea296ac3066f6e0a36fe090792fa9 +Subproject commit 2e25386f4f48da38e34b0ea259b04f310d1a3c91 diff --git a/templates/gotosocial/config.yaml.gotmpl b/templates/gotosocial/config.yaml.gotmpl index 6929cfe..20ad7ea 100644 --- a/templates/gotosocial/config.yaml.gotmpl +++ b/templates/gotosocial/config.yaml.gotmpl @@ -35,6 +35,17 @@ log-db-queries: false # Default: true log-client-ip: true +# String. Format to use for the timestamp in log lines. +# If set to the empty string, the timestamp will be +# ommitted from the logs entirely. +# +# The format must be compatible with Go's time.Layout, as +# documented on https://pkg.go.dev/time#pkg-constants. +# +# Examples: [true, false] +# Default: "02/01/2006 15:04:05.000" +log-timestamp-format: "02/01/2006 15:04:05.000" + # String. Application name to use internally. # Examples: ["My Application","gotosocial"] # Default: "gotosocial" @@ -70,7 +81,7 @@ host: "{{ .GoToSocial.Subdomain }}.{{ .RootDomain }}" # DO NOT change this after your server has already run once, or you will break things! # # Please read the appropriate section of the installation guide before you go messing around with this setting: -# https://docs.gotosocial.org/installation_guide/advanced/#can-i-host-my-instance-at-fediexampleorg-but-have-just-exampleorg-in-my-username +# https://docs.gotosocial.org/en/latest/advanced/host-account-domain/ # # Examples: ["example.org","server.com"] # Default: "" @@ -260,6 +271,21 @@ web-asset-base-dir: "{{ .GoToSocial.WebBaseDirectory }}/assets/" # Config pertaining to instance federation settings, pages to hide/expose, etc. +# String. Federation mode to use for this instance. +# +# "blocklist" -- open federation by default. Only instances that are explicitly +# blocked will be denied (unless they are also explicitly allowed). +# +# "allowlist" -- closed federation by default. Only instances that are explicitly +# allowed will be able to interact with this instance. +# +# For more details on blocklist and allowlist modes, check the documentation at: +# https://docs.gotosocial.org/en/latest/admin/federation_modes +# +# Options: ["blocklist", "allowlist"] +# Default: "blocklist" +instance-federation-mode: "blocklist" + # Bool. Allow unauthenticated users to make queries to /api/v1/instance/peers?filter=open in order # to see a list of instances that this instance 'peers' with. Even if set to 'false', then authenticated # users (members of the instance) will still be able to query the endpoint. @@ -268,9 +294,12 @@ web-asset-base-dir: "{{ .GoToSocial.WebBaseDirectory }}/assets/" instance-expose-peers: false # Bool. Allow unauthenticated users to make queries to /api/v1/instance/peers?filter=suspended in order -# to see a list of instances that this instance blocks/suspends. This will also allow unauthenticated -# users to see the list through the web UI. Even if set to 'false', then authenticated users (members -# of the instance) will still be able to query the endpoint. +# to see a list of instances that this instance blocks/suspends. Even if set to 'false', then authenticated +# users (members of the instance) will still be able to query the endpoint. +# +# WARNING: Setting this variable to 'true' may result in your instance being scraped by blocklist scrapers. +# See: https://docs.gotosocial.org/en/latest/admin/domain_blocks/#block-announce-bots +# # Options: [true, false] # Default: false instance-expose-suspended: false @@ -606,7 +635,7 @@ oidc-client-secret: "" # Array of string. Scopes to request from the OIDC provider. The returned values will be used to # populate users created in GtS as a result of the authentication flow. 'openid' and 'email' are required. # 'profile' is used to extract a username for the newly created user. -# 'groups' is optional and can be used to determine if a user is an admin (if they're in the group 'admin' or 'admins'). +# 'groups' is optional and can be used to determine if a user is an admin based on oidc-admin-groups. # Examples: See eg., https://auth0.com/docs/scopes/openid-connect-scopes # Default: ["openid", "email", "profile", "groups"] oidc-scopes: @@ -712,21 +741,19 @@ request-id-header: "X-Request-Id" # Default: false tracing-enabled: false -# String. Set the transport protocol for the tracing system. Can either be "grpc" for -# OTLP gRPC or "jaeger" for jaeger based ingesters. -# Options: ["grpc", "jaeger"] +# String. Set the transport protocol for the tracing system. Can either be "grpc" +# for OTLP gRPC, or "http" for OTLP HTTP. +# Options: ["grpc", "http"] # Default: "grpc" tracing-transport: "grpc" -# String. Endpoint of the trace ingester. When using the gRPC based transport, the -# endpoint is usually a single address/port combination. For the jaeger transport it -# should be a fully qualified URL. -# OTLP gRPC or "jaeger" for jaeger based ingesters -# Examples: ["localhost:4317", "http://localhost:14268/api/traces"] +# String. Endpoint of the trace ingester. When using the gRPC or HTTP based transports, +# provide the endpoint as a single address/port combination without a protocol scheme. +# Examples: ["localhost:4317"] # Default: "" tracing-endpoint: "" -# Bool. Disable HTTPS for the gRPC transport protocol. +# Bool. Disable TLS for the gRPC and HTTP transport protocols. # Default: false tracing-insecure-transport: false @@ -836,6 +863,34 @@ advanced-cookies-samesite: "lax" # Default: 300 advanced-rate-limit-requests: 300 +# Array of string. CIDRs to except from rate limit restrictions. +# Any IPs inside the CIDR range(s) will not have rate limiting +# applied on their requests, and rate limit headers will not be +# set for those requests. +# +# This can be useful in the following example cases (and probably +# a bunch of others as well): +# +# 1. You've set up an automated service that uses the API, and +# it keeps getting rate limited, even though you trust it's +# not abusing the instance. +# +# 2. You live with multiple people who use the same instance, +# and you're all using the same router/NAT, so you all have +# the same IP address, and you keep rate limiting each other. +# +# 3. You mostly use your own home internet to access your instance, +# and you want to exempt your home internet from rate limiting. +# +# You should be careful when adjusting this setting, since you +# might inadvertently make rate limiting useless if you set too +# wide a range. If in doubt, be too restrictive rather than too +# lenient, and adjust as you go. +# +# Example: ["192.168.0.0/16"] +# Default: [] +advanced-rate-limit-exceptions: [] + # Int. Amount of open requests to permit per CPU, per router grouping, before applying http # request throttling. Any requests beyond the calculated limit are held in a backlog queue for # up to 30 seconds before either being processed or timing out. Requests that don't fit in the backlog